Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522718
MD5:	6aecfc2ede0f22d0add919214de21a83
SHA1:	c2c87ef0d333c4c56cdc2dcb52fd4d7c4902b2ec
SHA256:	64aa700db7bb8d9f836e59ce259a47bce371dc0c60cba660ce51edef945d679d
Tags:	exeuser-jstrosch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6644 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6AECFC2EDE0F22D0ADD919214DE21A83)

conhost.exe (PID: 6624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 3492 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 508 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.0% probability

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004093C8 FindFirstFileW,FindClose,	0_2_004093C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00429570 FindFirstFileW,FindNextFileW,FindClose,	0_2_00429570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041E578 FindFirstFileW,FindClose,	0_2_0041E578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408DFC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	0_2_00408DFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041DF90 FindFirstFileW,FindNextFileW,FindClose,GetLastError,	0_2_0041DF90

Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe	String found in binary or memory: https://www.abyssmedia.com

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408090	0_2_00408090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042CAC4	0_2_0042CAC4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040FCAC	0_2_0040FCAC

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 508

Source: file.exe, 00000000.00000000.1696205746.0000000000454000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename" vs file.exe
Source: file.exe	Binary or memory string: OriginalFilename" vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal60.winEXE@3/6@0/0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004151D0 GetDiskFreeSpaceW,

0_2_004151D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0042EF38 FindResourceW,LoadResource,LockResource,SizeofResource,FreeResource,

0_2_0042EF38

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6624:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6644

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\49ad28af-b7ed-4263-8b81-3101fdabf7e2

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 508

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll			Jump to behavior

Source: file.exe

Static PE information: section name: .didata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00432310 push 004323ADh; ret	0_2_004323A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042F0E0 push 0042F110h; ret	0_2_0042F108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A9F0 push 0041AA3Eh; ret	0_2_0041AA36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004119F8 push ecx; mov dword ptr [esp], eax	0_2_004119FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041E184 push 0041E1C2h; ret	0_2_0041E1BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A2A8 push 0041A39Dh; ret	0_2_0041A395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00411ABC push ecx; mov dword ptr [esp], eax	0_2_00411ABE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042EB28 push 0042EB60h; ret	0_2_0042EB58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042DBDC push ecx; mov dword ptr [esp], ecx	0_2_0042DBE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041744C push 004174CDh; ret	0_2_004174C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042B544 push 0042B592h; ret	0_2_0042B58A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004275FC push 0042775Fh; ret	0_2_004276DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004275FC push 0042775Fh; ret	0_2_00427757
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00411DA8 push 00411DE0h; ret	0_2_00411DD8

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 7.3 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004093C8 FindFirstFileW,FindClose,	0_2_004093C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00429570 FindFirstFileW,FindNextFileW,FindClose,	0_2_00429570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041E578 FindFirstFileW,FindClose,	0_2_0041E578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408DFC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	0_2_00408DFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041DF90 FindFirstFileW,FindNextFileW,FindClose,GetLastError,	0_2_0041DF90

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00409C44 GetSystemInfo,

0_2_00409C44

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_0-17292

Source: C:\Users\user\Desktop\file.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004056AC cpuid

0_2_004056AC

Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	0_2_00409500
Source: C:\Users\user\Desktop\file.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetUserDefaultLCID,GetLocaleInfoW,GetUserDefaultLCID,GetTimeFormatW,	0_2_0041B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00419880
Source: C:\Users\user\Desktop\file.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004089A0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00419A68
Source: C:\Users\user\Desktop\file.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetUserDefaultLCID,GetLocaleInfoW,GetUserDefaultLCID,GetDateFormatW,GetUserDefaultLCID,GetDateFormatW,GetUserDefaultLCID,GetDateFormatW,GetLastError,	0_2_0041B374
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00416CE4
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00416D30
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0041AD3C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041B8F0 GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetUserDefaultLCID,GetLocaleInfoW,GetUserDefaultLCID,GetTimeFormatW,

0_2_0041B8F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A8B6 GetVersionExW,

0_2_0040A8B6

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	26 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	55%	ReversingLabs	Win32.Trojan.Ulise
file.exe	100%	Avira	TR/Redcap.cafuo

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.abyssmedia.com	file.exe	false		unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522718
Start date and time:	2024-09-30 15:57:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal60.winEXE@3/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 16 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:58:17	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_71e4f97fcad7bd8af59197fe7fdb89b6f66cc6a_89969336_9d5f8a6b-4665-44cb-89ec-0ff41a3c22d9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7305092461365446
Encrypted:	false
SSDEEP:	192:CA8uPXwTevTPrl0Wj7YcI3jcqzuiFGZ24IO8TVBGi:CU4TwTqWfYbj5zuiFGY4IO8XGi
MD5:	9A8F37BED9E0D1534555FACB5261FD8D
SHA1:	352030F9CF0AF0A1B9CF7B2C7D822C6B0BFEA5F3
SHA-256:	FF59C87BA5217CAB39282508CBFB26EF492CD556CD65E0F7B02DC6323D624EA8
SHA-512:	C772124B2A0490A04BE241633D0CBAB4836CE1DA721F176CBDB99EA7091C113240201EDF1E43E50EA6D26AA99B04C19E517A8BD60CFAEB554F9336E340CCE920
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.1.7.8.2.8.4.6.5.5.9.0.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.1.7.8.2.8.5.0.3.0.8.7.8.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.d.5.f.8.a.6.b.-.4.6.6.5.-.4.4.c.b.-.8.9.e.c.-.0.f.f.4.1.a.3.c.2.2.d.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.7.1.d.6.3.a.1.-.2.4.9.4.-.4.b.a.f.-.a.0.e.b.-.8.e.f.f.a.0.1.7.8.6.4.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.4.-.0.0.0.1.-.0.0.1.4.-.a.8.6.a.-.e.8.c.4.4.0.1.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.2.4.e.5.0.4.b.a.9.3.f.3.7.5.c.4.e.7.b.b.a.f.1.8.7.9.d.7.8.1.e.0.0.0.0.0.9.0.4.!.0.0.0.0.c.2.c.8.7.e.f.0.d.3.3.3.c.4.c.5.6.c.d.c.2.d.c.b.5.2.f.d.4.d.7.c.4.9.0.2.b.2.e.c.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5517.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Sep 30 13:58:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35816
Entropy (8bit):	1.948888161259869
Encrypted:	false
SSDEEP:	192:Mg3lq6tH8JtOvmNWZ9enGQbw6QxxwF7eMF:vAwJo8sDfQ4F
MD5:	6993E53FAD2C8694ADDD52A170291DCA
SHA1:	E255C3E55F3390413B1D3F7FB172F7AE24130A97
SHA-256:	CE51CFC36F3AC132D29601E9AAC40EF74C329F5047F1A4686B2F5B58B1F8C0C0
SHA-512:	D71988624D96E8D17F8B42CD0453156F6D9D3DAC0DF48509F6BAAB082355468635D7A21D47ECAA48221015B1B8019DEDE0D900EF864DB5418BEA6B2205736AC5
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......l..f........................................x ..........T.......8...........T...........`....w..........\|...........h...............................................................................eJ..............GenuineIntel............T...........k..f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5585.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8264
Entropy (8bit):	3.6892511934779812
Encrypted:	false
SSDEEP:	192:R6l7wVeJICk6m/6Y9KSU9bxegmfBv9WJ1xpr789bX8sf8dm:R6lXJs6m6YQSU9bxegmfz4gXPfL
MD5:	A531809040B905FEFB23FBEFA9A2E208
SHA1:	8B839BFBEC0D4899AD98E521011F164275423412
SHA-256:	D228E00BBE93DA19E797B0872089D3DD561E45772FFC097ACFB458573E2D8F4D
SHA-512:	AD77EB181E999EE29CE7F4C458120E9F62DDDDEBA8E5822A6766F9F4C32D92A579857B4FAF1EBF9762DC65B671B27D18A2844828BD90800D36A63CF7923BEEE7
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER55C5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.429274436238106
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI9/DrEWpW8VYpYm8M4J6upFSO+q8FjD1F8bVhed:uIjfeI75Drd7VFJCOMubVhed
MD5:	7C5D100DCBC06AEE4B6364E25A98F08D
SHA1:	BA89B082D5556A159B7154DE3CAF25BE9DF07632
SHA-256:	0C2A2958A076B746957038D660A61B6BB1FAAB6C06C90E387E9A17028CDFDE5E
SHA-512:	CFBF2F9E687460E2592CE1E5381711A9857D3EF78C66B97751AEB181755810C9573FED8718DE0AAC1CCA172FA84087B2AEA281971BC60FE830F111958AC93854
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="523020" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4653700044436
Encrypted:	false
SSDEEP:	6144:vIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbo:AXD94+WlLZMM6YFH1+o
MD5:	647395672846865397B1707BCAF045E9
SHA1:	CD10C1592B1110D5457E3916DED3621089ACCA49
SHA-256:	C6D0D2E18C11C86B6E17FFF3DB74EC687B693F8DF1F492E8DA47635AA1B6D98F
SHA-512:	70FA31E8E20B2E5F2C3A59B0AFB03EBF69EC6DB3401AC070A6493CC14BA9127AC09FB953C9F7E6313A7F8DD52EF197A1509F32652857A460D10DFB088CEF705C
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmBAB.@.................................................................................................................................................................................................................................................................................................................................................U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.362817182138386
Encrypted:	false
SSDEEP:	3:YX7/FCp7/FaBktRNVFDe8yLALwqQFNV0owvn:YXBA1tRHFixLAsXUowvn
MD5:	9D70D97D77237FF5E8E515812D35A794
SHA1:	B12CF9D743825BA7552E6530CD3284D268901D1E
SHA-256:	E28851B7C00C0007E12E148A3669BDDBDA4F5436BA6D8F8CDBEF866F0FD639E3
SHA-512:	391F283B27A1B04C08CEA56577A2A7551D33287A9C7F84C75DE9DC1490A2105D01B66D10E7B4BF982BE234EDE6EE5656712D8E915BF3119810E3A91829C02946
Malicious:	false
Reputation:	low
Preview:	Exception EExternalException in module file.exe at 00032553...External exception 80000001.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.342809552882167
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	file.exe
File size:	247'808 bytes
MD5:	6aecfc2ede0f22d0add919214de21a83
SHA1:	c2c87ef0d333c4c56cdc2dcb52fd4d7c4902b2ec
SHA256:	64aa700db7bb8d9f836e59ce259a47bce371dc0c60cba660ce51edef945d679d
SHA512:	4431cbe661c002b003d03707873c83cf45d72e4d6a55fc429983ef9fbfb94bf8a151776afddb4aa33d9e70d4a657b879e813d5ce248ed32bfe0f69e42702e71a
SSDEEP:	3072:EFnAqcUJYKwCRmkuMRub1hKjTBp9q81sAarKzRVk0UwwQFFwBhY7m0R4uvV+sWVX:EFA9D3Cb5BvVurKzR6Ql7PR4uvV+sWVX
TLSH:	A1344B21F6B04C77FCA0363C48B5AE20A83FBF612935585A5AD5CE0DCDA87516C24B6F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x432408
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x63FD37C5 [Mon Feb 27 23:07:49 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	a23e906a3949b729caf5252cca3e2436

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
mov ecx, 00000005h
push 00000000h
push 00000000h
dec ecx
jne 00007FAB687F3C2Bh
push ebx
push esi
push edi
mov eax, dword ptr [00435138h]
mov byte ptr [eax], 00000001h
mov eax, 0042F114h
call 00007FAB687CB639h
mov esi, 0044EA78h
xor eax, eax
push ebp
push 0043284Ch
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov edx, 0044EA74h
mov eax, 0042EB74h
call 00007FAB687CB377h
mov eax, dword ptr [00435070h]
xor edx, edx
mov dword ptr [eax], edx
mov eax, dword ptr [00434FDCh]
mov byte ptr [eax], 00000000h
mov eax, dword ptr [00434E70h]
mov byte ptr [eax], 00000001h
mov al, 01h
call 00007FAB687C549Bh
mov eax, dword ptr [00435038h]
movzx eax, word ptr [eax]
mov edx, dword ptr [00435008h]
mov dword ptr [edx], eax
push 00000000h
call 00007FAB687DBD78h
push 00000000h
mov eax, dword ptr [00434F1Ch]
mov ecx, 00000001h
mov edx, dword ptr [0041A4C8h]
call 00007FAB687C9BA1h
add esp, 04h
push 00000000h
mov eax, dword ptr [00435154h]
mov ecx, 00000001h
mov edx, dword ptr [0041A4F8h]
call 00007FAB687C9B87h
add esp, 04h
mov dl, 01h
mov eax, dword ptr [0042EB8Ch]
call 00007FAB687F0530h
mov ebx, eax
mov cl, 01h
mov edx, 00432868h
mov eax, ebx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f000	0x1690	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x39c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0x3bfc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4f464	0x360	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x51000	0x154	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x30278	0x30400	807e6bc6e9d85fffec10d6334d0864ea	False	0.4723324158031088	data	6.339345262683559	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x32000	0x898	0xa00	21e2297d5d83a14b3c3e6a714602540f	False	0.56640625	data	5.606376089772764	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x33000	0x2244	0x2400	57356af26eab43fbfb0619f07bb22c81	False	0.4635416666666667	data	4.5093245997612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x36000	0x18a80	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4f000	0x1690	0x1800	2193ef0275c1f12cfd67fc09fade29dc	False	0.3121744791666667	data	4.896486827036879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x51000	0x154	0x200	6de21e24620a89ab2e2905a0e4915a2b	False	0.310546875	data	2.432645247523557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x52000	0xc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x53000	0x18	0x200	272af25f48168b97f4538cbb5693615c	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "E"	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0x3bfc	0x3c00	9cf473c658767053ad651cc6b3eac91c	False	0.636328125	data	6.643887780687566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x58000	0x39c8	0x3a00	1388b5a631f83e74d554866889a09fe5	False	0.2848195043103448	data	3.6591492278320907	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_DIALOG	0x583b8	0x28	Non-ISO extended-ASCII text, with CR, NEL line terminators			1.275
RT_DIALOG	0x583e0	0x4	ISO-8859 text, with no line terminators			3.0
RT_DIALOG	0x583e4	0x80	data			1.0078125
RT_STRING	0x58464	0xac4	data			0.31712626995645865
RT_STRING	0x58f28	0x6d0	data			0.34174311926605505
RT_STRING	0x595f8	0x5d0	data			0.3326612903225806
RT_STRING	0x59bc8	0x7e0	data			0.31398809523809523
RT_STRING	0x5a3a8	0x310	data			0.3711734693877551
RT_STRING	0x5a6b8	0x328	data			0.3910891089108911
RT_STRING	0x5a9e0	0x1fc	data			0.4862204724409449
RT_STRING	0x5abdc	0xc4	data			0.6428571428571429
RT_STRING	0x5aca0	0x170	data			0.5597826086956522
RT_STRING	0x5ae10	0x328	data			0.422029702970297
RT_STRING	0x5b138	0x354	data			0.4107981220657277
RT_STRING	0x5b48c	0x2b8	data			0.4367816091954023
RT_VERSION	0x5b744	0x27c	data	English	United States	0.4481132075471698
None	0x5b9c0	0x8	ASCII text, with no line terminators			2.0

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	MessageBoxA, CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsDBCSLeadByteEx, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetConsoleOutputCP, GetConsoleCP, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, SwitchToThread, GetCurrentThreadId, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, SetFilePointer, SetEndOfFile, ReadFile, GetFileType, GetFileSize, CreateFileW, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	MessageBoxW, LoadStringW, GetUserObjectInformationW, GetThreadDesktop, GetSystemMetrics, GetProcessWindowStation, CharUpperBuffW, CharUpperW
mpr.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetAddConnection2W
kernel32.dll	WriteFile, WriteConsoleW, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, TerminateProcess, SystemTimeToFileTime, SizeofResource, SetLocalTime, SetFilePointer, SetEvent, SetErrorMode, SetEnvironmentVariableW, SetCurrentDirectoryW, SetConsoleTitleW, SetConsoleTextAttribute, SetConsoleMode, SetConsoleCursorPosition, SetConsoleCtrlHandler, SearchPathW, ScrollConsoleScreenBufferW, ResetEvent, ReadFile, ReadConsoleW, MultiByteToWideChar, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, GetWindowsDirectoryW, GetVolumeInformationW, GetVersionExW, GetVersion, GetUserDefaultLCID, GetTimeFormatW, GetThreadLocale, GetSystemTime, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileType, GetFileSize, GetFileAttributesExW, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetEnvironmentStringsW, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentDirectoryW, GetConsoleTitleW, GetConsoleScreenBufferInfo, GetConsoleOutputCP, GetConsoleMode, GetCommandLineW, GetCPInfo, GetBinaryTypeW, FreeResource, FreeLibrary, FreeEnvironmentStringsW, FormatMessageW, FlushFileBuffers, FlushConsoleInputBuffer, FindResourceW, FindNextFileW, FindFirstFileW, FindClose, FillConsoleOutputAttribute, FileTimeToSystemTime, FileTimeToLocalFileTime, ExitProcess, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DuplicateHandle, DebugBreak, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CompareStringW, CloseHandle
advapi32.dll	RegSetValueExW, RegSetValueW, RegQueryValueExW, RegQueryValueW, RegOpenKeyExW, RegOpenKeyW, RegEnumKeyW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey
kernel32.dll	SetThreadUILanguage, SetEnvironmentStringsW, GetVDMCurrentDirectories
msvcrt.dll	_ltow, _ultow, _wtol, wcstoul, wcstol, _getch, _pipe, feof, ferror, fgets, _pclose, _wpopen, fflush, _dup2, _dup, _close, _get_osfhandle, _open_osfhandle
shell32.dll	ShellExecuteExW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 15:58:51.441318989 CEST	53	62457	162.159.36.2	192.168.2.4
Sep 30, 2024 15:58:51.923090935 CEST	53	60015	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	09:58:03
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	247'808 bytes
MD5 hash:	6AECFC2EDE0F22D0ADD919214DE21A83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:58:04
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:58:04
Start date:	30/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 508
Imagebase:	0x340000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	45

