Edit tour

Windows Analysis Report
Unlock_Tool_2.3.1.exe

Overview

General Information

Sample name:	Unlock_Tool_2.3.1.exe
Analysis ID:	1538171
MD5:	72162382680c702829c6ceed17d2e507
SHA1:	51324f4095fe73a99d080d9f0bba1c829430bb18
SHA256:	eaae82540ddec53797abee6d3bf507acace850f3fff7cb2a03b6a26ab0b5c46f
Tags:	exeuser-KnownStormChaser
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Self deletion via cmd or bat file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Unlock_Tool_2.3.1.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" MD5: 72162382680C702829C6CEED17D2E507)

Unlock_Tool_2.3.1.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" MD5: 72162382680C702829C6CEED17D2E507)

cmd.exe (PID: 5928 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7136 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 7480 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199786602107"], "Botnet": "23a142269e47ce1692ccc9fb68473bc2"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7336	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7336	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7336	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7404	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7404	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7404	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Unlock_Tool_2.3.1.exe.7ab930.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.Unlock_Tool_2.3.1.exe.7ab930.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
2.2.Unlock_Tool_2.3.1.exe.400000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.Unlock_Tool_2.3.1.exe.400000.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
2.2.Unlock_Tool_2.3.1.exe.400000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.Unlock_Tool_2.3.1.exe.400000.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.Unlock_Tool_2.3.1.exe.790000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.Unlock_Tool_2.3.1.exe.790000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.Unlock_Tool_2.3.1.exe.7ab930.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.Unlock_Tool_2.3.1.exe.7ab930.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T17:59:29.851328+0200	2028765	3	Unknown Traffic	192.168.2.6	49839	65.109.142.154	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Unlock_Tool_2.3.1.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199786602107"], "Botnet": "23a142269e47ce1692ccc9fb68473bc2"}

Multi AV Scanner detection for submitted file

Source: Unlock_Tool_2.3.1.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Unlock_Tool_2.3.1.exe

Joe Sandbox ML: detected

Source: Unlock_Tool_2.3.1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.142.154:443 -> 192.168.2.6:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49850 version: TLS 1.2

Source: Unlock_Tool_2.3.1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_0079A7CB FindFirstFileExW,		0_2_0079A7CB
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0079A7CB FindFirstFileExW,		2_2_0079A7CB

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_00415182 GetLogicalDriveStringsA,_memset,GetDriveTypeA,

2_2_00415182

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	0_2_007AC1DD
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	0_2_007AC1DD
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	2_2_004014AD
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	2_2_004014AD

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199786602107

Source: global traffic	HTTP traffic detected: GET /profiles/76561199786602107 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lpnjoke HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49839 -> 65.109.142.154:443

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 65.109.142.154Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.142.154
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_00406963 InternetOpenA,InternetConnectA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,

2_2_00406963

Source: global traffic	HTTP traffic detected: GET /profiles/76561199786602107 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 65.109.142.154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lpnjoke HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ equals www.youtube.com (Youtube)
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.ered.com/explore/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: Unlock_Tool_2.3.1.exe, 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgclass=
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgsive/header_logo.png
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.re
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptotml
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptowered.com/explore/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.oudflare
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ore.steampowered.com/explore/
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199786602107[1].htm.2.dr	String found in binary or memory: https://65.109.142.154
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/%
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/0
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/L
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/U
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.142.154/c
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199786602107[1].htm.2.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.c
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.stea
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/app
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=D_iTAfDsLH
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=4Xou
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&amp
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199786602107[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/6
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 76561199786602107[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199786602107
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Unlock_Tool_2.3.1.exe, Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107
Source: Unlock_Tool_2.3.1.exe, 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.000000000127A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107h
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.000000000127A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107y
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/Z
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2400133479.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Unlock_Tool_2.3.1.exe, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/lpnjoke
Source: Unlock_Tool_2.3.1.exe, 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/lpnjokeg0b4cMozilla/5.0
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/lpnjokeh
Source: Unlock_Tool_2.3.1.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.142.154:443 -> 192.168.2.6:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49850 version: TLS 1.2