Executed Functions

Function 00409500 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,004095C0,?,?), ref: 00409532
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,004095C0,?,?), ref: 0040953B

Part of subcall function 004093C8: FindFirstFileW.KERNEL32(00000000,?,00000000,00409426,?,00000001), ref: 004093FB
Part of subcall function 004093C8: FindClose.KERNEL32(00000000,00000000,?,00000000,00409426,?,00000001), ref: 0040940B

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 5e425b5381f49e77debb17cb532570a91ce03e2471ae4a664c4b302440e7807d
Instruction ID: 071e64af6b88f542872354593d617c80015b1f849b8bb04898bb7fc151495cb3
Opcode Fuzzy Hash: 5e425b5381f49e77debb17cb532570a91ce03e2471ae4a664c4b302440e7807d
Instruction Fuzzy Hash: 7C116670A042099FDB04EBA6D992AADB3F8EF49304F50447EF905B32C2D7786F048769

Function 004093C8 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00409426,?,00000001), ref: 004093FB
FindClose.KERNEL32(00000000,00000000,?,00000000,00409426,?,00000001), ref: 0040940B

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b344a49cfde1689ea3054574d788de18550e4a209e79c5a6a29cb86aee5296c7
Instruction ID: 30c26af4e475a8533fb64ed181d0bc5ec4e7e29dd092294426818dad85e2bdff
Opcode Fuzzy Hash: b344a49cfde1689ea3054574d788de18550e4a209e79c5a6a29cb86aee5296c7
Instruction Fuzzy Hash: 35F0E271908608AEC710EBB5DD1295EB3ECEB493247A109B7B800F25C2EA3CAF10951D

Function 00409C44 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00409C48

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 77aadbaf1419b8ce617d9818894e266f742206cc870b6c8e8026940cf331f8f7
Instruction ID: 92718fd32b649ffd1c7789a63053aa7737a3fda4e5e7f101603dfa55f598ec14
Opcode Fuzzy Hash: 77aadbaf1419b8ce617d9818894e266f742206cc870b6c8e8026940cf331f8f7
Instruction Fuzzy Hash: 06A012104085000AC404A7394D4740F31C42945514FC40224785CB52C2E62D866843DB

Function 00408FEC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00409211,?,?), ref: 00409025
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,00409211,?,?), ref: 0040906E
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,00409211,?,?), ref: 00409090
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 004090AE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 004090CC
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 004090EA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00409108
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,004091F4,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,00409211), ref: 00409148
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,004091F4,?,80000001), ref: 00409173
RegCloseKey.ADVAPI32(?,004091FB,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,004091F4,?,80000001,Software\Embarcadero\Locales), ref: 004091EE

Strings

Software\Embarcadero\Locales, xrefs: 00409064, 00409086
Software\CodeGear\Locales, xrefs: 004090A4, 004090C2
Software\Borland\Delphi\Locales, xrefs: 004090FE
Software\Borland\Locales, xrefs: 004090E0

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 02cb05001f5eaad6fff4339b5af17fb9bc6815be3947461fd3347b4c018bfb3a
Instruction ID: a0cd080a1ff7527f2579847e9569a255959e0f2ed411b0715fcd69c9a807d56b
Opcode Fuzzy Hash: 02cb05001f5eaad6fff4339b5af17fb9bc6815be3947461fd3347b4c018bfb3a
Instruction Fuzzy Hash: 7B515871B4020DBEEB10EAA5CD46FAE73BCDB48704F50447BBA04F61C2D6B89E409659

Function 00432408 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 290
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadUILanguage.KERNEL32(00000000,00000000,0043284C,?,?,?,?,00000000,00000000), ref: 00432480
_get_osfhandle.MSVCRT ref: 00432654

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Part of subcall function 0042B5D8: InitializeCriticalSection.KERNEL32(0044E930,00000000,0042B88D,?,00000000), ref: 0042B613
Part of subcall function 0042B5D8: SetConsoleCtrlHandler.KERNEL32(0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B624
Part of subcall function 0042B5D8: GetWindowsDirectoryW.KERNEL32(0044E6EC,00000105,00000000,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B706
Part of subcall function 0042B5D8: GetConsoleOutputCP.KERNEL32(?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B717
Part of subcall function 0042B5D8: GetCPInfo.KERNEL32(00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B72C
Part of subcall function 0042B5D8: GetConsoleTitleW.KERNEL32(00000000,00000104,00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B771

Part of subcall function 0042C398: ExitProcess.KERNEL32(00000000,00000000,00432828), ref: 0042C3B1

Strings

B, xrefs: 004324BB
BIN, xrefs: 004324C9
``C, xrefs: 00432765
D, xrefs: 00432476
<cC, xrefs: 0043258E, 004326E5, 00432709, 0043272D, 00432751
T`C, xrefs: 0043241A
TXT, xrefs: 0043252A
CRC, xrefs: 004324F2

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Console$CriticalCtrlDirectoryExitHandlerInfoInitializeLanguageLoadOutputProcessSectionStringThreadTitleWindows_get_osfhandle
String ID: <cC$BIN$CRC$TXT$T`C$``C$B$D
API String ID: 2958763707-2773022990
Opcode ID: 3a90bb429f451ce73e71aafb876a89f7a3c20cc72ecc5f47d944eaa56cab1f0b
Instruction ID: 05c674e6a89e990405df80dbf507ba3f9d9f23654c3176dc86012a4c3b5596b2
Opcode Fuzzy Hash: 3a90bb429f451ce73e71aafb876a89f7a3c20cc72ecc5f47d944eaa56cab1f0b
Instruction Fuzzy Hash: 48C15F746006018FD700FF6AE881A5A77E1FF89314B54957AE901AB3A6CB78FC41CB9D

Function 00417DE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417BE8: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00417D94), ref: 00417C1B
Part of subcall function 00417BE8: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00417C3F
Part of subcall function 00417BE8: GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 00417C5A
Part of subcall function 00417BE8: LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 00417CF5

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00417F05), ref: 00417E41
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00417E74
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00417E86
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00417E8C
GetStdHandle.KERNEL32(000000F4,00417F20,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00417EA0
WriteFile.KERNEL32(00000000,000000F4,00417F20,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00417EA6
LoadStringW.USER32(00000000,0000FFEB,?,00000040), ref: 00417ECA
MessageBoxW.USER32(00000000,?,?,00002010), ref: 00417EE4

Strings

<cC, xrefs: 00417E1E
T`C, xrefs: 00417E10

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: <cC$T`C
API String ID: 135118572-2907802301
Opcode ID: c830c6d019e0b2c82b1b22302c3ae2dd07d2ba64d974e9f814e6c5bfe0acd496
Instruction ID: 58906fad06aeeaf9f466d3d3253202a83cb380b9e0a52c9a91e9a57a9748e339
Opcode Fuzzy Hash: c830c6d019e0b2c82b1b22302c3ae2dd07d2ba64d974e9f814e6c5bfe0acd496
Instruction Fuzzy Hash: 17312DB2644204BFE714E765DC42FEA73ACEB04704F50817AB644F61D1DAB86E848B6D

Function 00408CB8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00438B84,00000000,00408DBC,?,?,?,00000000,?,00409684,00000000,004096E3,?,?,00000000,00000000,00000000), ref: 00408CD6
LeaveCriticalSection.KERNEL32(00438B84,00438B84,00000000,00408DBC,?,?,?,00000000,?,00409684,00000000,004096E3,?,?,00000000,00000000), ref: 00408CFA
LeaveCriticalSection.KERNEL32(00438B84,00438B84,00000000,00408DBC,?,?,?,00000000,?,00409684,00000000,004096E3,?,?,00000000,00000000), ref: 00408D09
IsValidLocale.KERNEL32(00000000,00000002,00438B84,00438B84,00000000,00408DBC,?,?,?,00000000,?,00409684,00000000,004096E3), ref: 00408D1B
EnterCriticalSection.KERNEL32(00438B84,00000000,00000002,00438B84,00438B84,00000000,00408DBC,?,?,?,00000000,?,00409684,00000000,004096E3), ref: 00408D78
LeaveCriticalSection.KERNEL32(00438B84,00438B84,00000000,00000002,00438B84,00438B84,00000000,00408DBC,?,?,?,00000000,?,00409684,00000000,004096E3), ref: 00408DA1

Strings

en-GB,en,en-US,, xrefs: 00408CE6, 00408D8D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 1ee68946195f193d8b2c1b3f62ebaf0ca0bae414d7619bd794637c17c73039b4
Instruction ID: 3dc906d19139535a517bf05a43ec2f41213ab5801fe5d559e5ac7df0bf09f9e7
Opcode Fuzzy Hash: 1ee68946195f193d8b2c1b3f62ebaf0ca0bae414d7619bd794637c17c73039b4
Instruction Fuzzy Hash: BB21C3707107465AD714B7B68E03B1AA1949F99718FA0457FB480B32D2DEBCAD01826F

Function 0042EE28 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020019,?,00000000,00000000,0042EFAA,00400000,00000000,00400000,00000000,00000005,00000000,0042F0CD), ref: 0042EE4E
RegQueryValueExW.ADVAPI32(?,MachineGuid,00000000,?,?,?,80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020019,?,00000000,00000000,0042EFAA,00400000,00000000), ref: 0042EE72
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,MachineGuid,00000000,?,?,?,80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020019), ref: 0042EE91
RegQueryValueExW.ADVAPI32(?,MachineGuid,00000000,?,?,?,80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,MachineGuid,00000000,?,?), ref: 0042EEB5

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0042EE44, 0042EE87
MachineGuid, xrefs: 0042EE68, 0042EEAB

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: OpenQueryValue
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 4153817207-1211650757
Opcode ID: 7aeb374d09ccaf4faa7c7184a15372a46a3e12d2bcb6c6c10f605ca0fc949c19
Instruction ID: 4acd9089b50f56c747d35b13d68d7b592a5668b2c744b2dd2c07be4cd837ba67
Opcode Fuzzy Hash: 7aeb374d09ccaf4faa7c7184a15372a46a3e12d2bcb6c6c10f605ca0fc949c19
Instruction Fuzzy Hash: E811A5723443117BD310D993AD82FAB738C9F54744F550C2BBA40E71C6E678E80486AB

Function 00406D5C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00406D8D
FreeLibrary.KERNEL32(00400000,?,?,?,?,00406E92,0040401B,00404062,?,00000000,0040407B,?,?,?,?,00000000), ref: 00406E2E
ExitProcess.KERNEL32(00000001,?,?,?,?,00406E92,0040401B,00404062,?,00000000,0040407B,?,?,?,?,00000000), ref: 00406E6A

Part of subcall function 00406CC4: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?,?,00406E92,0040401B,00404062,?,00000000), ref: 00406CFD
Part of subcall function 00406CC4: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?,?,00406E92,0040401B,00404062,?), ref: 00406D03
Part of subcall function 00406CC4: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?), ref: 00406D1E
Part of subcall function 00406CC4: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D), ref: 00406D24

Strings

MZP, xrefs: 00406E2D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: db5ecf3e493b48906c9d6fc14bfd7c8e272e6dfb4ad713da9b1759fe41478d41
Instruction ID: 027523a471c850c2d6f5948c08cf4c6e9b43939df7d15fd5d14c5f77f5a4c2e5
Opcode Fuzzy Hash: db5ecf3e493b48906c9d6fc14bfd7c8e272e6dfb4ad713da9b1759fe41478d41
Instruction Fuzzy Hash: 6F316B646003528BE730AF79C44971BB6E4AF05318F16583FE446A73D1CBBCA9A4C75D

Function 00406D54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00406D8D
FreeLibrary.KERNEL32(00400000,?,?,?,?,00406E92,0040401B,00404062,?,00000000,0040407B,?,?,?,?,00000000), ref: 00406E2E
ExitProcess.KERNEL32(00000001,?,?,?,?,00406E92,0040401B,00404062,?,00000000,0040407B,?,?,?,?,00000000), ref: 00406E6A

Part of subcall function 00406CC4: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?,?,00406E92,0040401B,00404062,?,00000000), ref: 00406CFD
Part of subcall function 00406CC4: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?,?,00406E92,0040401B,00404062,?), ref: 00406D03
Part of subcall function 00406CC4: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?), ref: 00406D1E
Part of subcall function 00406CC4: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D), ref: 00406D24

Strings

MZP, xrefs: 00406E2D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: b345d8689da2649745ee8ce4969478b728c55c347d51a61831c1870b9deb212a
Instruction ID: 64baec8160611f0d12e964ee0f1bbc1b02591ea2685f4a2b1028bc1e3f95387a
Opcode Fuzzy Hash: b345d8689da2649745ee8ce4969478b728c55c347d51a61831c1870b9deb212a
Instruction Fuzzy Hash: 5E314964A043428ED731AFB9C44971BBBE0AF05319F16583FE046A72D2CB7CA8A4C75D

Function 00403E10 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00403E2E
VirtualFree.KERNEL32(00438AF8,00000000,00008000), ref: 00403EAA

Strings

h0C, xrefs: 00403E3E
TjC, xrefs: 00403E14

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeVirtual
String ID: TjC$h0C
API String ID: 1263568516-2781714519
Opcode ID: 28025f4953048df38c8401b685c6974b0b01bed780533aa76f380f2bd7de03d2
Instruction ID: a2be80c46c8db117d9eeeff0df746457e332e92e65e0654445dab54c858edb7b
Opcode Fuzzy Hash: 28025f4953048df38c8401b685c6974b0b01bed780533aa76f380f2bd7de03d2
Instruction Fuzzy Hash: CD116DB16002009BD7649F199984716BAE4EB89711F16C57FE249EB381D778AD02CB98

Function 0040278C Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402D9F,FFFFFFDC,00402A70), ref: 004027A2

Strings

TjC, xrefs: 004027AB, 004027B9
TjC, xrefs: 004027B3

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: TjC$TjC
API String ID: 4275171209-3370660221
Opcode ID: e09b7ca250215bd02166fe9cae5d380e964669fd141c4ea3df241ecc16fca971
Instruction ID: d58c566c32e20f241ab4f8b1cf21c9e0fdeb5a30aec7f5fa187c016e01894f2f
Opcode Fuzzy Hash: e09b7ca250215bd02166fe9cae5d380e964669fd141c4ea3df241ecc16fca971
Instruction Fuzzy Hash: 6EF04FB1B003415BEB45EF799D853017AD6E78A304F21D03EE609EB7D8D67584058B18

Function 004095CC Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,004096E3,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040976A,00000000,?,00000105), ref: 00409677
GetSystemDefaultUILanguage.KERNEL32(00000000,004096E3,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040976A,00000000,?,00000105), ref: 0040969F

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: b62fc543054050e3ce69501bcf4300a57c0faefa39be0320ed61ca82e73c7ba2
Instruction ID: 08fb147fdbcebe08428e2cf7960e314bc20fac605dabfd1cf4f1766cf2536f83
Opcode Fuzzy Hash: b62fc543054050e3ce69501bcf4300a57c0faefa39be0320ed61ca82e73c7ba2
Instruction Fuzzy Hash: 24314170A142099FDB10EBA9C891AAEB7B5EF45304F50497BE400B33E2DB79AD41CB59

Function 004068DA Relevance: 3.1, APIs: 2, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnhandledExceptionFilter.KERNEL32(00000006), ref: 004068FB
RtlUnwind.KERNEL32(?,?,00000000,00000000), ref: 0040691C

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandledUnwind
String ID:
API String ID: 2354489195-0
Opcode ID: d6f31b83982de99da8382a4c2b0ef4a2cf49d2acc30aa13fc6fa3e0284d212f4
Instruction ID: 9f73ad73aa315f6702dbae8d4611e6fac1ed1bcee52eb92282eca4ee3201315f
Opcode Fuzzy Hash: d6f31b83982de99da8382a4c2b0ef4a2cf49d2acc30aa13fc6fa3e0284d212f4
Instruction Fuzzy Hash: 6E21C6752052019BEB24EF18C985B2B73A5AF44300F16C53AE846AB3D9C73CDC61DB5D

Function 004096F0 Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004097AA,?,?,00000000), ref: 0040972C
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004097AA,?,?,00000000), ref: 0040977D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 092220cb52d444f6877993d1257730cf6ceba111b2df17c8dac5e30885d2ecec
Instruction ID: 4b8ae59a8274ec1f7fe7bedadba4008a70b0768cba9215aaa869a0053a364d14
Opcode Fuzzy Hash: 092220cb52d444f6877993d1257730cf6ceba111b2df17c8dac5e30885d2ecec
Instruction Fuzzy Hash: BB11B271A4420C9FDB10EB94CC86BDE73B8DB14304F5104FAA408B32D1DA785F808A99

Function 00408478 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 00408496

Part of subcall function 004096F0: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004097AA,?,?,00000000), ref: 0040972C
Part of subcall function 004096F0: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004097AA,?,?,00000000), ref: 0040977D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 555b207bfeb04d72a20648cf77d3343bb5b89bfeb5ce74508b24d888fb9169c6
Instruction ID: 48c28891e3bf74db38ef62a4c3c9261bcb525cc5651df91a29b38cc91f364b49
Opcode Fuzzy Hash: 555b207bfeb04d72a20648cf77d3343bb5b89bfeb5ce74508b24d888fb9169c6
Instruction Fuzzy Hash: FDE0ED71A003109BCB10DE9CDAC5A4737D4AB48754F0449AAAD54DF387E779DD1087D5

Non-executed Functions

Function 0041AD3C Relevance: 42.3, APIs: 16, Strings: 8, Instructions: 255COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(?,00000000,00000000,0042B736,00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0041AD47
GetLocaleInfoW.KERNEL32(00000000,0000001E,?,00000010,?,00000000,00000000,0042B736,00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930), ref: 0041AD54
GetLocaleInfoW.KERNEL32(00000000,00000023,?,00000080,00000000,0000001E,?,00000010,?,00000000,00000000,0042B736,00000000,0044E8F8,?, /c ), ref: 0041AD83
GetLocaleInfoW.KERNEL32(00000000,00000028,?,00000010,00000000,00000023,?,00000080,00000000,0000001E,?,00000010,?,00000000,00000000,0042B736), ref: 0041ADA9
GetLocaleInfoW.KERNEL32(00000000,00000029,?,00000010,00000000,00000028,?,00000010,00000000,00000023,?,00000080,00000000,0000001E,?,00000010), ref: 0041ADD5
GetLocaleInfoW.KERNEL32(00000000,00000021,?,00000080,00000000,00000029,?,00000010,00000000,00000028,?,00000010,00000000,00000023,?,00000080), ref: 0041AE0B
GetLocaleInfoW.KERNEL32(00000000,0000001D,?,00000010,00000000,00000021,?,00000080,00000000,00000029,?,00000010,00000000,00000028,?,00000010), ref: 0041AE7E
GetLocaleInfoW.KERNEL32(00000000,00000031,?,00000020,00000000,0000001D,?,00000010,00000000,00000021,?,00000080,00000000,00000029,?,00000010), ref: 0041AEAA
GetLocaleInfoW.KERNEL32(00000000,00000032,?,00000020,00000000,00000031,?,00000020,00000000,0000001D,?,00000010,00000000,00000021,?,00000080), ref: 0041AED6
GetLocaleInfoW.KERNEL32(00000000,00000033,?,00000020,00000000,00000032,?,00000020,00000000,00000031,?,00000020,00000000,0000001D,?,00000010), ref: 0041AF02
GetLocaleInfoW.KERNEL32(00000000,00000034,?,00000020,00000000,00000033,?,00000020,00000000,00000032,?,00000020,00000000,00000031,?,00000020), ref: 0041AF2E
GetLocaleInfoW.KERNEL32(00000000,00000035,?,00000020,00000000,00000034,?,00000020,00000000,00000033,?,00000020,00000000,00000032,?,00000020), ref: 0041AF5A
GetLocaleInfoW.KERNEL32(00000000,00000036,?,00000020,00000000,00000035,?,00000020,00000000,00000034,?,00000020,00000000,00000033,?,00000020), ref: 0041AF86
GetLocaleInfoW.KERNEL32(00000000,00000037,?,00000020,00000000,00000036,?,00000020,00000000,00000035,?,00000020,00000000,00000034,?,00000020), ref: 0041AFB2
GetLocaleInfoW.KERNEL32(00000000,0000000E,?,00000010,00000000,00000037,?,00000020,00000000,00000036,?,00000020,00000000,00000035,?,00000020), ref: 0041AFDE
GetLocaleInfoW.KERNEL32(00000000,0000000F,?,00000010,00000000,0000000E,?,00000010,00000000,00000037,?,00000020,00000000,00000036,?,00000020), ref: 0041B00A

Strings

Sat, xrefs: 0041AF9D
Sun, xrefs: 0041AFC9
Thu, xrefs: 0041AF45
Fri, xrefs: 0041AF71
MM/dd/yydd/MM/yyyy/MM/dd/, xrefs: 0041AE31
Wed, xrefs: 0041AF19
Mon, xrefs: 0041AEC1
Tue, xrefs: 0041AEED

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale$DefaultUser
String ID: Fri$MM/dd/yydd/MM/yyyy/MM/dd/$Mon$Sat$Sun$Thu$Tue$Wed
API String ID: 183805406-2725659345
Opcode ID: 5083693fdfab4dd46d87d493b47507d16569c0fe72b83a0747a2d338eb38cc76
Instruction ID: b0dc7d32b17400cf10c49c6fb7f96ed95534bc07079b1885cfb9c23afacce83d
Opcode Fuzzy Hash: 5083693fdfab4dd46d87d493b47507d16569c0fe72b83a0747a2d338eb38cc76
Instruction Fuzzy Hash: 736152B535231052E23061660D46BDB0499CB49748F24883B7A54AA2C7DBBECDF742FF

Function 0041B374 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 380timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,0041B89C,?,00440F84,00000000,?), ref: 0041B3D2
SystemTimeToFileTime.KERNEL32(?,?,?,00000000,0041B89C,?,00440F84,00000000,?), ref: 0041B3E2
FileTimeToLocalFileTime.KERNEL32(?,?,00000000,0041B89C,?,00440F84,00000000,?), ref: 0041B410
FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000,0041B89C,?,00440F84,00000000,?), ref: 0041B420
GetUserDefaultLCID.KERNEL32(?,?,?,?,00000000,0041B89C,?,00440F84,00000000,?), ref: 0041B51D
GetLocaleInfoW.KERNEL32(00000000,0000001F,?,00000080,?,?,?,?,00000000,0041B89C,?,00440F84,00000000,?), ref: 0041B533
GetUserDefaultLCID.KERNEL32(00000000,0000001F,?,00000080,?,?,?,?,00000000,0041B89C,?,00440F84,00000000,?), ref: 0041B68E
GetDateFormatW.KERNEL32(?,00000000,?,?,?,?,00000000,0000001F,?,00000080,?,?,?,?,00000000,0041B89C), ref: 0041B6AC
GetUserDefaultLCID.KERNEL32(?,00000000,?,?,?,?,00000000,0000001F,?,00000080,?,?,?,?,00000000,0041B89C), ref: 0041B6BF
GetDateFormatW.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,?,?,?,?,00000000,0000001F,?,00000080), ref: 0041B6D9
GetUserDefaultLCID.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,?,?,?,?,00000000,0000001F,?,00000080), ref: 0041B70C
GetDateFormatW.KERNEL32(?,00000000,?,?,?,00000001,00000000,00000000,?,?,00000000,00000000,?,00000000,?,?), ref: 0041B72A
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,?,?,?,?,00000000,0000001F,?,00000080), ref: 0041B738

Strings

%s %s , xrefs: 0041B844
%02d%s%02d%s%02d, xrefs: 0041B500
, xrefs: 0041B39D
%s , xrefs: 0041B86D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$DefaultFileUser$DateFormatSystem$ErrorInfoLastLocalLocale
String ID: $%02d%s%02d%s%02d$%s $%s %s
API String ID: 3547417185-410911588
Opcode ID: 739a57e1ed726c5c988a130102d539851d89a3380d9257a2e666bf5c849069c7
Instruction ID: bd11bb6a77d30f9659ec2bfc6a68520022c60487f61cd20b3d88836a2d13d56e
Opcode Fuzzy Hash: 739a57e1ed726c5c988a130102d539851d89a3380d9257a2e666bf5c849069c7
Instruction Fuzzy Hash: 95F13C75E003189FDF10DBA9C8857EEB7F5EF49304F1440AAE908AB281D7789E85CB95

Function 0041B8F0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 258timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00440F84,00000000,?), ref: 0041B908
SystemTimeToFileTime.KERNEL32(?,?,?,00440F84,00000000,?), ref: 0041B915
FileTimeToLocalFileTime.KERNEL32(?,?,00440F84,00000000,?), ref: 0041B92C
FileTimeToSystemTime.KERNEL32(?,?,?,?,00440F84,00000000,?), ref: 0041B939
GetUserDefaultLCID.KERNEL32(?,?,?,?,00440F84,00000000,?), ref: 0041BBA3
GetLocaleInfoW.KERNEL32(00000000,00001003,?,00000080,?,?,?,?,00440F84,00000000,?), ref: 0041BBBC
GetUserDefaultLCID.KERNEL32(00000000,00001003,?,00000080,?,?,?,?,00440F84,00000000,?), ref: 0041BC7C
GetTimeFormatW.KERNEL32(00000000,00000002,?,?,?,00000020,00000000,00001003,?,00000080,?,?,?,?,00440F84,00000000), ref: 0041BC9A

Strings

, xrefs: 0041BACD
%.2d%s%0.2d%s, xrefs: 0041BB1E, 0041BB7B
%.2d%s%0.2d%s%0.2d%s%0.2d, xrefs: 0041B9D5, 0041BA74
HH:mm:ss t, xrefs: 0041BBC5

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$File$System$DefaultUser$FormatInfoLocalLocale
String ID: $%.2d%s%0.2d%s$%.2d%s%0.2d%s%0.2d%s%0.2d$HH:mm:ss t
API String ID: 1639527492-3485249401
Opcode ID: 0346bbf31d30e01cc993cd7f082ad59083b8ff36e5ef28fa0bde1c803d4b3688
Instruction ID: 656d066bc6f14210b78f0edb226831cdf3b533679f189d4a0789d57a772f5d8a
Opcode Fuzzy Hash: 0346bbf31d30e01cc993cd7f082ad59083b8ff36e5ef28fa0bde1c803d4b3688
Instruction Fuzzy Hash: 9DB16F71E043689ADB21CB65C8457EEB7F4EF49304F0481DAE548A7381EB784EC5CB9A

Function 00408DFC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00408E19
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 00408E2A
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 00408F2A
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 00408F3C
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 00408F48
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 00408F8D

Strings

\, xrefs: 00408F5A
GetLongPathNameW, xrefs: 00408E24
kernel32.dll, xrefs: 00408E14

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 6529d149c9b23dd5294fa744df04069a21137189c2797ce175b25f5b08e93afd
Instruction ID: a81a4d77bda4d419970e4c857a27713445a2199e476d97cc489ac22f85a4bf6f
Opcode Fuzzy Hash: 6529d149c9b23dd5294fa744df04069a21137189c2797ce175b25f5b08e93afd
Instruction Fuzzy Hash: 6B418431A006199BCB10EAA4CE85ADEB3B6AF44310F5445BED584F73C0EB7C9E458B89

Function 0042EF38 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,00000000,00000005,00000000,0042F0CD,?,?,0044EA78,00000000), ref: 0042EF77
LoadResource.KERNEL32(00400000,00000000,00400000,00000000,00000005,00000000,0042F0CD,?,?,0044EA78,00000000), ref: 0042EF90

Part of subcall function 0042EE28: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020019,?,00000000,00000000,0042EFAA,00400000,00000000,00400000,00000000,00000005,00000000,0042F0CD), ref: 0042EE4E
Part of subcall function 0042EE28: RegQueryValueExW.ADVAPI32(?,MachineGuid,00000000,?,?,?,80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020019,?,00000000,00000000,0042EFAA,00400000,00000000), ref: 0042EE72

LockResource.KERNEL32(?,00400000,00000000,00400000,00000000,00000005,00000000,0042F0CD,?,?,0044EA78,00000000), ref: 0042EFBB
SizeofResource.KERNEL32(00400000,?,?,00400000,00000000,00400000,00000000,00000005,00000000,0042F0CD,?,?,0044EA78,00000000), ref: 0042EFCD
FreeResource.KERNEL32(?,00400000,?,?,00400000,00000000,00400000,00000000,00000005,00000000,0042F0CD,?,?,0044EA78,00000000), ref: 0042F0AA

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLockOpenQuerySizeofValue
String ID:
API String ID: 2385253180-0
Opcode ID: cdd1f54ee9f4e27d10dd4c839316856832945144a4a8e1506ee2a7b39a67df97
Instruction ID: 470452359d02959b2a82e493305dd9586f467a6c4a95ed9613e45acd33ea13c9
Opcode Fuzzy Hash: cdd1f54ee9f4e27d10dd4c839316856832945144a4a8e1506ee2a7b39a67df97
Instruction Fuzzy Hash: 70518070A00A16AFC700DF6AD581A59F7F4FF48314B90823AE408D3A41DB38F964CF99

Function 0041DF90 Relevance: 6.1, APIs: 4, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,-00000002,?), ref: 0041DFAF
GetLastError.KERNEL32(00000000,00000000,?), ref: 0041E03C

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 321e58e50d224d908461dc322c33f5d91f1d2aba134d19e77d62c7b27265a804
Instruction ID: 9b6f964e2967cfbdc8d1c9e944728f8147227f1a32f4a99092c6dff2fd5d5bd1
Opcode Fuzzy Hash: 321e58e50d224d908461dc322c33f5d91f1d2aba134d19e77d62c7b27265a804
Instruction Fuzzy Hash: EB21CFB0A006019FCB10DF59EC41A9AB7A8EF8A324B204277E851D73D0D7389E92CF59

Function 0042CAC4 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

D, xrefs: 0042CB26
7, xrefs: 0042CC03

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID: 7$D
API String ID: 1611563598-1199756253
Opcode ID: 28b5e18778e08de363d5ec20efcdc89a5f214f6f8b26ad161a795e8ad2caf248
Instruction ID: 6395f369b4c9bed57b421ad016a0ac1f935084ab2fcf427628ce73a92fe48ba3
Opcode Fuzzy Hash: 28b5e18778e08de363d5ec20efcdc89a5f214f6f8b26ad161a795e8ad2caf248
Instruction Fuzzy Hash: 57C17EB0F002288BDB20DF65ECC179EB7B1AF45314F9141AAD509A7391D7789E85CF89

Function 00429570 Relevance: 4.6, APIs: 3, Instructions: 128fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000001,?), ref: 0042963B
FindNextFileW.KERNEL32(00000000,00000010), ref: 004296CF
FindClose.KERNEL32(00000000,00000000,00000010), ref: 004296DD

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: e81c68514d29f13ef3f86a91459a3f1e69e1838139565904ca29f546a2ebf565
Instruction ID: 1acd9ca46e8cb24d59e6611a3c32c04d7b9f48139ab1ffd3041df7352441d4b9
Opcode Fuzzy Hash: e81c68514d29f13ef3f86a91459a3f1e69e1838139565904ca29f546a2ebf565
Instruction Fuzzy Hash: 3F415E72B00228ABCB11DF59DC81ADEB7F4EF48314F5440AAE818D7391E7789E81CB59

Function 004089A0 Relevance: 4.6, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00408B05,?,?,?,00000000), ref: 00408A4A
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,00408B05,?,?,?,00000000), ref: 00408A66
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00408B05,?,?,?,00000000), ref: 00408A77

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: ea0965341c164747aa438cb65c92a4da53aa7ed2badfb8fde95bc0ee800d068d
Instruction ID: 21605bc2a06bad9cf0e6a23b166eedfa00832c6933dd506d79f96c7522ef7f53
Opcode Fuzzy Hash: ea0965341c164747aa438cb65c92a4da53aa7ed2badfb8fde95bc0ee800d068d
Instruction Fuzzy Hash: C131AF70A006089BDB20DF54DD91B9AB7B9EB44701F5101BBB548B32D1DA796E81CF19

Function 00416D30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,0000000F,<nA,00000002,0000002C,?,?,?,00416E3C), ref: 00416D43

Strings

<nA, xrefs: 00416D3C, 00416D40

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID: <nA
API String ID: 2299586839-680915657
Opcode ID: 481378556fd2f4782c63f6ed86e00509561caa7bea20dc1f1a79b27e466628ab
Instruction ID: f1cc9d58c34ec4fb3ce4063e72c3893b7a2999b89c5cee81e40c0823702babf8
Opcode Fuzzy Hash: 481378556fd2f4782c63f6ed86e00509561caa7bea20dc1f1a79b27e466628ab
Instruction Fuzzy Hash: 44D05EA630926026E210925B6D85EB756EDCBC5761F15443BBA8CC6252D224CC4A9276

Function 0041E578 Relevance: 3.1, APIs: 2, Instructions: 95fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,00000002,00000000,0041E870,?,00000000,00000104,?,?,00000104,?,?,0044EA78), ref: 0041E5B4
FindClose.KERNEL32(00000000,?,?,?,?,00000002,00000000,0041E870,?,00000000,00000104,?,?,00000104,?), ref: 0041E5C6

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9869e399d77d7b30a338f1604437d7397bbedae7ccf52aa5c9794f7ef9f463d6
Instruction ID: 83b49d14aa2d7e9fdfd1922beb8bd092bf31cc602ee9b2e420b4ef262ab7a866
Opcode Fuzzy Hash: 9869e399d77d7b30a338f1604437d7397bbedae7ccf52aa5c9794f7ef9f463d6
Instruction Fuzzy Hash: 63318236B052045BC7209A79CC857AF76D5AFD4354F98843EE889C7381EA7CDC89874A

Function 0040FCAC Relevance: 2.9, Instructions: 2860COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d5b8b05b4d134ca3bdec6ac7951fa84107f32b5f88050daf4d7dee5a02201d
Instruction ID: 48076cec15eccd35ecadb57d2a6182a26f6c9f014f6a7e5a8ac4b072b4e572cb
Opcode Fuzzy Hash: 60d5b8b05b4d134ca3bdec6ac7951fa84107f32b5f88050daf4d7dee5a02201d
Instruction Fuzzy Hash: 6633868AA4E7C10FE303477099656906F719F6726AF2F45EB80D9CF1E3E55C894AC322

Function 004151D0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 004151F1

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 9041f734942ca57c5fb34a01f220f8073245e939ec68fc4f06e6ad66118583cb
Instruction ID: ff22b59d577313d6bbfba741a0fb47c02e5a205fe59c6f6de2aed158c3e01250
Opcode Fuzzy Hash: 9041f734942ca57c5fb34a01f220f8073245e939ec68fc4f06e6ad66118583cb
Instruction Fuzzy Hash: 8211C0B5E00209AFDB04CFA9C9819EFB7F9EFC8704B14C56AA505E7254E6319A018BA4

Function 00416CE4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00416D02

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6c4f1e6aa9f658c76dcd92db1758fae387683ef62497e0b06259f29383213a92
Instruction ID: 2b9c1a6928095edd7dc05a64c72801690ba2a1fef3c258e55fc692f210e56574
Opcode Fuzzy Hash: 6c4f1e6aa9f658c76dcd92db1758fae387683ef62497e0b06259f29383213a92
Instruction Fuzzy Hash: 19E09272B0431817E310A5695C86AE7725C9B48300F00417FBA09E7383EEB4AD4446EA