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007CC0F7	0_2_007CC0F7
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_0079E0E8	0_2_0079E0E8
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007C71E7	0_2_007C71E7
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007C427F	0_2_007C427F
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007D82E1	0_2_007D82E1
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00791317	0_2_00791317
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00792415	0_2_00792415
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007C6487	0_2_007C6487
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007D86B3	0_2_007D86B3
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007A2820	0_2_007A2820
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007D7AAE	0_2_007D7AAE
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007D8A9B	0_2_007D8A9B
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_0079DC60	0_2_0079DC60
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00795E4E	0_2_00795E4E
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00798F68	0_2_00798F68
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007D7F43	0_2_007D7F43
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0041C4B7	2_2_0041C4B7
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0042D983	2_2_0042D983
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0042D213	2_2_0042D213
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0041954F	2_2_0041954F
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0042DD6B	2_2_0042DD6B
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0042CD7E	2_2_0042CD7E
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0042D5B1	2_2_0042D5B1
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0041B757	2_2_0041B757
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_007A2820	2_2_007A2820
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0079E0E8	2_2_0079E0E8
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00791317	2_2_00791317
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0079DC60	2_2_0079DC60
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00792415	2_2_00792415
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00795E4E	2_2_00795E4E
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00798F68	2_2_00798F68

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: String function: 007923D0 appears 70 times
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: String function: 0079A48A appears 36 times
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: String function: 004104BC appears 36 times
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: String function: 004105DE appears 71 times

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 272

Source: Unlock_Tool_2.3.1.exe

Static PE information: invalid certificate

Source: Unlock_Tool_2.3.1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Unlock_Tool_2.3.1.exe

Static PE information: Section: .data ZLIB complexity 0.9950630040322581

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/7@3/3

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_0041147A CreateToolhelp32Snapshot,Process32First,Process32Next,

2_2_0041147A

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_0041196C __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z,__EH_prolog3_catch,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear,

2_2_0041196C

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199786602107[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5876:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7336

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: Unlock_Tool_2.3.1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Unlock_Tool_2.3.1.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 272
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Unlock_Tool_2.3.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Unlock_Tool_2.3.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Unlock_Tool_2.3.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Unlock_Tool_2.3.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Unlock_Tool_2.3.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Unlock_Tool_2.3.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Unlock_Tool_2.3.1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Unlock_Tool_2.3.1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Unlock_Tool_2.3.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Unlock_Tool_2.3.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Unlock_Tool_2.3.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Unlock_Tool_2.3.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Unlock_Tool_2.3.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_0042587E LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0042587E

Source: Unlock_Tool_2.3.1.exe

Static PE information: section name: .dash

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007DA240 push cs; ret	0_2_007DA241
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007DA210 push esp; retn 0003h	0_2_007DA215
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007915F4 push eax; ret	0_2_00791653
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007DC845 push 0000004Ch; iretd	0_2_007DC856
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007C8B35 push ecx; ret	0_2_007C8B48
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007D9EC2 push ecx; ret	0_2_007D9ED5
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007A2F31 push ecx; ret	0_2_007A2F44
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0042F192 push ecx; ret	2_2_0042F1A5
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00422D89 push esi; ret	2_2_00422D8B
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0041DE05 push ecx; ret	2_2_0041DE18
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00432715 push 0000004Ch; iretd	2_2_00432726
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_007915F4 push eax; ret	2_2_00791653
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_007A2F31 push ecx; ret	2_2_007A2F44

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit			Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.7ab930.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Unlock_Tool_2.3.1.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Unlock_Tool_2.3.1.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.7ab930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7404, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Unlock_Tool_2.3.1.exe	Binary or memory string: DIR_WATCH.DLL
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL23:02:3123:02:3123:02:3123:02:3123:02:3123:02:31DELAYS.TMP%S%SNTDLL.DLL
Source: Unlock_Tool_2.3.1.exe	Binary or memory string: SBIEDLL.DLL
Source: Unlock_Tool_2.3.1.exe	Binary or memory string: API_LOG.DLL

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

2_2_0040180D

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

API coverage: 4.9 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 7512

Thread sleep count: 89 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_0079A7CB FindFirstFileExW,		0_2_0079A7CB
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0079A7CB FindFirstFileExW,		2_2_0079A7CB

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_00415182 GetLogicalDriveStringsA,_memset,GetDriveTypeA,

2_2_00415182

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_00410F8F GetSystemInfo,

2_2_00410F8F

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWzf
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:}]
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001218000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpJ)
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001218000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	API call chain: ExitProcess graph end node			graph_2-31000
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	API call chain: ExitProcess graph end node			graph_2-31016