Function 00419A68 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00419864,00000002,?,?,00419DC5,004171B5,?,00000000,004171F6,?,?,?,00000000,00000000), ref: 00419A95

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 5afc6ff0a8dce8195612bc0fed306c66ecd2644cfc92cbc385c39c888367258d
Instruction ID: a77c024cf322692a8c7cec17c1031f2e599c8aace297205cca6f58bce0ed0080
Opcode Fuzzy Hash: 5afc6ff0a8dce8195612bc0fed306c66ecd2644cfc92cbc385c39c888367258d
Instruction Fuzzy Hash: B9E0DF73740A9047C214B3AA0C43B9726059F41FE4F088037F8489B3C2DA3E0C5846EA

Function 00419880 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000400,?,00419924,?,00000000,00419A31,?,?,?,00000000,00000000,?,0041987A), ref: 0041989B

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8108c8bf47c58d3f16ac2741031a2f31bd522cc2493eaf267972ee138a186f91
Instruction ID: ce83a26554a48b871db40be406feca0705ab7bfaaf3879aa63724075275dcd35
Opcode Fuzzy Hash: 8108c8bf47c58d3f16ac2741031a2f31bd522cc2493eaf267972ee138a186f91
Instruction Fuzzy Hash: 98D0A7D1B1420013E60456588C47B26219C9B84714F10443C7784973C1EE7D681592AF

Function 0040A8B6 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 0040A8C6

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 4afc06809abf30ecdb7b7dd656bec85bab4b959a5939932278656d1409d05816
Instruction ID: 821697932f9ef1367aa0b374dc6900a18d16d9b4ba69b7de74dca3c6eaa235d0
Opcode Fuzzy Hash: 4afc06809abf30ecdb7b7dd656bec85bab4b959a5939932278656d1409d05816
Instruction Fuzzy Hash: 1DE0EC755043019FD304DF28D84258576E0B744711F40943DA898D3390E77DC951CB5A

Function 00408090 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction ID: 73e49479f985fbd099593cfa7becaa53ebf3b11143f3f6311cb0a9223223b834
Opcode Fuzzy Hash: d17ffc1b7c175c9f3f133bcf490b3ef334a0cf6f2a578ee1034f9dfeca47056c
Instruction Fuzzy Hash: F401D632B017110B870CDD7ECD8952AB6C3ABD8A10F09C73E95C9D72C8DD318C1AC686

Function 004056AC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0e43f82692c6785844f3e70bb209c8b319b1924ab6e756aa91dc1deac9637f
Instruction ID: ab32cd948f5cc0f986b103ed126492745cff1ff6344bafc82bdf97f524ea6183
Opcode Fuzzy Hash: ae0e43f82692c6785844f3e70bb209c8b319b1924ab6e756aa91dc1deac9637f
Instruction Fuzzy Hash: F4D0C9AAA2150217F766902958A0B631567E740315F75CC3AA409E5BC5E17ACCA09424

Function 00425590 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 318threadprocessCOMMON

Download Yara Rule

APIs

GetProcessWindowStation.USER32(00000000,00425A18,?,?,00000000,00000000), ref: 0042561E
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,00000000,00425A18,?,?,00000000,00000000), ref: 00425630
GetCurrentThreadId.KERNEL32 ref: 00425635
GetThreadDesktop.USER32(00000000,00000000,00000002,00000000,00000000,?,00000000,00425A18,?,?,00000000,00000000), ref: 0042563B
GetUserObjectInformationW.USER32(?,00000002,00000000,00000000,?,00000000,00000000,00000002,00000000,00000000,?,00000000,00425A18,?,?,00000000), ref: 00425651
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00000002,00000000,00000000,?,00000000,00000000,00000002,00000000,00000000,?), ref: 0042568E
GetUserObjectInformationW.USER32(?,00000002,?,?,?,00000000,00000002,?,?,?,?,00000002,00000000,00000000,?,00000000), ref: 004256C6
CreateProcessW.KERNEL32(?,?,00000000,00000000,000000FF,00000000,00000000,0044E6EC,?,?,?,00000002,00000000,00000000,?,00000000), ref: 004256FB
GetLastError.KERNEL32(?,?,00000000,00000000,000000FF,00000000,00000000,0044E6EC,?,?,?,00000002,00000000,00000000,?,00000000), ref: 0042571A
ShellExecuteExW.SHELL32(?), ref: 004257A7
CloseHandle.KERNEL32(?,?,?,00000000,00000000,000000FF,00000000,00000000,0044E6EC,?,?,?,00000002,00000000,00000000,?), ref: 0042581F
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,000000FF,00000000,00000000,0044E6EC,?,?,?,00000002,00000000), ref: 004259AD

Part of subcall function 0042DC78: WaitForSingleObject.KERNEL32(?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DC88
Part of subcall function 0042DC78: GetExitCodeProcess.KERNEL32(?), ref: 0042DC8F
Part of subcall function 0042DC78: fflush.MSVCRT ref: 0042DCA4
Part of subcall function 0042DC78: CloseHandle.KERNEL32(?,?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DCB6

Strings

D, xrefs: 004256E3, 0042578B
d, xrefs: 004255FF
d, xrefs: 00425609
dIC, xrefs: 00425843
%01s, xrefs: 00425905
D, xrefs: 004255DA
=ExitCode, xrefs: 004258DB
%08X, xrefs: 004258C6
=ExitCodeAscii, xrefs: 0042591A, 0042592B
<, xrefs: 00425759

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Object$InformationUser$CloseHandleProcess$Thread$CodeCreateCurrentDesktopErrorExecuteExitLastShellSingleStationWaitWindowfflush
String ID: %01s$%08X$<$=ExitCode$=ExitCodeAscii$D$d$d$dIC$D
API String ID: 4162345748-4261697235
Opcode ID: da31e7b4ddab6ca53a2466cf879ea0ca870b1f0c12eac7a77019afc211a361d0
Instruction ID: 29cece55cede7e875dbd62b60b7ff0cfa83eaee8ee864221612e865b74dff63f
Opcode Fuzzy Hash: da31e7b4ddab6ca53a2466cf879ea0ca870b1f0c12eac7a77019afc211a361d0
Instruction Fuzzy Hash: F8D16071E002699FDB20DF69DC81B9EB7F4BB09314F9040A6E508E7391D7B89E81CB59

Function 0042B8F4 Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 162registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(00000000,Software\Microsoft\Command Processor), ref: 0042B931
RegQueryValueExW.ADVAPI32(?,DisableUNCCheck,00000000,?,?,00000040), ref: 0042B961
_wtol.MSVCRT ref: 0042B982
RegQueryValueExW.ADVAPI32(?,EnableExtensions,00000000,?,?,00000040,?,DisableUNCCheck,00000000,?,?,00000040), ref: 0042B9A4
_wtol.MSVCRT ref: 0042B9C5
RegQueryValueExW.ADVAPI32(?,DelayedExpansion,00000000,?,?,00000040,?,EnableExtensions,00000000,?,?,00000040,?,DisableUNCCheck,00000000,?), ref: 0042B9E7
_wtol.MSVCRT ref: 0042BA08
RegQueryValueExW.ADVAPI32(?,DefaultColor,00000000,?,?,00000040,?,DelayedExpansion,00000000,?,?,00000040,?,EnableExtensions,00000000,?), ref: 0042BA2A
wcstol.MSVCRT ref: 0042BA50
RegQueryValueExW.ADVAPI32(?,CompletionChar,00000000,?,?,00000040,?,DefaultColor,00000000,?,?,00000040,?,DelayedExpansion,00000000,?), ref: 0042BA71
wcstol.MSVCRT ref: 0042BA97
RegCloseKey.ADVAPI32(00000000,?,CompletionChar,00000000,?,?,00000040,?,DefaultColor,00000000,?,?,00000040,?,DelayedExpansion,00000000), ref: 0042BAA9

Strings

@, xrefs: 0042B946
DefaultColor, xrefs: 0042BA20
DisableUNCCheck, xrefs: 0042B957
Software\Microsoft\Command Processor, xrefs: 0042B929
CompletionChar, xrefs: 0042BA67
DelayedExpansion, xrefs: 0042B9DD
EnableExtensions, xrefs: 0042B99A

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: QueryValue$_wtol$wcstol$CloseOpen
String ID: @$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$Software\Microsoft\Command Processor
API String ID: 2011142946-3045645619
Opcode ID: e366d2a4c4599984b5a91b1a498737ae439a1574c2842ad9554b40e7888031d2
Instruction ID: b568e245839fec098a9ff80b0fb22002d39e8b9061c6090bdb52f27f9316806c
Opcode Fuzzy Hash: e366d2a4c4599984b5a91b1a498737ae439a1574c2842ad9554b40e7888031d2
Instruction Fuzzy Hash: 8851E4B1605351AEDB20CB61AC42BA777ACDF91750F50182BF54097282E37CA994C7AF

Function 0041E6C0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 170COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?,?,0044EA78,00000000,0041E916,0041F789,00000000,0042C3A2,00000000,00432828), ref: 0041E729
GetFullPathNameW.KERNEL32(00000000,00000104,?,?,00000104,?,?,0044EA78,00000000,0041E916,0041F789,00000000,0042C3A2,00000000,00432828), ref: 0041E7AD
GetLastError.KERNEL32(00000000,00000104,?,?,00000104,?,?,0044EA78,00000000,0041E916,0041F789,00000000,0042C3A2,00000000,00432828), ref: 0041E7B6

Strings

D, xrefs: 0041E8C9
:, xrefs: 0041E75C
:, xrefs: 0041E785
:, xrefs: 0041E7D9
, xrefs: 0041E70A
=, xrefs: 0041E749

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CurrentDirectoryErrorFullLastNamePath
String ID: $:$:$:$=$D
API String ID: 1966084046-3320138216
Opcode ID: 2a70e21eb2caa05c3df6f490e1ec8f370a0d799ab3863714bc2f12419bd414c3
Instruction ID: a201bb975ddcc14929384874e46a04078e206f5854b688f416f7376d47ed11f7
Opcode Fuzzy Hash: 2a70e21eb2caa05c3df6f490e1ec8f370a0d799ab3863714bc2f12419bd414c3
Instruction Fuzzy Hash: 155180786043519AEB20FB2AC8456EB72E5AF91318F04882BF891C72D0E77CC8C5D75B

Function 0042B5D8 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 176COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0044E930,00000000,0042B88D,?,00000000), ref: 0042B613

Part of subcall function 0042C35C: EnterCriticalSection.KERNEL32(0044E930,0042B61D,0044E930,00000000,0042B88D,?,00000000), ref: 0042C361
Part of subcall function 0042C35C: LeaveCriticalSection.KERNEL32(0044E930,0044E930,0042B61D,0044E930,00000000,0042B88D,?,00000000), ref: 0042C372

SetConsoleCtrlHandler.KERNEL32(0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B624

Part of subcall function 0042E4A0: _get_osfhandle.MSVCRT ref: 0042E4B6
Part of subcall function 0042E4A0: SetConsoleMode.KERNEL32(00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E4BD
Part of subcall function 0042E4A0: _get_osfhandle.MSVCRT ref: 0042E4CA
Part of subcall function 0042E4A0: GetConsoleMode.KERNEL32(00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E4D1
Part of subcall function 0042E4A0: _get_osfhandle.MSVCRT ref: 0042E4F8
Part of subcall function 0042E4A0: SetConsoleMode.KERNEL32(00000000,00000000,00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E4FF
Part of subcall function 0042E4A0: _get_osfhandle.MSVCRT ref: 0042E50C
Part of subcall function 0042E4A0: GetConsoleMode.KERNEL32(00000000,0044E920,00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E513
Part of subcall function 0042E4A0: _get_osfhandle.MSVCRT ref: 0042E54F
Part of subcall function 0042E4A0: SetConsoleMode.KERNEL32(00000000,00000000,00000000,0044E920,00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E556

Part of subcall function 0042B8F4: RegOpenKeyW.ADVAPI32(00000000,Software\Microsoft\Command Processor), ref: 0042B931
Part of subcall function 0042B8F4: RegQueryValueExW.ADVAPI32(?,DisableUNCCheck,00000000,?,?,00000040), ref: 0042B961
Part of subcall function 0042B8F4: RegQueryValueExW.ADVAPI32(?,EnableExtensions,00000000,?,?,00000040,?,DisableUNCCheck,00000000,?,?,00000040), ref: 0042B9A4
Part of subcall function 0042B8F4: RegQueryValueExW.ADVAPI32(?,DelayedExpansion,00000000,?,?,00000040,?,EnableExtensions,00000000,?,?,00000040,?,DisableUNCCheck,00000000,?), ref: 0042B9E7
Part of subcall function 0042B8F4: RegQueryValueExW.ADVAPI32(?,DefaultColor,00000000,?,?,00000040,?,DelayedExpansion,00000000,?,?,00000040,?,EnableExtensions,00000000,?), ref: 0042BA2A
Part of subcall function 0042B8F4: RegQueryValueExW.ADVAPI32(?,CompletionChar,00000000,?,?,00000040,?,DefaultColor,00000000,?,?,00000040,?,DelayedExpansion,00000000,?), ref: 0042BA71

Part of subcall function 0041E4DC: GetCurrentDirectoryW.KERNEL32(00000104,00440F84), ref: 0041E4F0

Part of subcall function 0042C08C: VirtualQuery.KERNEL32(?,0042B5A8,0000001C,00000000,0042C292,?,00000000,00000000), ref: 0042C0D3
Part of subcall function 0042C08C: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,0042B5A8,0000001C,00000000,0042C292,?,00000000,00000000), ref: 0042C121

GetWindowsDirectoryW.KERNEL32(0044E6EC,00000105,00000000,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B706
GetConsoleOutputCP.KERNEL32(?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B717
GetCPInfo.KERNEL32(00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B72C
GetConsoleTitleW.KERNEL32(00000000,00000104,00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B771
GetStdHandle.KERNEL32(000000F5,?,00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B7AD
GetConsoleScreenBufferInfo.KERNEL32(00000000,000000F5,?,00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B7B3
GetModuleHandleW.KERNEL32(KERNEL32.DLL,IsDebuggerPresent,00000000,0044E8F8,?, /c ,?,0042B5A8,000000FF,0044E930,00000000,0042B88D,?,00000000), ref: 0042B852

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Strings

L`C, xrefs: 0042B64B
/c , xrefs: 0042B643
KERNEL32.DLL, xrefs: 0042B84D
IsDebuggerPresent, xrefs: 0042B848
D, xrefs: 0042B6EF

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Console$Query$ModeValue_get_osfhandle$CriticalSection$DirectoryHandleInfoModule$BufferCtrlCurrentEnterFileHandlerInitializeLeaveLoadNameOpenOutputScreenStringTitleVirtualWindows
String ID: /c $IsDebuggerPresent$KERNEL32.DLL$L`C$D
API String ID: 823238324-460285165
Opcode ID: f32365ca3bd5669f4518458bd4dfe1c12d6f026e60ef6a7e51fad7ba4fe90df8
Instruction ID: 4e79633e98e41082f364da831a232bd15b0c0c84a61507a755bf56309128a8ef
Opcode Fuzzy Hash: f32365ca3bd5669f4518458bd4dfe1c12d6f026e60ef6a7e51fad7ba4fe90df8
Instruction Fuzzy Hash: 0E6171B4A012149ADB00FBB6EC81A9D77B5FB48318F50453BF410A72E2DB7CA944CB9D

Function 0042D85C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,0000000C,?,00000003,00000080,00000000), ref: 0042D903
CreateFileW.KERNEL32(?,80000000,0000000C,?,00000003,00000080,00000000,?,80000000,0000000C,?,00000003,00000080,00000000), ref: 0042D92B
GetLastError.KERNEL32(?,80000000,0000000C,?,00000003,00000080,00000000,?,80000000,0000000C,?,00000003,00000080,00000000), ref: 0042D937
CreateFileW.KERNEL32(?,80000000,0000000C,?,00000003,00000080,00000000), ref: 0042D974
GetLastError.KERNEL32(?,80000000,0000000C,?,00000003,00000080,00000000), ref: 0042D980
_open_osfhandle.MSVCRT ref: 0042D9A8
GetFileSize.KERNEL32(00000000,00000000), ref: 0042D9D0
SetFilePointer.KERNEL32(00000000,000000FF,?,00000002), ref: 0042D9F6
GetLastError.KERNEL32(00000000,000000FF,?,00000002), ref: 0042D9FD
_close.MSVCRT ref: 0042DA1B
ReadFile.KERNEL32(00000000,?,00000001,FFFFFFFF,00000000,00000000,000000FF,?,00000002), ref: 0042DA35
SetFilePointer.KERNEL32(00000000,00000000,?,00000002,00000000,?,00000001,FFFFFFFF,00000000,00000000,000000FF,?,00000002), ref: 0042DA50
SetFilePointer.KERNEL32(00000000,000000FF,?,00000002,00000000,?,00000001,FFFFFFFF,00000000,00000000,000000FF,?,00000002), ref: 0042DA6F

Strings

con, xrefs: 0042D8B1

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CreateErrorLastPointer$ReadSize_close_open_osfhandle
String ID: con
API String ID: 2744256135-4257191772
Opcode ID: ec9d835b21950934a3650b5f3da288062123e11d27ac97da0ea3ec4a2d2ea18f
Instruction ID: a8aafa59e29608650fe8345e6a63883d94b5a5ac0ca1098a238f6131ccf085ac
Opcode Fuzzy Hash: ec9d835b21950934a3650b5f3da288062123e11d27ac97da0ea3ec4a2d2ea18f
Instruction Fuzzy Hash: 7851BEB1F09311AAE710EA78AC45F6B72D8AB84324F500B2AF5B1D72D1D7B8DC45835A

Function 0041CDE8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,0041D0BA), ref: 0041CF3A
GetConsoleMode.KERNEL32(?,?,000000F5,00000000,0041D0BA), ref: 0041CF4A
SetConsoleMode.KERNEL32(?,?,?,?,000000F5,00000000,0041D0BA), ref: 0041CF62
GetLastError.KERNEL32(?,?,?,?,000000F5,00000000,0041D0BA), ref: 0041CF67
GetStdHandle.KERNEL32(000000F6,?,?,000000F5,00000000,0041D0BA), ref: 0041CF6E
GetConsoleMode.KERNEL32(?,?,000000F6,?,?,000000F5,00000000,0041D0BA), ref: 0041CF7E
SetConsoleMode.KERNEL32(?,?,?,?,000000F6,?,?,000000F5,00000000,0041D0BA), ref: 0041CF9C
GetLastError.KERNEL32(?,?,?,?,000000F6,?,?,000000F5,00000000,0041D0BA), ref: 0041CFA1
SetConsoleMode.KERNEL32(?,?,?), ref: 0041D05D
SetConsoleMode.KERNEL32(?,?,?), ref: 0041D070

Strings

, xrefs: 0041D00B
=, xrefs: 0041CF03
", xrefs: 0041CEDD

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleMode$ErrorHandleLast
String ID: $"$=
API String ID: 142029828-3137003337
Opcode ID: da357deb41f2922d347dda3b9a52cc711d37534b445ee3f9336ed38662cce3c8
Instruction ID: 865f3dcd195a89cb5a5abe06bd6b2739945314c5b8f0776bbe46b85f788f77bb
Opcode Fuzzy Hash: da357deb41f2922d347dda3b9a52cc711d37534b445ee3f9336ed38662cce3c8
Instruction Fuzzy Hash: 5F71A570E002159BDB20EB65CC807DEB7F5BF48318F1445A6E444A7282DB7D9E81CB9E

Function 00426E30 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,0000020A), ref: 00426E7C
RegOpenKeyW.ADVAPI32(?,0000002E,?), ref: 00426EE2
RegQueryValueExW.ADVAPI32(?,004271C0,00000000,?,?,0000020A,?,0000002E,?), ref: 00426F1B
RegCloseKey.ADVAPI32(?,?,004271C0,00000000,?,?,0000020A,?,0000002E,?), ref: 00426F26

Strings

%s\Shell\Open\Command, xrefs: 00427010
\Shell\Open\Command, xrefs: 00426EB6
*** no open command defined ***, xrefs: 00426EC6
%s=%s, xrefs: 00426F6A, 004270D5
{, xrefs: 00426FD0
., xrefs: 00426E9A

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEnumOpenQueryValue
String ID: %s=%s$%s\Shell\Open\Command$*** no open command defined ***$.$\Shell\Open\Command${
API String ID: 3984146545-2468193110
Opcode ID: dbdc2516c416aa1b04d10fe59cfcd294d76879acc1d09890d8bd9115ee25ff17
Instruction ID: 116559adae04dba84b3c08218e4b63129272dc625c466050257a41c5e68b908e
Opcode Fuzzy Hash: dbdc2516c416aa1b04d10fe59cfcd294d76879acc1d09890d8bd9115ee25ff17
Instruction Fuzzy Hash: D68145B5A042289ADB20DB55DC85BDDB7B8AF04304F9140EAEA08A7281D7785F94CF5E

Function 0042E4A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0042E4B6
SetConsoleMode.KERNEL32(00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E4BD
_get_osfhandle.MSVCRT ref: 0042E4CA
GetConsoleMode.KERNEL32(00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E4D1
_get_osfhandle.MSVCRT ref: 0042E4F8
SetConsoleMode.KERNEL32(00000000,00000000,00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E4FF
_get_osfhandle.MSVCRT ref: 0042E50C
GetConsoleMode.KERNEL32(00000000,0044E920,00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E513
_get_osfhandle.MSVCRT ref: 0042E54F
SetConsoleMode.KERNEL32(00000000,00000000,00000000,0044E920,00000000,0044E924,00000000,00000000,00000000,004349C4,0042C5D4), ref: 0042E556

Strings

D, xrefs: 0042E504, 0042E51C, 0042E525, 0042E536, 0042E53E, 0042E545
$D, xrefs: 0042E4AC, 0042E4C2, 0042E4DA, 0042E4E7, 0042E4EE

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: D$$D
API String ID: 1606018815-2300610124
Opcode ID: cc42cf222249ed1649b5cf6f63f395be8194c94dc6006fa1d82e3ac29f84e021
Instruction ID: f305ef07755de7834ef06ba784ebea511ee43af3d1da8f8aec9bac4f818cc33b
Opcode Fuzzy Hash: cc42cf222249ed1649b5cf6f63f395be8194c94dc6006fa1d82e3ac29f84e021
Instruction Fuzzy Hash: 02114F71714621AFE704EBD9EC86F5633A9EB88719F005166F400CF2A1D6B8EC508B6D

Function 004044BC Relevance: 19.7, APIs: 13, Instructions: 189COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(FFFFFFF5), ref: 0040456A
GetStdHandle.KERNEL32(000000F6), ref: 00404575
GetFileType.KERNEL32(00000000), ref: 0040458D
GetConsoleOutputCP.KERNEL32(00000000), ref: 0040459F
GetConsoleCP.KERNEL32(00000000), ref: 004045B0
GetFileType.KERNEL32(00000000), ref: 004046FB

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleFileHandleType$Output
String ID:
API String ID: 393880136-0
Opcode ID: 0e3193d4c0489fb8fe930c9f6cb2be9426119d284c09d2d911fd307d3aa1ad49
Instruction ID: 44818e351155a583358b238547e797e5d0553b54459bbe2914d2e11aea70f6f1
Opcode Fuzzy Hash: 0e3193d4c0489fb8fe930c9f6cb2be9426119d284c09d2d911fd307d3aa1ad49
Instruction Fuzzy Hash: 885161E0500200AADF20EF6589887273694AFC6314F158A7BEB15BF2D6E77DC841976E

Function 00409E7C Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00409F34

Strings

(<C, xrefs: 00409E91
H<C, xrefs: 00409EF6

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID: (<C$H<C
API String ID: 3997070919-3224027150
Opcode ID: 076dbe915f91956be400e8e65fdf05f96802e6b4a5d50a34f0ccc415e07fbb36
Instruction ID: 1ee168f13e44fd747450b25795412b987f935942c6365d45b43deeebd993f223
Opcode Fuzzy Hash: 076dbe915f91956be400e8e65fdf05f96802e6b4a5d50a34f0ccc415e07fbb36
Instruction Fuzzy Hash: 44A18D72A003099FDB11DFA9D880BEEB7B5BF48300F14953AE505BB391DB78A944CB59

Function 00417560 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 175threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00406158: GetTickCount.KERNEL32 ref: 0040618F
Part of subcall function 00406158: GetTickCount.KERNEL32 ref: 004061A7

Part of subcall function 00416CE4: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00416D02

GetThreadLocale.KERNEL32(00000000,00000004), ref: 004175FB
EnumCalendarInfoW.KERNEL32(0041744C,00000000,00000000,00000004), ref: 00417606
GetThreadLocale.KERNEL32(00000000,00000003,0041744C,00000000,00000000,00000004), ref: 00417636
EnumCalendarInfoW.KERNEL32(004174D8,00000000,00000000,00000003,0041744C,00000000,00000000,00000004), ref: 00417641
GetThreadLocale.KERNEL32(00000000,00000004), ref: 004176D2
EnumCalendarInfoW.KERNEL32(0041744C,00000000,00000000,00000004), ref: 004176DD
GetThreadLocale.KERNEL32(00000000,00000003,0041744C,00000000,00000000,00000004), ref: 0041770F
EnumCalendarInfoW.KERNEL32(004174D8,00000000,00000000,00000003,0041744C,00000000,00000000,00000004), ref: 0041771A

Strings

8AA, xrefs: 00417770
B.C., xrefs: 00417680
pBA, xrefs: 00417737

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoLocale$CalendarEnumThread$CountTick
String ID: 8AA$B.C.$pBA
API String ID: 1601775584-1801559493
Opcode ID: db743d50ddc811bb4b19ec784315abac5a425741be62414b27879390e3c3a899
Instruction ID: f779f405f7bf5c115b4640ed699a02e87b66550376314941ef65ff2446fb59c1
Opcode Fuzzy Hash: db743d50ddc811bb4b19ec784315abac5a425741be62414b27879390e3c3a899
Instruction Fuzzy Hash: 6B51E4706043009FC751EB69DD82AEA77B5EB94314F11817EF810AB3E2CB38AD418B9D

Function 0042C08C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 148COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,0042B5A8,0000001C,00000000,0042C292,?,00000000,00000000), ref: 0042C0D3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,0042B5A8,0000001C,00000000,0042C292,?,00000000,00000000), ref: 0042C121

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Part of subcall function 0042C398: ExitProcess.KERNEL32(00000000,00000000,00432828), ref: 0042C3B1

Strings

\CMD.EXE, xrefs: 0042C1E0
PATHEXT, xrefs: 0042C143, 0042C156
$P$G, xrefs: 0042C16E
KEYS, xrefs: 0042C1FF
COMSPEC, xrefs: 0042C17D, 0042C1F3
\CMD.EXE, xrefs: 0042C1D2
.COM;.EXE;.BAT;.CMD, xrefs: 0042C151
PATH, xrefs: 0042C126, 0042C139
PROMPT, xrefs: 0042C160, 0042C173

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitFileLoadModuleNameProcessQueryStringVirtual
String ID: $P$G$.COM;.EXE;.BAT;.CMD$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE$\CMD.EXE
API String ID: 3132779286-2718134287
Opcode ID: 378fedc8eb04913ae9282e370df604eca6602215c14efdda8b876530ccaa9b6e
Instruction ID: c6f3d75e003e591319e080799ca882cd3471f38fa8cddb2bbb44a27153a8f319
Opcode Fuzzy Hash: 378fedc8eb04913ae9282e370df604eca6602215c14efdda8b876530ccaa9b6e
Instruction Fuzzy Hash: 485161747002158FD700EBAAECC269E73A4EB89354B90957BE800DB352DB7CDC418BAD

Function 0041C4B8 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00440F84,00002001,00000000,00000000,00000000,0042D52C,00000000,0042D5ED,?,0043AEC8,00000000,?,?,00428180,00000000), ref: 0041C4CB

Strings

RANDOM, xrefs: 0041C5CD
ERRORLEVEL, xrefs: 0041C509
TIME, xrefs: 0041C5A0
CMDEXTVERSION, xrefs: 0041C533
DATE, xrefs: 0041C573
CMDCMDLINE, xrefs: 0041C557

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentVariable
String ID: CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$RANDOM$TIME
API String ID: 1431749950-3577079365
Opcode ID: aa02ba526aba6a2cb1b7ceeda021806e895254bdce99554e738f717af2fcf0ea
Instruction ID: c5e49d4f8323c7dcc25afabd03bc36df13bddd75a41424c8c249d721635f5fa0
Opcode Fuzzy Hash: aa02ba526aba6a2cb1b7ceeda021806e895254bdce99554e738f717af2fcf0ea
Instruction Fuzzy Hash: 1231B170B8066572E720227B5DC27DB124A9BD0794F14903BBC06EB387E6ACDCC2439E

Function 0042DF84 Relevance: 18.2, APIs: 12, Instructions: 152COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5), ref: 0042DFC6
GetConsoleMode.KERNEL32(?,?,000000F5), ref: 0042DFD9
SetConsoleMode.KERNEL32(?,?,?,?,000000F5), ref: 0042DFF4
GetLastError.KERNEL32(?,?,?,?,000000F5), ref: 0042DFF9
GetStdHandle.KERNEL32(000000F6,?,?,000000F5), ref: 0042E000
GetConsoleMode.KERNEL32(?,?,000000F6,?,?,000000F5), ref: 0042E013
SetConsoleMode.KERNEL32(?,?,?,?,000000F6,?,?,000000F5), ref: 0042E038
GetLastError.KERNEL32(?,?,?,?,000000F6,?,?,000000F5), ref: 0042E03D
GetStdHandle.KERNEL32(000000F6,000000FF,?,?,000000F6,?,?,000000F5), ref: 0042E096
FlushConsoleInputBuffer.KERNEL32(00000000,000000F6,000000FF,?,?,000000F6,?,?,000000F5), ref: 0042E09C
SetConsoleMode.KERNEL32(?,?,?,?,000000F6,?,?,000000F5), ref: 0042E16B
SetConsoleMode.KERNEL32(?,?,?,?,000000F6,?,?,000000F5), ref: 0042E181

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Console$Mode$Handle$ErrorLast$BufferFlushInput
String ID:
API String ID: 589625271-0
Opcode ID: 438c3773d31c425142d0acd2361cc7c0041ad1dbebca37dd8401495308a48b39
Instruction ID: b62f991822aacebff3112e291d8033601b920fb396382c85d7fae18f17ef378a
Opcode Fuzzy Hash: 438c3773d31c425142d0acd2361cc7c0041ad1dbebca37dd8401495308a48b39
Instruction Fuzzy Hash: AA51D0716083609ACB20DF2AD845B6B77E4BF85328F484A2FF894972D1D778C945C71B

Function 004202A4 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 353COMMON

Download Yara Rule

Strings

D, xrefs: 0042035D, 0042038D, 00420558, 004206B5, 00420773
PROMPT, xrefs: 00420335
Unknown, xrefs: 00420750
%.*s, xrefs: 0042068F
%s>, xrefs: 004203A8
+++++++++++++++++++++++++++++++++, xrefs: 00420674
hIC, xrefs: 004202FA
$, xrefs: 004203C8
%s , xrefs: 00420724

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$EnterEnvironmentLeaveLoadStringVariable
String ID: $$%.*s$%s $%s>$+++++++++++++++++++++++++++++++++$PROMPT$Unknown$hIC$D
API String ID: 3837321750-545324147
Opcode ID: 4e1d57c0f2c874a2a788936fd0359a5a04647f1ce96b68dc4d6d7b7391cd29d2
Instruction ID: 883c0385007684d30356b67a48d011197ac73531404de27a67a391f6c1155b98
Opcode Fuzzy Hash: 4e1d57c0f2c874a2a788936fd0359a5a04647f1ce96b68dc4d6d7b7391cd29d2
Instruction Fuzzy Hash: 62F11930E00218EFCB50DBA9D995B9DB7F0EF48310F5480A6E415E7292D778AE81CF59

Function 0042CF78 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,00000000,0042D31D,?,?,?,?), ref: 0042CFE0
SetErrorMode.KERNEL32(?,00000000,00000000,00000000,0042D31D,?,?,?,?), ref: 0042D0CA
GetFileAttributesW.KERNEL32(0043498C,00000000,0042D31D,?,?,?,?), ref: 0042D169
GetLastError.KERNEL32(0043498C,00000000,0042D31D,?,?,?,?), ref: 0042D180
GetFileAttributesW.KERNEL32(00434988,00000000,0042D31D,?,?,?,?), ref: 0042D1BF
GetLastError.KERNEL32(00434988,00000000,0042D31D,?,?,?,?), ref: 0042D1D6
GetFileAttributesW.KERNEL32(00434984,00000000,0042D31D,?,?,?,?), ref: 0042D1F7

Part of subcall function 0041E3BC: _get_osfhandle.MSVCRT ref: 0041E3C2
Part of subcall function 0041E3BC: GetFileType.KERNEL32(00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000), ref: 0041E3CB
Part of subcall function 0041E3BC: GetConsoleMode.KERNEL32(00000000,?,000000F6,00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000), ref: 0041E407

GetLastError.KERNEL32(00434984,00000000,0042D31D,?,?,?,?), ref: 0042D20E

Part of subcall function 0041E450: _get_osfhandle.MSVCRT ref: 0041E454
Part of subcall function 0041E450: GetFileType.KERNEL32(00000000,00000000,0041ECF4,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E45B

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Strings

:\*, xrefs: 0042CF99, 0042D235
\, xrefs: 0042D22E

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFile$AttributesLastMode$Type_get_osfhandle$ConsoleLoadString
String ID: :\*$\
API String ID: 3917490256-2060159975
Opcode ID: e0aba001a1734eff74b5f0870aaec981b43b90093d8db2693008d2f189d9164b
Instruction ID: 8676db7fcce67f9e7c17ae9da64bc12e3ed9348eebe21c3817a212eeca1f1944
Opcode Fuzzy Hash: e0aba001a1734eff74b5f0870aaec981b43b90093d8db2693008d2f189d9164b
Instruction Fuzzy Hash: 6AB18170F00615CFDB20EFA9E88179A73F0AF49318F90856AE450973A5E779DC42CB69

Function 00416D5C Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 219threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0041704B,?,?,?,?,00000000,00000000), ref: 00416D83
GetThreadLocale.KERNEL32(?,00000001,00000000,0041704B,?,?,?,?,00000000,00000000), ref: 00416D8C

Part of subcall function 00416D30: GetLocaleInfoW.KERNEL32(?,0000000F,<nA,00000002,0000002C,?,?,?,00416E3C), ref: 00416D43

Part of subcall function 00416CE4: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00416D02

Strings

AMPM , xrefs: 00416FD3
m/d/yy, xrefs: 00416E97
:mm:ss, xrefs: 00416FFE
pBA, xrefs: 00416DA0
AMPM, xrefs: 00416FC4
:mm, xrefs: 00416FE3
mmmm d, yyyy, xrefs: 00416EBC
2, xrefs: 00417027

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy$pBA
API String ID: 233154393-1309873074
Opcode ID: 9fe86e8d231827b89954bae2f4a73363bf767d3e158fae614fceef9cd323ec1f
Instruction ID: ae2340563471d082460ba2b478ea8b8b299e0bf9addc3d726e6e7ff642e47639
Opcode Fuzzy Hash: 9fe86e8d231827b89954bae2f4a73363bf767d3e158fae614fceef9cd323ec1f
Instruction Fuzzy Hash: B47132707041085BDB01EB65D841ADF76B6EF88704F51807BF504AB386DA3DDA46C7A9