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 0_2_007915F4 LdrInitializeThunk,

0_2_007915F4

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 0_2_00792178 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00792178

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

2_2_0042587E

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00791659 mov edi, dword ptr fs:[00000030h]	0_2_00791659
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007AC1DD mov eax, dword ptr fs:[00000030h]	0_2_007AC1DD
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007AC1D2 mov eax, dword ptr fs:[00000030h]	0_2_007AC1D2
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007AC1BA mov eax, dword ptr fs:[00000030h]	0_2_007AC1BA
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_007C330C mov eax, dword ptr fs:[00000030h]	0_2_007C330C
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_0079765D mov ecx, dword ptr fs:[00000030h]	0_2_0079765D
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_0079B9E5 mov eax, dword ptr fs:[00000030h]	0_2_0079B9E5
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_004014AD mov eax, dword ptr fs:[00000030h]	2_2_004014AD
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0040148A mov eax, dword ptr fs:[00000030h]	2_2_0040148A
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_004014A2 mov eax, dword ptr fs:[00000030h]	2_2_004014A2
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_004185DC mov eax, dword ptr fs:[00000030h]	2_2_004185DC
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0079B9E5 mov eax, dword ptr fs:[00000030h]	2_2_0079B9E5
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00791659 mov edi, dword ptr fs:[00000030h]	2_2_00791659
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0079765D mov ecx, dword ptr fs:[00000030h]	2_2_0079765D

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 0_2_0079C45E GetProcessHeap,

0_2_0079C45E

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00792178 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00792178
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00792305 SetUnhandledExceptionFilter,	0_2_00792305
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00796984 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00796984
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 0_2_00791CCE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00791CCE
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0041D05A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041D05A
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0041D9DC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041D9DC
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_0042767E SetUnhandledExceptionFilter,	2_2_0042767E
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00792178 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00792178
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00796984 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00796984
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00792305 SetUnhandledExceptionFilter,	2_2_00792305
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: 2_2_00791CCE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00791CCE

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7404, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_0040F51F _memset,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,

2_2_0040F51F

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Memory written: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 0_2_007ABE6B cpuid

0_2_007ABE6B

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	0_2_007D0163
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_007D22F6
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	0_2_007D47D0
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_007D58C0
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	0_2_007D4AEE
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_007D3B44
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: GetLocaleInfoA,	2_2_00410DB0
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_0042B11C
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	2_2_0042B211
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	2_2_00429AA0
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	2_2_0042B2B8
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	2_2_0042B313
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	2_2_0042AB90
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	2_2_00425433
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	2_2_0042B4E4
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	2_2_004274EC
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_004275C6
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	2_2_0042B5D0
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: EnumSystemLocalesA,	2_2_0042B5A6
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	2_2_00429DBE
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	2_2_0042E5BF
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	2_2_0042B673
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_00428E14
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	2_2_0042B637
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Code function: GetLocaleInfoA,	2_2_0042E6F4

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 0_2_00792065 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00792065

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_00410C28 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00410C28

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Code function: 2_2_00410D03 GetTimeZoneInformation,