Function 0041EF44 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000800,0043DE14,?,00000000,0041F1C8), ref: 0041EFB6
GetLastError.KERNEL32(000000FF,?,00000800,0043DE14,?,00000000,0041F1C8), ref: 0041EFC1

Part of subcall function 0042DE0C: GetDriveTypeW.KERNEL32 ref: 0042DE29

CreateDirectoryW.KERNEL32(?,00000000,?,00000800,0043DE14,?,00000000,0041F1C8), ref: 0041EFE8
GetLastError.KERNEL32(?,00000000,?,00000800,0043DE14,?,00000000,0041F1C8), ref: 0041EFF5

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Strings

:, xrefs: 0041EF6D
\, xrefs: 0041F0FF

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryDriveFullLoadNamePathStringType
String ID: :$\
API String ID: 3155896459-1166558509
Opcode ID: d475d4f3deb5f9b6467045b0e950e967c7d80e3c0a897bc957d6c898a5ab2ce1
Instruction ID: 5f8715485b1821dd9e71d7c95c07ccd0ccd496caa82c902b5291760976a09a66
Opcode Fuzzy Hash: d475d4f3deb5f9b6467045b0e950e967c7d80e3c0a897bc957d6c898a5ab2ce1
Instruction Fuzzy Hash: 3671A274E00204EBDB10EF95C981AEEB7F1EF58314F5081BAE404A7291E77C9E8AD759

Function 00403890 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 285windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004024DC,00002010), ref: 00403C84

Strings

j0C, xrefs: 00403A12
, xrefs: 00403BBD
TjC, xrefs: 004038E2
@$@, xrefs: 00403A6E, 00403A7C
7, xrefs: 00403A08
h$@, xrefs: 00403BF2, 00403C00
TjC, xrefs: 0040396F

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Message
String ID: $7$@$@$TjC$TjC$h$@$j0C
API String ID: 2030045667-870653932
Opcode ID: 3865173792abf774d962e86b543473beabf32d9ea3fb5edf836efcdce3cb461e
Instruction ID: 70882ba3cec9f805b14261335af8e53c6eefcb66acd924a6baa1ca9ca47d01dc
Opcode Fuzzy Hash: 3865173792abf774d962e86b543473beabf32d9ea3fb5edf836efcdce3cb461e
Instruction Fuzzy Hash: 40B17830B042548BDB21EF2DC880B997BF8AB09705F1451F6E449EB387DB789E85CB59

Function 00422C5C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 209COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32(00000020,?,00000200,?,?,?,00000000,00000000,00000000,00422FB9), ref: 00422D7C
GetLastError.KERNEL32(00000020,?,00000200,?,?,?,00000000,00000000,00000000,00422FB9), ref: 00422D9E
GetLastError.KERNEL32(000000FF,00000020,?,00000200,?,?,?,00000000,00000000,00000000,00422FB9), ref: 00422DD1

Part of subcall function 0041EBE0: _get_osfhandle.MSVCRT ref: 0041EC50
Part of subcall function 0041EBE0: WriteConsoleW.KERNEL32(00000000,0043AEC8,00000000,?,00000000,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000), ref: 0041EC57
Part of subcall function 0041EBE0: GetLastError.KERNEL32(00000000,0043AEC8,00000000,?,00000000,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000), ref: 0041EC66
Part of subcall function 0041EBE0: GetLastError.KERNEL32(?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000,00000000,?,0041BCE1,00000000), ref: 0041ECA9

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Strings

:, xrefs: 00422CA3
%0.4X-%0.4X, xrefs: 00422F33
D, xrefs: 00422CBB
\, xrefs: 00422CA9
, xrefs: 00422C9D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$ConsoleInformationLoadStringVolumeWrite_get_osfhandle
String ID: $%0.4X-%0.4X$:$\$D
API String ID: 3192398648-954999098
Opcode ID: 3b968ef8a7dc9ef9144539650c664523049d8260251d66a9b7497a9a0391377a
Instruction ID: e2d4084d0e5931fd1a20d6d2d95e0c62f8f5af0845b4235fdc188e1e617b3777
Opcode Fuzzy Hash: 3b968ef8a7dc9ef9144539650c664523049d8260251d66a9b7497a9a0391377a
Instruction Fuzzy Hash: 22919430A102289BCB26DB25DD817DDB3F9AF45314F9041EAE408AB2D5D7B86F85CF49

Function 0040388E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 207COMMON

Download Yara Rule

Strings

j0C, xrefs: 00403A12
, xrefs: 00403BBD
TjC, xrefs: 004038E2
@$@, xrefs: 00403A6E, 00403A7C
7, xrefs: 00403A08
h$@, xrefs: 00403BF2, 00403C00
TjC, xrefs: 0040396F

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: $7$@$@$TjC$TjC$h$@$j0C
API String ID: 0-870653932
Opcode ID: 9634f1cfca89adc7cdb218cedbe1645155aa5edda4f342eb7045ed18cbfa3a2a
Instruction ID: f5476afb3b956266bac58d5710667e828f49a60b966df5c0ed2e6b75f59184a9
Opcode Fuzzy Hash: 9634f1cfca89adc7cdb218cedbe1645155aa5edda4f342eb7045ed18cbfa3a2a
Instruction Fuzzy Hash: 8C819430B042548FDB21EF2DC884B99BBF8AB09705F1451F6E448E7386DB789A85CB59

Function 00427200 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 183registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 00427274
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,02000000,00000000,?,?,?,?,?), ref: 00427317
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,00000000,02000000,00000000,?,?,?,?,?), ref: 00427377

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

RegDeleteKeyW.ADVAPI32(?,00000000), ref: 00427396
RegSetValueExW.ADVAPI32(?,004274EC,00000000,00000002,00000000,00000001,?,?,?), ref: 004273FF
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?), ref: 0042747D

Strings

%s\Shell\Open\Command, xrefs: 00427255
%s=%s, xrefs: 00427430

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$CreateDeleteLoadOpenStringValue
String ID: %s=%s$%s\Shell\Open\Command
API String ID: 1799281012-1013525187
Opcode ID: 43e74d0b0a1c9e6f6be711a04ce70c4a0f0f3c3539546040015a37e19b3fb71b
Instruction ID: 9c63a30ad6edb18036cc17ca58e6e95f7b7a22c75c83e8365899d70be6a1fa2a
Opcode Fuzzy Hash: 43e74d0b0a1c9e6f6be711a04ce70c4a0f0f3c3539546040015a37e19b3fb71b
Instruction Fuzzy Hash: B1711175E042289BDB10DB95DC89B9EB7B5FB48300F5041DAE808A7291D77C5F84CF69

Function 0042D4DC Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0041C4B8: GetEnvironmentVariableW.KERNEL32(?,00440F84,00002001,00000000,00000000,00000000,0042D52C,00000000,0042D5ED,?,0043AEC8,00000000,?,?,00428180,00000000), ref: 0041C4CB

SetCurrentDirectoryW.KERNEL32(00000000,00000000,0042D5ED,?,0043AEC8,00000000,?,?,00428180,00000000,00000000,00428119), ref: 0042D533
SetErrorMode.KERNEL32(00000001,00000000,0042D5ED,?,0043AEC8,00000000,?,?,00428180,00000000,00000000,00428119), ref: 0042D54C
SetCurrentDirectoryW.KERNEL32(?,00000000,0042D5ED,?,0043AEC8,00000000,?,?,00428180,00000000,00000000,00428119), ref: 0042D590
SetErrorMode.KERNEL32(00000000,?,00000000,0042D5ED,?,0043AEC8,00000000,?,?,00428180,00000000,00000000,00428119), ref: 0042D5C3

Strings

=, xrefs: 0042D503
D, xrefs: 0042D5C8
:, xrefs: 0042D516
\, xrefs: 0042D569

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CurrentDirectoryErrorMode$EnvironmentVariable
String ID: :$=$\$D
API String ID: 1902915753-4086321335
Opcode ID: c84258a3773b430e6ba999c71d2aa19d1b98ac79dbb9b191f04c105e3f7fbf05
Instruction ID: d5cb7de9750c05d6a24e2ac071ac77ede12de5704f6aad5faa042bac199d095e
Opcode Fuzzy Hash: c84258a3773b430e6ba999c71d2aa19d1b98ac79dbb9b191f04c105e3f7fbf05
Instruction Fuzzy Hash: C1218734D4022C9ADB11EF65DC456DEB3B4EF54708F5081ABE804A7250E7784F85CB99

Function 0041BD54 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 211timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,000000FF,00000000,0041C032,?,?,?,?), ref: 0041BF46

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

GetLastError.KERNEL32(?,?,000000FF,00000000,0041C032,?,?,?,?), ref: 0041BF8F
GetLastError.KERNEL32(000000FF,?,?,000000FF,00000000,0041C032,?,?,?,?), ref: 0041BF9D

Strings

:, xrefs: 0041BDB2
%.2d%s%0.2d%s, xrefs: 0041BD9D
%s, xrefs: 0041BEFA
., xrefs: 0041BDB8

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$LoadLocalStringTime
String ID: %.2d%s%0.2d%s$%s$.$:
API String ID: 2097227092-2097317611
Opcode ID: 572cb3da4348d12fe114bbc9acc3fcb2a98db5148e49d3e19b5225238afd6654
Instruction ID: 0d642e9cdfeddb0e002c2ee26661f49aa49ec77cac97d5663e1e43f25fd6ecb9
Opcode Fuzzy Hash: 572cb3da4348d12fe114bbc9acc3fcb2a98db5148e49d3e19b5225238afd6654
Instruction Fuzzy Hash: 88814D30914208DBCB24DBA5D8816DDB7F1FF05318F60453BE511A7292E7B899C6CB8D

Function 0041F544 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 160shareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR(?,00000000,00000000,00000000), ref: 0041F646

Strings

:, xrefs: 0041F713
D, xrefs: 0041F71A
\, xrefs: 0041F689
\, xrefs: 0041F5CF
A, xrefs: 0041F6E3
:, xrefs: 0041F616

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Connection2
String ID: :$:$A$\$\$D
API String ID: 951124676-1323042167
Opcode ID: e914f0622c5744d1859c830ce3f5db66f3a9537acc603cc0c3237f7d7d033627
Instruction ID: de6903be853d0e93713632dca1f23a446e42e65ae98195daa72b8d6ba732463c
Opcode Fuzzy Hash: e914f0622c5744d1859c830ce3f5db66f3a9537acc603cc0c3237f7d7d033627
Instruction Fuzzy Hash: EA51BD30A04604CFCB15DF65C880B9AB7F1EF59304F01D076E8049B3A6E779988ACB6D

Function 00406CC4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?,?,00406E92,0040401B,00404062,?,00000000), ref: 00406CFD
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?,?,00406E92,0040401B,00404062,?), ref: 00406D03
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D,?,?,?), ref: 00406D1E
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00406D7D), ref: 00406D24
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00406D42

Strings

Error, xrefs: 00406D36
Runtime error at 00000000, xrefs: 00406CF6, 00406D3B

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: eecde37390cf18eeda7ac79a75cdfe9e86cdc58b2b1ae6d9a14d2b40840ab541
Instruction ID: 8d232dfbb4434259f94e32261e0cdce2704fc8c62347cff489187cca3be3a9f4
Opcode Fuzzy Hash: eecde37390cf18eeda7ac79a75cdfe9e86cdc58b2b1ae6d9a14d2b40840ab541
Instruction Fuzzy Hash: 13F0F6B078834575F611B7A45D0AF5A225CDF08F16F21957BBA50B90D2C7FC98C4922E

Function 00402E28 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00402A98), ref: 00402EBE
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00402A98), ref: 00402ED8

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 861abcb8f46a6eb64ff94c89fb904ba08e9bc9a138af66715ca9642c7f326342
Instruction ID: 4bfebdeae85c00683b5610abe5ea885f333ee3dbc8b623835842db8a6bbcc228
Opcode Fuzzy Hash: 861abcb8f46a6eb64ff94c89fb904ba08e9bc9a138af66715ca9642c7f326342
Instruction Fuzzy Hash: AC71E1716042019BE715DB29CA89B17BBE0AB85314F14C2BFE844AB3E2D6F88845C799

Function 00403020 Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccb220493a30a118f36d08614cbabc300c0a4fc2c6b366e5b05fe71cc2a2771
Instruction ID: 2a671d29592211b5fbf572d6eb98111a1a3df8bc4f9b39c3c733f7aeb79d3fcb
Opcode Fuzzy Hash: 5ccb220493a30a118f36d08614cbabc300c0a4fc2c6b366e5b05fe71cc2a2771
Instruction Fuzzy Hash: DBC136727102010BD724AE7D9E8836EB7859BC9322F18867FE104EB3D6DABCCD458358

Function 0041FDC4 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 316COMMON

Download Yara Rule

APIs

Part of subcall function 0042C35C: EnterCriticalSection.KERNEL32(0044E930,0042B61D,0044E930,00000000,0042B88D,?,00000000), ref: 0042C361
Part of subcall function 0042C35C: LeaveCriticalSection.KERNEL32(0044E930,0044E930,0042B61D,0044E930,00000000,0042B88D,?,00000000), ref: 0042C372

GetLastError.KERNEL32(00000000,00000008,00000000,0042026D,?,?), ref: 0041FEBA

Part of subcall function 0042B37C: _get_osfhandle.MSVCRT ref: 0042B38B
Part of subcall function 0042B37C: GetStdHandle.KERNEL32(000000F5,?,00444F94,00000000), ref: 0042B396
Part of subcall function 0042B37C: _get_osfhandle.MSVCRT ref: 0042B3A4
Part of subcall function 0042B37C: GetConsoleScreenBufferInfo.KERNEL32(00000000,?,000000F5,?,00444F94,00000000), ref: 0042B3C6
Part of subcall function 0042B37C: ReadConsoleW.KERNEL32(?,00444F94,?,?,00000000,000000F5,?,00444F94,00000000), ref: 0042B3DE

GetLastError.KERNEL32(?,00000000,0042026D,?,?), ref: 0041FF50
GetLastError.KERNEL32(?,00000000,0042026D,?,?), ref: 0041FF95
GetLastError.KERNEL32 ref: 0041FFE8

Part of subcall function 0041EBE0: _get_osfhandle.MSVCRT ref: 0041EC50
Part of subcall function 0041EBE0: WriteConsoleW.KERNEL32(00000000,0043AEC8,00000000,?,00000000,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000), ref: 0041EC57
Part of subcall function 0041EBE0: GetLastError.KERNEL32(00000000,0043AEC8,00000000,?,00000000,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000), ref: 0041EC66
Part of subcall function 0041EBE0: GetLastError.KERNEL32(?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000,00000000,?,0041BCE1,00000000), ref: 0041ECA9

Strings

hIC, xrefs: 0042016C
:RD, xrefs: 0042005B, 0042007D, 0042008A, 00420135, 00420203, 0042021D, 00420227, 00420239
:RD, xrefs: 0042017E

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$Console_get_osfhandle$CriticalSection$BufferEnterHandleInfoLeaveReadScreenWrite
String ID: :RD$:RD$hIC
API String ID: 1270314918-2772246872
Opcode ID: f00a14a44e0c9934d5298f88f3914fae55959ba783fa867a066df0bc10cc7119
Instruction ID: 3a1e2a02244a5b1a33384499df5aa427a36e3745cb5a1aa3f888342b3af32766
Opcode Fuzzy Hash: f00a14a44e0c9934d5298f88f3914fae55959ba783fa867a066df0bc10cc7119
Instruction Fuzzy Hash: 94D16C35A00214DFDB10DBA5E88679E77F0BB46314F9046BBE410972A2D7BC9D86CB1E

Function 00406158 Relevance: 10.6, APIs: 7, Instructions: 131threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004063F4: GetCurrentThreadId.KERNEL32 ref: 004063F7

GetTickCount.KERNEL32 ref: 0040618F
GetTickCount.KERNEL32 ref: 004061A7
GetCurrentThreadId.KERNEL32 ref: 004061D7
GetTickCount.KERNEL32 ref: 00406202
GetTickCount.KERNEL32 ref: 00406239
GetTickCount.KERNEL32 ref: 00406263
GetCurrentThreadId.KERNEL32 ref: 004062D3

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: ff0d451f1921140a55af1f059dfb466f60419af23f985ae784c06128e562ecce
Instruction ID: 29d9ba70e5f2eb885d164a0b3de890b460bf9a057a9a9946b3bc9aeb2f14b802
Opcode Fuzzy Hash: ff0d451f1921140a55af1f059dfb466f60419af23f985ae784c06128e562ecce
Instruction Fuzzy Hash: EC41AD302093419ED721AE78C58431FBBD5AF81344F16897EE8DA972C6EB7DC990874A

Function 0042B37C Relevance: 9.1, APIs: 6, Instructions: 134COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0042B38B
GetStdHandle.KERNEL32(000000F5,?,00444F94,00000000), ref: 0042B396
_get_osfhandle.MSVCRT ref: 0042B3A4
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,000000F5,?,00444F94,00000000), ref: 0042B3C6
ReadConsoleW.KERNEL32(?,00444F94,?,?,00000000,000000F5,?,00444F94,00000000), ref: 0042B3DE
ReadConsoleW.KERNEL32(?,00444F94,?,?,00000010,00000000,?,000000F5,?,00444F94,00000000), ref: 0042B42E

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Console$Read_get_osfhandle$BufferHandleInfoScreen
String ID:
API String ID: 4242899780-0
Opcode ID: 81de232f7f58ca491d334bce3cc634e26f614ea0127cad6c2617a712c03c7ba5
Instruction ID: 68f6ff667c68eff74639935069849f5357d53d3815d3a5c9b98a9f84a1c888ce
Opcode Fuzzy Hash: 81de232f7f58ca491d334bce3cc634e26f614ea0127cad6c2617a712c03c7ba5
Instruction Fuzzy Hash: 8D419471E00219AFCB10EFA9D8816EEB7F4EF09324F504166E560E7391D7789E41CBA9