2_2_00410D03

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001218000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.7ab930.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Unlock_Tool_2.3.1.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Unlock_Tool_2.3.1.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.7ab930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7404, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.7ab930.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Unlock_Tool_2.3.1.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Unlock_Tool_2.3.1.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Unlock_Tool_2.3.1.exe.7ab930.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Unlock_Tool_2.3.1.exe PID: 7404, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	211 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Unlock_Tool_2.3.1.exe	66%	ReversingLabs	Win32.Trojan.StealC
Unlock_Tool_2.3.1.exe	100%	Avira	HEUR/AGEN.1305290
Unlock_Tool_2.3.1.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://player.vimeo.com	0%	URL Reputation	safe
http://cowod.hopto.org	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
http://cowod.hopto.org_DEBUG.zip/c	0%	URL Reputation	safe
http://cowod.hopto.	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
http://cowod.hopto	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
http://cowod.hopto.org/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
t.me	149.154.167.99	true	false	unknown
cowod.hopto.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/lpnjoke	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199786602107	76561199786602107[1].htm.2.dr	false		unknown
https://steamcommunity.com/?subsection=broadcasts	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
http://cowod.hopto.org	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://store.steampowered.com/subscriber_agreement/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&amp	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
http://www.valvesoftware.com/legal.htm	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199786602107y	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.000000000127A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	Unlock_Tool_2.3.1.exe, 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hopto.orgclass=	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://t.me/lpnjokeg0b4cMozilla/5.0	Unlock_Tool_2.3.1.exe, 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199786602107h	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.000000000127A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/app	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://65.109.142.154	76561199786602107[1].htm.2.dr	false		unknown
https://s.ytimg.com;	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
http://www.entrust.net/rpa03	Unlock_Tool_2.3.1.exe	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=4Xou	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://store.steampowered.com/points/shop/	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=D_iTAfDsLH	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://sketchfab.com	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/privacy_agreement/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.stea	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://www.google.com/recaptcha/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hoptotml	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
http://crl.entrust.net/2048ca.crl0	Unlock_Tool_2.3.1.exe	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2400133479.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://www.entrust.net/rpa0	Unlock_Tool_2.3.1.exe	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgsive/header_logo.png	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/my/wishlist/	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://t.me/	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
http://ocsp.entrust.net03	Unlock_Tool_2.3.1.exe	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	Unlock_Tool_2.3.1.exe	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://store.steampowered.com/news/	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0	Unlock_Tool_2.3.1.exe, 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://65.109.142.154/0	Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://65.109.142.154/%	Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
http://cowod.hopto.re	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://medal.tv	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://store.steampowered.com/steam_refunds/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://65.109.142.154/L	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
http://crl.entrust.net/ts1ca.crl0	Unlock_Tool_2.3.1.exe	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400297153.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://login.steampowered.com/	Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/6	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001218000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.c	Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://65.109.142.154/U	Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org/	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	Unlock_Tool_2.3.1.exe, 00000002.00000002.2447739196.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, 76561199786602107[1].htm.2.dr	false		unknown
https://recaptcha.net	Unlock_Tool_2.3.1.exe, 00000002.00000003.2400483429.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2421704792.00000000012A4000.00000004.00000020.00020000.00000000.sdmp, Unlock_Tool_2.3.1.exe, 00000002.00000003.2399682592.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
65.109.142.154	unknown	United States	11022	ALABANZA-BALTUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538171
Start date and time:	2024-10-20 17:58:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Unlock_Tool_2.3.1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/7@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 47 Number of non-executed functions: 135
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Unlock_Tool_2.3.1.exe

Simulations

Behavior and APIs

Time	Type	Description
11:59:17	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:59:31	API Interceptor	1x Sleep call for process: Unlock_Tool_2.3.1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
65.109.142.154	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Win32.DropperX-gen.7855.32539.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	https://njanimallaw.com/divorce-family-law/	Get hash	malicious	Unknown	Browse	162.241.217.237
	https://linkifly.net/TRACKING	Get hash	malicious	Unknown	Browse	50.6.153.232
	https://hwu.iaa.mybluehost.me/vvvop/SEEKKK/	Get hash	malicious	Unknown	Browse	50.6.153.232
	nvANxkZUSC.elf	Get hash	malicious	Mirai	Browse	194.120.230.54
steamcommunity.com	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	AxoPac.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win32.DropperX-gen.7855.32539.exe	Get hash	malicious	Xehook Stealer	Browse	149.154.167.99
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe	Get hash	malicious	Python Stealer, Braodo	Browse	149.154.167.220
	Wuerth_factura_4052073226..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
ALABANZA-BALTUS	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	65.109.241.236
	xy894fdlWJ.exe	Get hash	malicious	Vidar	Browse	65.109.241.236
	yakuza.sparc.elf	Get hash	malicious	Unknown	Browse	64.176.208.213
	file.exe	Get hash	malicious	Vidar	Browse	65.109.241.236
	file.exe	Get hash	malicious	Unknown	Browse	65.109.241.236
	PURCHASE_ORDER.exe	Get hash	malicious	DBatLoader, Remcos	Browse	64.176.178.205
	http://nndpdnm.3utilities.com/#bd5on/p8la73b/LoiU9/1oQd1tRDE-SUREIDANt92YuMXZpJHZuV3bmxWYi9GbnBUY5hGZhBHc15Cdp1WY	Get hash	malicious	HTMLPhisher	Browse	65.108.133.178
AKAMAI-ASUS	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Download.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	AxoPac.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	xy894fdlWJ.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	file.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	file.exe	Get hash	malicious	Unknown	Browse	65.109.142.154
	EP2E1yYJyT.exe	Get hash	malicious	Unknown	Browse	65.109.142.154
	9evHLnwull.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
	tiCW7a3x1P.exe	Get hash	malicious	Vidar	Browse	65.109.142.154
37f463bf4616ecd445d4a1937da06e19	3507071243740008011.exe	Get hash	malicious	GuLoader	Browse	104.102.49.254 149.154.167.99
	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254 149.154.167.99
	SecuriteInfo.com.FileRepMalware.4445.21502.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 149.154.167.99
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254 149.154.167.99
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	xy894fdlWJ.exe	Get hash	malicious	Vidar	Browse	104.102.49.254 149.154.167.99
	SecuriteInfo.com.Win32.Evo-gen.14702.4787.exe	Get hash	malicious	KoiLoader	Browse	104.102.49.254 149.154.167.99

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Unlock_Tool_2.3._2aeb643dce4cdcbeeaaa9deab94801d87eb2245_2e620264_e4511507-1d45-44dd-b311-3e06606d6c77\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6655377807856876
Encrypted:	false
SSDEEP:	96:/ikFm0FsHWZAa7sNhKoI7Rn6tQXIDcQvc6QcEVcw3cE/6uD+HbHg/5hZAX/d5FM4:LcnWua7N0BU/uugjhzuiFjZ24IO8ds
MD5:	0D06F3450E16E76C095190FAB67570D3
SHA1:	3B3C9B4E89675B525770D8BE03E8927494AA1B48
SHA-256:	2807621C3F32F59CF46E7A13C13B21307BA2B32B315F981CB5394EA78EE2AFB6
SHA-512:	458D201CBC3D0C8BDA0FDA828A26F22DA9EDAA7AC5CD49C5DCB48DFEB2F17BF376853BF9BD3473BD8ABD892A28DD2213F885AE10FF15259B86CC8E5FBF30D147
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.1.3.5.3.9.4.7.1.6.5.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.1.3.5.4.0.6.4.8.4.7.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.4.5.1.1.5.0.7.-.1.d.4.5.-.4.4.d.d.-.b.3.1.1.-.3.e.0.6.6.0.6.d.6.c.7.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.8.c.c.a.a.0.-.d.f.d.6.-.4.a.d.0.-.b.b.1.4.-.1.5.9.b.4.7.1.a.b.0.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.U.n.l.o.c.k._.T.o.o.l._.2...3...1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.8.-.0.0.0.1.-.0.0.1.5.-.c.5.7.5.-.0.c.f.9.0.8.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.8.f.2.1.d.0.2.f.c.9.6.6.7.b.b.5.7.7.5.2.6.8.3.7.0.6.6.e.8.4.1.0.0.0.0.f.f.f.f.!.0.0.0.0.5.1.3.2.4.f.4.0.9.5.f.e.7.3.a.9.9.d.0.8.0.d.9.f.0.b.b.a.1.c.8.2.9.4.3.0.b.b.1.8.!.U.n.l.o.c.k._.T.o.o.l._.2...3...1...e.x.e.....