Function 00420C28 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(00000000,00421044,?,00000000,00000021,?), ref: 00420D47

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

wcstol.MSVCRT ref: 00420DA4
wcstol.MSVCRT ref: 00420DD8

Strings

ERRORLEVEL, xrefs: 00420CFC
CMDCMDLINE, xrefs: 00420D36

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: wcstol$CommandLineLoadString
String ID: CMDCMDLINE$ERRORLEVEL
API String ID: 3320807497-3727483786
Opcode ID: ec263c1166ed5ab579c4425a6849d398a9a950159ec0bce2f8d7376ec96b4547
Instruction ID: 2066b3ef339eff4d0f9fdd73cae23a1c68702821149802ea9f6ad196cc38f9a4
Opcode Fuzzy Hash: ec263c1166ed5ab579c4425a6849d398a9a950159ec0bce2f8d7376ec96b4547
Instruction Fuzzy Hash: 54D18A70F002298FCB10DFA9E9816EEB3F1BF58314F95456AE410A7391D778AD81CB69

Function 00423CCC Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 306COMMON

Download Yara Rule

APIs

Part of subcall function 0041E3BC: _get_osfhandle.MSVCRT ref: 0041E3C2
Part of subcall function 0041E3BC: GetFileType.KERNEL32(00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000), ref: 0041E3CB
Part of subcall function 0041E3BC: GetConsoleMode.KERNEL32(00000000,?,000000F6,00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000), ref: 0041E407

Part of subcall function 0041E450: _get_osfhandle.MSVCRT ref: 0041E454
Part of subcall function 0041E450: GetFileType.KERNEL32(00000000,00000000,0041ECF4,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E45B

_get_osfhandle.MSVCRT ref: 00423E21
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000000,00424139,?,00000001,?,?,?,00424332,00000000,0042434A,?,00000001), ref: 00423E28
SearchPathW.KERNEL32(DPATH,?,00000000,00000104,?,?,00000000,00424139,?,00000001,?,?,?,00424332,00000000,0042434A), ref: 00423FF6
GetLastError.KERNEL32(000000FF,00000000,00424139,?,00000001,?,?,?,00424332,00000000,0042434A,?,00000001,00000000,00000000), ref: 004240D3

Strings

DPATH, xrefs: 00423FF1

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File_get_osfhandle$Type$ConsoleErrorLastModePathPointerSearch
String ID: DPATH
API String ID: 813518873-2010427443
Opcode ID: ebc1fe81ea560fcdaaf8c0a055be5403ecf9010572c76a7342151e43c5ac1934
Instruction ID: 5f1ea81e580a7f05d0caead0e58977167eeada402022a173e920dd21153f8b96
Opcode Fuzzy Hash: ebc1fe81ea560fcdaaf8c0a055be5403ecf9010572c76a7342151e43c5ac1934
Instruction Fuzzy Hash: 1BD15130B002248BDB20EF65E88579AB7B0EF48314F5481EAE8189B395D77CDE85CF59

Function 0041E3BC Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0041E3C2
GetFileType.KERNEL32(00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000), ref: 0041E3CB
GetStdHandle.KERNEL32(000000F6,00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000), ref: 0041E3E8
GetStdHandle.KERNEL32(000000F5,00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000), ref: 0041E3F3
GetStdHandle.KERNEL32(000000F4,00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000), ref: 0041E3FE
GetConsoleMode.KERNEL32(00000000,?,000000F6,00000000,?,00000000,00000000,0041ECC8,?,?,?,00000000,0041ED55,?,00440F84,00000000), ref: 0041E407

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$ConsoleFileModeType_get_osfhandle
String ID:
API String ID: 3006655848-0
Opcode ID: d70a2db51f614da4d766352b73f96fc6dd45ea5288b3446b70f99a505d1153d6
Instruction ID: 50b90ea80130b39a20dab3d9e418b1bb2675c93bd250fe14ffb35702c42ef723
Opcode Fuzzy Hash: d70a2db51f614da4d766352b73f96fc6dd45ea5288b3446b70f99a505d1153d6
Instruction Fuzzy Hash: C201D8796082105ED320977BAD493FA25C49706378F68073BEC66D22D3E76C4CC2525F

Function 00402AA4 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00402A70), ref: 00402B5B
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00402A70), ref: 00402B71
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00402A70), ref: 00402B9F
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00402A70), ref: 00402BB5

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fbed82d3cfe5f33c82c6b13f3a5eca371e9553dc365f3410045f166b6d929db3
Instruction ID: d6c9818163ac4615f7c5c11563140dab7e23f2c8159fce2275c5c82e41bb5f9c
Opcode Fuzzy Hash: fbed82d3cfe5f33c82c6b13f3a5eca371e9553dc365f3410045f166b6d929db3
Instruction Fuzzy Hash: 54C159726013129FE715DF28DA88716BBE0EB86310F19C2BFD445AB3D1C7B89941C7A9

Function 0041E478 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0041E47E
GetFileType.KERNEL32(00000000,?,00000000,00000000,0041EC3D,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000), ref: 0041E487
GetStdHandle.KERNEL32(000000F6,00000000,?,00000000,00000000,0041EC3D,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000), ref: 0041E4A4
GetStdHandle.KERNEL32(000000F5,00000000,?,00000000,00000000,0041EC3D,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000), ref: 0041E4AF
GetStdHandle.KERNEL32(000000F4,00000000,?,00000000,00000000,0041EC3D,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000), ref: 0041E4BA
GetConsoleMode.KERNEL32(00000000,?,000000F6,00000000,?,00000000,00000000,0041EC3D,?,?,00000000,0041ED55,?,00440F84,00000000,00000000), ref: 0041E4C3

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Handle$ConsoleFileModeType_get_osfhandle
String ID:
API String ID: 3006655848-0
Opcode ID: e702d8a8ed5436618eb197489e4d97f6ccaab42bdcae16d8e3bf9fea5cc3dbb3
Instruction ID: 9cf0d6bec0b9fa9ceb0a92f8ab7afb08ece9beb0ec36215879b94a990e9376b7
Opcode Fuzzy Hash: e702d8a8ed5436618eb197489e4d97f6ccaab42bdcae16d8e3bf9fea5cc3dbb3
Instruction Fuzzy Hash: 38F0377B61D3203A9A1021772D855FF10988A5A3B47380737BD26E72D2D85D8CD1217F

Function 00428368 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

GOTO, xrefs: 004283ED, 00428402
8RD, xrefs: 004284E5

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 8RD$GOTO
API String ID: 0-1652146345
Opcode ID: d4b5a97b48a0859f1856e18cf6974029dbe03c960dad603f6cf5db9a0e9f7ee5
Instruction ID: 47bb2f638037c66365c0b937d1684f8f6f490ee3f669bde7e7b0daa95634b018
Opcode Fuzzy Hash: d4b5a97b48a0859f1856e18cf6974029dbe03c960dad603f6cf5db9a0e9f7ee5
Instruction Fuzzy Hash: 98915A70B012259FDB10EFA9E88179EB7F0AF48314F94856FE80597391DB7CA980CB59

Function 0041EBE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0041EC50
WriteConsoleW.KERNEL32(00000000,0043AEC8,00000000,?,00000000,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000), ref: 0041EC57
GetLastError.KERNEL32(00000000,0043AEC8,00000000,?,00000000,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000), ref: 0041EC66
GetLastError.KERNEL32(?,?,?,00000000,0041ED55,?,00440F84,00000000,00000000,00000000,00000000,00000000,00000000,?,0041BCE1,00000000), ref: 0041ECA9

Part of subcall function 00416C48: FormatMessageW.KERNEL32(00003300,00000000,?,00000000,?,00000000,00000000,00000000,00000000,?,?,0041ED23,000000FF,?), ref: 00416C62
Part of subcall function 00416C48: LocalFree.KERNEL32(?,00416CBE,00003300,00000000,?,00000000,?,00000000,00000000,00000000,00000000,?,?,0041ED23,000000FF,?), ref: 00416CB1

Strings

p, xrefs: 0041ECB7

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$ConsoleFormatFreeLocalMessageWrite_get_osfhandle
String ID: p
API String ID: 2270358821-2181537457
Opcode ID: 0204b2111009f6fdd1736e9e54ef18b357ba1b1f8898a310d257fec38ef63b86
Instruction ID: 49edcebe0a85dd48a2e070739db156686d173b9639f2b96a125106bac5c506d9
Opcode Fuzzy Hash: 0204b2111009f6fdd1736e9e54ef18b357ba1b1f8898a310d257fec38ef63b86
Instruction Fuzzy Hash: 5F41D774B002159FEB00EBA6DD81BEE73B4EF44314F50852AF810A7281DA7CAD8187A9

Function 004269AC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,0000020A), ref: 004269EC
RegQueryValueW.ADVAPI32(?,0000002E,?,0000020A), ref: 00426A2E
RegQueryValueW.ADVAPI32(?,00000000,?,0000020A), ref: 00426AC7

Strings

%s=%s, xrefs: 00426A69, 00426AF8
., xrefs: 00426A0A

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: QueryValue$Enum
String ID: %s=%s$.
API String ID: 4111014795-4275322459
Opcode ID: f1c62476c0a59da3f590bf0842a351fa31978a8ee87c3719ef33815e40657458
Instruction ID: 2c636fb1329cd15d83b00e9da85558723bf258c0e801e26cfe553c4b9cd9d097
Opcode Fuzzy Hash: f1c62476c0a59da3f590bf0842a351fa31978a8ee87c3719ef33815e40657458
Instruction Fuzzy Hash: EF4175B1B042389ADB21DA55DC947DEBBB8EB09304F8140FBE904E3241D7785E94CB9E

Function 00417BE8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00417D94), ref: 00417C1B
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00417C3F
GetModuleFileNameW.KERNEL32(MZP,?,00000105), ref: 00417C5A
LoadStringW.USER32(00000000,0000FFEA,?,00000100), ref: 00417CF5

Strings

MZP, xrefs: 00417C59

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID: MZP
API String ID: 3990497365-2889622443
Opcode ID: 3ef64bc2c4261145098a3c062584a36777ad11253964d742893b81a22fb6573c
Instruction ID: 80ab70f2b93dfe37295a3ae79f27070d34fcea32ae60c8c3a02933449a0be010
Opcode Fuzzy Hash: 3ef64bc2c4261145098a3c062584a36777ad11253964d742893b81a22fb6573c
Instruction Fuzzy Hash: B3413D70A0431C9FDB20DF65CC81BDAB7B9AB98314F5080FAE508E7241DB799E948F59

Function 00405F90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00405FA6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00405FAC
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00405FC8

Strings

kernel32.dll, xrefs: 00405FA1
GetLogicalProcessorInformation, xrefs: 00405F9C

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-812649623
Opcode ID: bd2e3c33bd11c53c5d300c0185f8ce7b7d7f868649576a545f0bf7f30e04c864
Instruction ID: 5d6e66ec93e10d7886517edabbe52e5c8cd566ed8fa27352bdb5c7e07854c76c
Opcode Fuzzy Hash: bd2e3c33bd11c53c5d300c0185f8ce7b7d7f868649576a545f0bf7f30e04c864
Instruction Fuzzy Hash: 6111B671D44204AEEB20EBA5D946B5EB7F8DB40314F2240BFE805B22C2D67D9FA0865D

Function 00405F8E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00405FA6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00405FAC
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00405FC8

Strings

kernel32.dll, xrefs: 00405FA1
GetLogicalProcessorInformation, xrefs: 00405F9C

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-812649623
Opcode ID: 251978b34e377692bc80b67647e58cdc138d8128925342292972071cfe3dea7e
Instruction ID: 44311a6b8b6cd7867a0930f42e4339a60c21becb3f61a42b79d02befdf299494
Opcode Fuzzy Hash: 251978b34e377692bc80b67647e58cdc138d8128925342292972071cfe3dea7e
Instruction Fuzzy Hash: B5018471D84204AEDB20EBA1D946A6EB7E99B00314F2140BFF805F61C2D67D9AA08619

Function 0042DE40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,004245FD), ref: 0042DE65
GetVolumeInformationW.KERNEL32(?,?,00000104,?,?,?,00000000,00000000,?,004245FD), ref: 0042DE9F
GetLastError.KERNEL32(?,?,00000104,?,?,?,00000000,00000000,?,004245FD), ref: 0042DEA8

Strings

\, xrefs: 0042DE52
:, xrefs: 0042DE4B

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DriveErrorInformationLastTypeVolume
String ID: :$\
API String ID: 1929915864-1166558509
Opcode ID: 2303b1fb79b5ef4a2e638baf1db761647025159a071e0685a8e53359de552362
Instruction ID: 85d4e233b75b5ba4ad75be32e4d70d4f67db23e6f388f99416d30daa92100dda
Opcode Fuzzy Hash: 2303b1fb79b5ef4a2e638baf1db761647025159a071e0685a8e53359de552362
Instruction Fuzzy Hash: 2BF081B1918750A5D720DA50D881B9F72ECBF54304F954C1FF5A4CA290E778E145875F

Function 0042B278 Relevance: 7.6, APIs: 5, Instructions: 104fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0042B288
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00444F94,00000000), ref: 0042B2A1
ReadFile.KERNEL32(?,0043EE16,?,?,00000000,?,00000000,00000000,00000001,?,00444F94,00000000), ref: 0042B2BD

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$PointerRead_get_osfhandle
String ID:
API String ID: 1944154119-0
Opcode ID: cca99747a22471e377f59d3bbb4defd00f25036e75d1cfff84522416b49370b0
Instruction ID: bda4b283853c0d5d0cdd0b75419822c66d349f292db09f5999b03b3f87793a3c
Opcode Fuzzy Hash: cca99747a22471e377f59d3bbb4defd00f25036e75d1cfff84522416b49370b0
Instruction Fuzzy Hash: 96315071A04214AFDB10CB99DC81FABB7F9EB89310F548096F904DB350D378AD4187A9

Function 0041E2B0 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 68a29e21ada7a1d73980bf707f426c2ec723bc7b4cba94b3d701aa2d8859e2c5
Instruction ID: be95d2f0238709fc43d2869d9c4b94caec4bed5684931305ea1f8c02383cc80f
Opcode Fuzzy Hash: 68a29e21ada7a1d73980bf707f426c2ec723bc7b4cba94b3d701aa2d8859e2c5
Instruction Fuzzy Hash: ED21B279B0421457D710AB7B8C4279A62D5AF85324F14843BEC55CB382EAFDC8C283AF

Function 0041E1C4 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0041E1D8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00002000,0043EE16,00002000,00000000,00000000,00000000,00000000,00000000), ref: 0041E20E
WriteFile.KERNEL32(?,0043EE16,00000000,?,00000000,00000000,00000000,?,00002000,0043EE16,00002000,00000000,00000000,00000000,00000000,00000000), ref: 0041E230
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,0043EE16,00002000,00000000,00000000,00000000,00000000,00000000), ref: 0041E26E
WriteFile.KERNEL32(?,0043EE16,-00000001,?,00000000,00000000,00000000,?,000000FF,0043EE16,00002000,00000000,00000000,00000000,00000000,00000000), ref: 0041E284

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharFileMultiWideWrite$_get_osfhandle
String ID:
API String ID: 3996430891-0
Opcode ID: a2915911fdd40aad71c27654f119cbc523d1265d8c514667d98e034dbd955a97
Instruction ID: bbc2714c1c9e7c79e86cffdd82a24e7e5c29a21ae3c0866453ce4e5d5395e40d
Opcode Fuzzy Hash: a2915911fdd40aad71c27654f119cbc523d1265d8c514667d98e034dbd955a97
Instruction Fuzzy Hash: 4431A571A40314BBE710D69AEC85FAFBBBCEB45710F14006AFE14FB2C0C279694087A9

Function 004254F4 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetVDMCurrentDirectories.KERNEL32(00000000,00000000), ref: 004254FF
GetVDMCurrentDirectories.KERNEL32(00000000,00000000), ref: 00425520
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00425940,00000000,?), ref: 00425547
SetErrorMode.KERNEL32(00000001,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00425940,00000000), ref: 0042554E
SetErrorMode.KERNEL32(00000000,00000001,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00425940), ref: 0042557D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CurrentDirectoriesErrorMode$ByteCharMultiWide
String ID:
API String ID: 3679696385-0
Opcode ID: 4a82e97b66778526a6b20d6be2ed8ce1e4d9c9984b7e68dffe4e68b52a3f9724
Instruction ID: d350da4ff1af98a08e1eeb4a403d6ddfca8be5bcb7a4e2b7c14f04b77815b3f5
Opcode Fuzzy Hash: 4a82e97b66778526a6b20d6be2ed8ce1e4d9c9984b7e68dffe4e68b52a3f9724
Instruction Fuzzy Hash: CA019672B055206BC220777E9C86F5F72E99B46764F45413BF404DB381DA6DCC8142EE

Function 004275FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 0042753C: LoadLibraryW.KERNEL32(psapi.dll,00000000,00000000,?,?,0042760E,00000000,?,00000000), ref: 00427550

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000), ref: 00427620
GetLastError.KERNEL32(?,?,QueryFullProcessImageNameW,kernel32.dll,00000000,?,00000000), ref: 0042769F

Part of subcall function 00419704: GetLastError.KERNEL32(00427597,00000000,004275A1,?,00000000,GetModuleFileNameExW,psapi.dll,00000000,00000000,?,?,0042760E,00000000,?,00000000), ref: 00419704