C:\ProgramData\Microsoft\Windows\WER\Temp\WER813B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 15:58:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	31998
Entropy (8bit):	1.707530637222622
Encrypted:	false
SSDEEP:	96:5Q8P3QJKBTaS59+HyjSi77vnbK2Gv5aWV+NklIt3yrKVkjS68LWx4Wqx9avYfCoD:JfQAzAFOC2GxHqko3Zz8P1VEQ
MD5:	DB56F8E8F3EF3BF64A4CDD6907B73E0E
SHA1:	2718B3A3E54C443BBAB2528C0BFCBC43F3041C1E
SHA-256:	5EA0C4A53CC5E7B889406299C56D1A8BD7E929CBAACBC92D58ECC38C91BEEF41
SHA-512:	6054A8636AE3E6DB5796EB2EDBD22395C1D2BCA951A146CB163F31DCB67F4ED0636F5E6336783CB2A4C5B423A9466B616990539E81ECA946443547A2EB37C9C3
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........(.g........................d...........................T.......8...........T...............Nr......................................................................................................eJ..............GenuineIntel............T............(.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8320.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8428
Entropy (8bit):	3.6998131136811434
Encrypted:	false
SSDEEP:	192:R6l7wVeJgL666Y2DxSUUzgmfZppr789bNdsfN7vm:R6lXJs666YMSUogmfZoNWfN6
MD5:	46AABF99AEAF4D5354EEC13821E4E9E2
SHA1:	BBA7529A21521C1F942A0F9573C3B9AA7EFBE88D
SHA-256:	8D508AEFA022CECA2E5D8C77CBDC0743DCA6667871D7317070A60F72FC1DCF2E
SHA-512:	6514263A4817488E3153E91FCBC60A3FF9DA57CD40D8CB842C5FD6A30DD99B710610E4EAD689D473397BC09E42E0C4541D6FF51DA1DC26BC81B0DB720ABCA70F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83DD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4755
Entropy (8bit):	4.497133012266415
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9rAWpW8VYPYm8M4Jn7Ft+q8v00MfBzkSeTd:uIjf7I7F57VDJjKr4BzkSGd
MD5:	9F9A7808E7372704A1EC6B370D98CB53
SHA1:	29CA22BAEE85FE4CC032D83819AA3BB158027898
SHA-256:	B741A2D9CD9C6A1AFE985FB9F0801AD86F29C18C029FB5F7546282417EB69C1F
SHA-512:	CA766266EEFED1FEB5EAEC5CA4BF10EF7460DE87A3AFCFA12C91F9E8BE76FC8DC12D31DD304BE1FD03A8AAD5E4E212483C386926A654AC38826706139F42E97E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="551941" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199786602107[1].htm

Download File

Process:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3146), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	30851
Entropy (8bit):	5.426611821930421
Encrypted:	false
SSDEEP:	768:J7pqLjWYmmwB5DPgqaciNGAnTBv++nIjBtPF5zfukPco1AULTBv++nIjBtPF5x2q:J78LjWYmmwB5DPgqaccnTBv++nIjBtPk
MD5:	F7BA6379A11814D6122AF75717FE767E
SHA1:	0D59A98C819F506385E2D44CE14333DCE013B59A
SHA-256:	EA3C76CB3566CB536B62E65F12B9FB46D50C957CC3C27AC3A8AB697784C7B822
SHA-512:	49314FA288E883AEE974FE669CDC86E7BBDA77DCC8C8CA63E0E9A11ED6D5F82DEAE26B6787D28F5109C7145036669DEA9A6F89AE7B994585687F2C9F8031FC63
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: g0b4c https://65.109.142.154\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:tctl:Ql
MD5:	5F711BA80E4BD5BBA0B00C388AA7F2AD
SHA1:	869831162B0035C0684F82075F83E623A0B48883
SHA-256:	56F5C8C65EB28ADAD904E4284898D254993342EC3BACFC23B7C1DEA6745AD835
SHA-512:	E1C9EFD52E2CF0DBAB389BE90F3D8639B914F07BF9B54C8DB79DB8676EFCE793F5672B5E6024B455FC4BF7E0D9516829E2B0D963B47ED9D7D15A402E8E16E730
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468673433098864
Encrypted:	false
SSDEEP:	6144:nzZfpi6ceLPx9skLmb0f3ZWSP3aJG8nAgeiJRMMhA2zX4WABluuN3jDH5S:zZHt3ZWOKnMM6bFpVj4
MD5:	B99025DF3786446CCEADDF32356A126A
SHA1:	2B9924CA0D548110CBFF7EC523BF9FED22DD4CD9
SHA-256:	6C1C16248E648D111BFE922F91C0220F8721653C46CF715AF9A93B4127E5DAC9
SHA-512:	27AD1F8014765B78DBA9482FC22E5955475942E6FED0611479C3AC21B697CFBEB4D8964132F8B4FEC362671DA93FA3DE7E72D2F28D6C9321D53D39E0BB323296
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.`...#..............................................................................................................................................................................................................................................................................................................................................D)..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.068877902497512
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Unlock_Tool_2.3.1.exe
File size:	617'000 bytes
MD5:	72162382680c702829c6ceed17d2e507
SHA1:	51324f4095fe73a99d080d9f0bba1c829430bb18
SHA256:	eaae82540ddec53797abee6d3bf507acace850f3fff7cb2a03b6a26ab0b5c46f
SHA512:	27787baedb4fafe7884369d9cafb762aaa540e8130c7acefd618c4fb40e1c3459bcfe94df5f1aadc1245fcb52900692f96200d021f5d3bd6087ab12c3661d397
SSDEEP:	12288:9/kD3wynB4WIz1hhnpF6SnU/wq0vWCfIBM+09d83nEO:SwynIPU/wqsWCfIdm6Xt
TLSH:	9DD412127AC1C435E6325E310590DBB04F7DF8752E108EEB239856BB5FA02D1DD26EAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{u.............(h......(h..v...(h......(h..............................................................Rich............PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401cc4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6711203F [Thu Oct 17 14:33:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	39a5f7fa9f5c10de8f3718b5b2b8bc8f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2023 19:00:00 16/01/2026 18:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F576CC6433Eh
jmp 00007F576CC63DCFh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [00414008h]
push dword ptr [ebp+08h]
call dword ptr [00414004h]
push C0000409h
call dword ptr [0041400Ch]
push eax
call dword ptr [00414010h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [00414014h]
test eax, eax
je 00007F576CC63F57h
push 00000002h
pop ecx
int 29h
mov dword ptr [0047BE78h], eax
mov dword ptr [0047BE74h], ecx
mov dword ptr [0047BE70h], edx
mov dword ptr [0047BE6Ch], ebx
mov dword ptr [0047BE68h], esi
mov dword ptr [0047BE64h], edi
mov word ptr [0047BE90h], ss
mov word ptr [0047BE84h], cs
mov word ptr [0047BE60h], ds
mov word ptr [0047BE5Ch], es
mov word ptr [0047BE58h], fs
mov word ptr [0047BE54h], gs
pushfd
pop dword ptr [0047BE88h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0047BE7Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0047BE80h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0047BE8Ch], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [0047BDC8h], 00010001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a678	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x94400	0x2628	.dash
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x10b0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x19958	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x19898	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x14000	0x108	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12530	0x12600	1dd7d81d62409b332bb828eee3aacf2d	False	0.6117267219387755	COM executable for DOS	6.64221570515426	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x14000	0x6c64	0x6e00	e29701e725ee3bdda6bbb667b21841c0	False	0.46782670454545455	data	5.090175375333947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x617bc	0x60e00	c963fba4ac0e01ba716890477419d36c	False	0.9950630040322581	data	7.996108683776517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7d000	0x1e0	0x200	5fcefbf8ca00d90307acdcd0df127502	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x10b0	0x1200	6b45c3a5f2b0d65c52ba686507ebff50	False	0.7302517361111112	data	6.294753789118545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.dash	0x80000	0x186a0	0x18800	425814aaa9d11321e37bec742e2fa273	False	0.0027004942602040817	data	0.01834679374989137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

TlsFree, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, WriteConsoleW, RaiseException, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, LCMapStringW, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, HeapSize, HeapReAlloc, CloseHandle, CreateFileW, DecodePointer

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T17:59:29.851328+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49839	65.109.142.154	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 17:59:26.463424921 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:26.463459015 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:26.467294931 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:26.503307104 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:26.503317118 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:27.578979969 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:27.579058886 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:27.622817993 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:27.622833967 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:27.623847008 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:27.623908997 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:27.626343966 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:27.671401978 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.300414085 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.300476074 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.300529957 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.300549984 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.300565958 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.300582886 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.300609112 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.300614119 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.300647020 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.300746918 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.311141014 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.311187983 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.311223984 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.311228991 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.311258078 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.311325073 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.328943968 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.329058886 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.329247952 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.330781937 CEST	49827	443	192.168.2.6	104.102.49.254
Oct 20, 2024 17:59:28.330795050 CEST	443	49827	104.102.49.254	192.168.2.6
Oct 20, 2024 17:59:28.394776106 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:28.394833088 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:28.395008087 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:28.395211935 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:28.395239115 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:29.851219893 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:29.851327896 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:29.855159044 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:29.855174065 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:29.855379105 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:29.855787992 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:29.855942011 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:29.903397083 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:30.500529051 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:30.500566006 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:30.500602007 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:30.500662088 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:30.501352072 CEST	49839	443	192.168.2.6	65.109.142.154
Oct 20, 2024 17:59:30.501398087 CEST	443	49839	65.109.142.154	192.168.2.6
Oct 20, 2024 17:59:30.537729025 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:30.537825108 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:30.537941933 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:30.538223982 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:30.538263083 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:32.089