Strings

QueryFullProcessImageNameW, xrefs: 00427633
kernel32.dll, xrefs: 0042761B

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$HandleLibraryLoadModule
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 4252302101-1740548384
Opcode ID: 2ecd39ebd3d3d0c26c18704bc697b779764e4d1741cb5c07a2a77b02de8e63c0
Instruction ID: 5bf0f1c2fe2c7a787f9c561c4908e978d8bb44830b088c148e6cd9204b6364d6
Opcode Fuzzy Hash: 2ecd39ebd3d3d0c26c18704bc697b779764e4d1741cb5c07a2a77b02de8e63c0
Instruction Fuzzy Hash: 8131A970708A146FDB11FBBDAC42A5E77A8DF46768F90047BF400E3282EA3DAD41865D

Function 00426CB8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000002,Software\Classes,?), ref: 00426CE2
RegCloseKey.ADVAPI32(?,000000FF,80000002,Software\Classes,?,00000000,00426DE5,?,?,?,?,00000000,00000000,00000000), ref: 00426DC5

Part of subcall function 00426E30: RegEnumKeyW.ADVAPI32(?,00000000,?,0000020A), ref: 00426E7C

Strings

Software\Classes, xrefs: 00426CD8
{, xrefs: 00426D59

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEnumOpen
String ID: Software\Classes${
API String ID: 1332880857-1310189716
Opcode ID: 604154dfae668fc49c7baf1f66e9bdc13dfc555cbb4c44506076eef4809354bd
Instruction ID: 41c6464a7724e3360542a107b1677f7f227151cf13a16c47f588d303f585f86a
Opcode Fuzzy Hash: 604154dfae668fc49c7baf1f66e9bdc13dfc555cbb4c44506076eef4809354bd
Instruction Fuzzy Hash: F431C934B1022C9BD711EAA5EC8279EB2E5DF44314FA2447BF4019B382DABCDD42865D

Function 0042685C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000002,Software\Classes,?), ref: 00426888
RegCloseKey.ADVAPI32(?,000000FF,80000002,Software\Classes,?,00000000,00426973), ref: 00426958

Part of subcall function 004269AC: RegEnumKeyW.ADVAPI32(?,00000000,?,0000020A), ref: 004269EC

Strings

=, xrefs: 004268F2
Software\Classes, xrefs: 0042687E

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEnumOpen
String ID: =$Software\Classes
API String ID: 1332880857-889067453
Opcode ID: ee26286127dcb09f04be502dc97ab55d4b14339310faf369ff7dc467277d3b7e
Instruction ID: 4dea960224145465aac807c044d6743f0e5bfb1072e4a62240e343e54dfe5282
Opcode Fuzzy Hash: ee26286127dcb09f04be502dc97ab55d4b14339310faf369ff7dc467277d3b7e
Instruction Fuzzy Hash: 1731E8B0B002259BDB11EBA5EC8165E72E5EB89314BA2407AE400D7382EE7C9E85C75D

Function 0042E390 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetConsoleTitleW.KERNEL32(?,00000104,?,?,00000000,004246B4), ref: 0042E3DA
SetConsoleTitleW.KERNEL32(004349AC,?,00000104,?,?,00000000,004246B4), ref: 0042E455

Strings

dIC, xrefs: 0042E39D
- , xrefs: 0042E425

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleTitle
String ID: - $dIC
API String ID: 3358957663-2260885757
Opcode ID: 18df4d967149f5399ccad87f48e1912b26981e4ae86bd0de4b6f9ce047a5f831
Instruction ID: 382b0d7edfda4a521a0743bb4888e91c1c0fcf324d801d56f11b5a71215d4869
Opcode Fuzzy Hash: 18df4d967149f5399ccad87f48e1912b26981e4ae86bd0de4b6f9ce047a5f831
Instruction Fuzzy Hash: A2110771705251DBD311FB6AE88579AB7E4AB46704F44983AF5848B3A2CB7CDC80CB1E

Function 004277C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004277DD

Part of subcall function 00415038: ReadFile.KERNEL32(00000000,?,00000040,?,00000000,00000040,00000000,00000000,00000000,004277F8,00000000,80000000,00000001,00000000,00000003,00000080), ref: 0041504C

CloseHandle.KERNEL32(00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00427856

Part of subcall function 00415064: SetFilePointer.KERNEL32(00000000,?,00000000,00000000,0042780E,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00415069

Strings

PE, xrefs: 0042781C
MZ, xrefs: 004277F8

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID: MZ$PE
API String ID: 4133201480-1102611028
Opcode ID: 080d7fcd422ba145720c091abd9a2e7172d80cf72804ec405ce97fc805721fe6
Instruction ID: dcbb4d889583db28263f28d856cd42f979cbba9703595e9051f617ed9aa36113
Opcode Fuzzy Hash: 080d7fcd422ba145720c091abd9a2e7172d80cf72804ec405ce97fc805721fe6
Instruction Fuzzy Hash: 3C01D830705350D7E720B6649CA179B62954FC4744F40493EB7816B3C2DABDDD48C289

Function 004243B8 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

/, xrefs: 0042450F
(D, xrefs: 004246BD

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: (D$/
API String ID: 0-3590975923
Opcode ID: b73c55f1a1c11231f2fda68aaa44fd8890c8353eabaff80dcfa3fcbeb8af9d29
Instruction ID: 6f62d097e54fc76a3fdcbae2efac5aa7994de3f4d19eb2cd12b22caf22ed59e9
Opcode Fuzzy Hash: b73c55f1a1c11231f2fda68aaa44fd8890c8353eabaff80dcfa3fcbeb8af9d29
Instruction Fuzzy Hash: BD81D430B002358BCB10EF65E884799B3F1EF95324F9145BAE8055B391D77C9E46CB49

Function 0042D6AC Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0042D757
WriteConsoleW.KERNEL32(00000000,0043AEC8,?,?,00000000,?,0000000C,00000000,?), ref: 0042D75E
GetLastError.KERNEL32(00000000,0043AEC8,?,?,00000000,?,0000000C,00000000,?), ref: 0042D767
GetLastError.KERNEL32(?,?,0000000C,00000000,?), ref: 0042D79F

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$ConsoleWrite_get_osfhandle
String ID:
API String ID: 581457647-0
Opcode ID: d0847b2d41681145c7de68883382b7b0378422511e1ad2c79dbce1ec6b9b98b9
Instruction ID: 73474893b2bac90f9fb368502ecf05381c80657d066e765acdf0f66f0c11b644
Opcode Fuzzy Hash: d0847b2d41681145c7de68883382b7b0378422511e1ad2c79dbce1ec6b9b98b9
Instruction Fuzzy Hash: 87314F71F002289BDB10DFA9D88179EB7F5AF88354F64847BAD04E7341E63CAD4187A9

Function 004279E4 Relevance: 6.1, APIs: 4, Instructions: 95fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00427A65
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00427A83
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000002), ref: 00427AB3
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000002), ref: 00427AD7

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Pointer$Read_get_osfhandle
String ID:
API String ID: 2224376348-0
Opcode ID: 59933432a4225aee383a2e0b5c2ec8e77a34ea1e634fd73134ecfa4a1ac26d76
Instruction ID: 7fbcd090624c8a26a52c4677edfcc844109b7a7b14e75264bb4cf7280c4330dc
Opcode Fuzzy Hash: 59933432a4225aee383a2e0b5c2ec8e77a34ea1e634fd73134ecfa4a1ac26d76
Instruction Fuzzy Hash: A4413B79600244AFC710EF59CC81E9A77A9FF88310F50C16AF949CF362DB35EA518B99

Function 00408B9C Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00408BAD
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00408C0B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00408C68
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00408C9B

Part of subcall function 00408B58: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00408C19), ref: 00408B6F
Part of subcall function 00408B58: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00408C19), ref: 00408B8C

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 5bd000ef9faf2ce5e777626ed128adf9e5d6de55d318ed006bf182100a3e7eda
Instruction ID: 4f86612df9afef8dc168f762eba1a3b0a8d2813837681946306221ac72f68b06
Opcode Fuzzy Hash: 5bd000ef9faf2ce5e777626ed128adf9e5d6de55d318ed006bf182100a3e7eda
Instruction Fuzzy Hash: 86316F70E0421E9BDB10EFA5C885AAEB7B8EF04304F40457EF555F72D1DB78AA448B68

Function 0042385C Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5), ref: 00423883
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,000000F5), ref: 00423890
FillConsoleOutputAttribute.KERNEL32(00000000,00000000,?,000000F5,000000F5,00000000,?,000000F5), ref: 004238BE
SetConsoleTextAttribute.KERNEL32(00000000,00000000,00000000,00000000,?,000000F5,000000F5,00000000,?,000000F5), ref: 004238C5

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: 39b98d81768fe0f695e9bdb72f311459652956ba8a69d336e6e891405d4c9120
Instruction ID: 4d734664593e06f5a9a13dc878724b12bc6292eb1d5fcd029eae1ebd6b877874
Opcode Fuzzy Hash: 39b98d81768fe0f695e9bdb72f311459652956ba8a69d336e6e891405d4c9120
Instruction Fuzzy Hash: 5BF0C85160822579E3006A618C819BF72FCDF9535AF44492BF891DA2C0E77CCE5163AB

Function 0042DC78 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DC88
GetExitCodeProcess.KERNEL32(?), ref: 0042DC8F
CloseHandle.KERNEL32(?,?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DCB6

Part of subcall function 0042C378: EnterCriticalSection.KERNEL32(0044E930,0042DCA2,?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042C37D
Part of subcall function 0042C378: LeaveCriticalSection.KERNEL32(0044E930,0044E930,0042DCA2,?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042C391

fflush.MSVCRT ref: 0042DCA4

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$CloseCodeEnterExitHandleLeaveObjectProcessSingleWaitfflush
String ID:
API String ID: 4081377292-0
Opcode ID: d041d10ecb1b1bca371db88a83d314c5df1ce85a1ca8d53eea094f96a1889b27
Instruction ID: 165dcddb9c5a3f0605b6d5cceaa86326c34234312b7ca19cca0c1976a0007937
Opcode Fuzzy Hash: d041d10ecb1b1bca371db88a83d314c5df1ce85a1ca8d53eea094f96a1889b27
Instruction Fuzzy Hash: CEE012B02483006ED600BB6BEC8296A7299AF89339B11572AB074A62D6CA7C5850852A

Function 00404B6C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

+K@, xrefs: 00404BBF, 00404BE2
``C, xrefs: 00404D0C, 00404D17, 00404D6A, 00404D25, 00404D43, 00404D53

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: +K@$``C
API String ID: 0-2148898874
Opcode ID: 20347ee991edc8de7611bb411ebc3471355b1df6111ca01e0d7f09b2ac20f7b6
Instruction ID: 5cc954d6e20fa8cd40a837c61c0d3408391d1c3201b641b4e0ac55a79da3e991
Opcode Fuzzy Hash: 20347ee991edc8de7611bb411ebc3471355b1df6111ca01e0d7f09b2ac20f7b6
Instruction Fuzzy Hash: C05102B09081A49BDB11EB65C4957EE7BB49F81308F0904FBD941BB2C7D63C9E05C7A9

Function 00418864 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00418A36), ref: 004188DA
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,00418A36), ref: 004188FC

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Strings

6A, xrefs: 00418997, 004189F9

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: 6A
API String ID: 902310565-1828091119
Opcode ID: 0a8a5f7d25dd6d408f29b0100952c20c11dbea0b9899c723a057f4e62207b4fc
Instruction ID: 55bb49759d43a2ddf400105b3ccf1db1d043e12df8e760a6825baaaedb2eb6b1
Opcode Fuzzy Hash: 0a8a5f7d25dd6d408f29b0100952c20c11dbea0b9899c723a057f4e62207b4fc
Instruction Fuzzy Hash: A951F674A046599FDB20EF68CD89BC9B7F4EB48314F1041EAE808A7351D778AE84CF59

Function 004251F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 0042DC44: TerminateProcess.KERNEL32(?,00000001,?,00000000,00434960,00425227,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DC50
Part of subcall function 0042DC44: GetLastError.KERNEL32(?,00000001,?,00000000,00434960,00425227,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DC59

_get_osfhandle.MSVCRT ref: 00425290
FlushFileBuffers.KERNEL32(00000000,?,0043AEC8,00000000,00000000,0042C55D), ref: 00425297

Part of subcall function 0042DC78: WaitForSingleObject.KERNEL32(?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DC88
Part of subcall function 0042DC78: GetExitCodeProcess.KERNEL32(?), ref: 0042DC8F
Part of subcall function 0042DC78: fflush.MSVCRT ref: 0042DCA4
Part of subcall function 0042DC78: CloseHandle.KERNEL32(?,?,000000FF,?,00434960,00425267,?,?,?,?,0043AEC8,00000000,00000000,0042C55D), ref: 0042DCB6

Strings

`IC, xrefs: 004251F8

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$BuffersCloseCodeErrorExitFileFlushHandleLastObjectSingleTerminateWait_get_osfhandlefflush
String ID: `IC
API String ID: 440551933-2046359124
Opcode ID: e4bb4563ce19de5ba2b113e5e2a50cfca94e9231daa0c95ba7d1f3c92f28fe24
Instruction ID: b5343a7084197eb16992b0b5e7ff8d9a711c96aa0a7cdb134deb011f145a5fc8
Opcode Fuzzy Hash: e4bb4563ce19de5ba2b113e5e2a50cfca94e9231daa0c95ba7d1f3c92f28fe24
Instruction Fuzzy Hash: 3031E435B01A30CFC714EF6AE484B1673A1AF56714B8A40EAE5048B3A6D778EC45CF5A

Function 00426B7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(?,00000000), ref: 00426BAD
RegSetValueW.ADVAPI32(?,00000000,00000001,00000004,00000000), ref: 00426BF1

Part of subcall function 00409B90: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00409BD5

Strings

%s=%s, xrefs: 00426C0D

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DeleteLoadStringValue
String ID: %s=%s
API String ID: 165137819-1087296587
Opcode ID: 576e67d2379019df031d6c4b188bcd91c3005552ce4e1f1353e7d1a2dc1f2866
Instruction ID: 3b9df548e103ad227f4ac6bca07f9f4cc23eb33f3e385fab044275901cdf35ac
Opcode Fuzzy Hash: 576e67d2379019df031d6c4b188bcd91c3005552ce4e1f1353e7d1a2dc1f2866
Instruction Fuzzy Hash: 93217930E043589BDB11EB96D881BDEB7F4EF49704F91416AE800B7381D7BC5E04CA9A

Function 0042753C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(psapi.dll,00000000,00000000,?,?,0042760E,00000000,?,00000000), ref: 00427550

Part of subcall function 00419704: GetLastError.KERNEL32(00427597,00000000,004275A1,?,00000000,GetModuleFileNameExW,psapi.dll,00000000,00000000,?,?,0042760E,00000000,?,00000000), ref: 00419704

Strings

GetModuleFileNameExW, xrefs: 00427568
psapi.dll, xrefs: 0042754B

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastLibraryLoad
String ID: GetModuleFileNameExW$psapi.dll
API String ID: 3568775529-1894792326
Opcode ID: b88f964b1472b510e97091693d9faaac061a02f4c2a613b4dedebd6dd4897fb3
Instruction ID: 130a6a2728818ef488f4c6a2e2615dec33ddd6d4cc94b6a22f4423864622f3f4
Opcode Fuzzy Hash: b88f964b1472b510e97091693d9faaac061a02f4c2a613b4dedebd6dd4897fb3
Instruction Fuzzy Hash: 1AF09679308324FED7415FB7BC55B22B668F766758FD1043BE40481A60D67C5880852D

Function 0042DE0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32 ref: 0042DE29

Strings

\, xrefs: 0042DE1A
:, xrefs: 0042DE13

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: 858a0acfbb05ab264ed078d721505fe814c7f53a396ecafd7f1ef06bc34f1488
Instruction ID: 0fbc0fdf5cdb0dc1e3a63b8c9b6641b5bbdd805e049915c2c93339e7d82eb778
Opcode Fuzzy Hash: 858a0acfbb05ab264ed078d721505fe814c7f53a396ecafd7f1ef06bc34f1488
Instruction Fuzzy Hash: D2D05E2112D34058A3109B24590610EB3E0EE81334FA0D91FE0AC962D4FB369046A30F

Function 004197D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0043236F,00000000,004323A6), ref: 004197DE

Part of subcall function 0040A664: GetProcAddress.KERNEL32(?,0042B88D), ref: 0040A688

Strings

kernel32.dll, xrefs: 004197D9
GetDiskFreeSpaceExW, xrefs: 004197E9

Memory Dump Source

Source File: 00000000.00000002.1836081492.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1836069438.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836104214.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836117915.0000000000435000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836129930.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836156931.0000000000450000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836169887.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1836182121.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: 8df9d7db37854f209d6322b4b6d05ce3073977e900c6ee5fcd9c5f41e5e7dd67
Instruction ID: c6d731c50d33cff667622933a37d5dc3a313c9916d13df34d1e9f3d205f4ed8c
Opcode Fuzzy Hash: 8df9d7db37854f209d6322b4b6d05ce3073977e900c6ee5fcd9c5f41e5e7dd67
Instruction Fuzzy Hash: 77D05EB0E143019ADB00BFB26CD679222749720305F54983BE02055282DBBC8E818F9C

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_71e4f97fcad7bd8af59197fe7fdb89b6f66cc6a_89969336_9d5f8a6b-4665-44cb-89ec-0ff41a3c22d9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5517.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5585.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER55C5.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
file.exe

Function 00409500 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Function 004093C8 Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Function 00408FEC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Function 00432408 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 290
threadCOMMON

Function 00417DE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
filewindowCOMMON

Function 00408CB8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Function 0042EE28 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61
registryCOMMON

Function 00406D5C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
threadCOMMON

Function 00406D54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87
threadCOMMON

Function 00403E10 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 63
COMMON

Function 0040278C Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38
memoryCOMMON

Function 004095CC Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Function 004068DA Relevance: 3.1, APIs: 2, Instructions: 68
COMMON

Function 004096F0 Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Function 00408478 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON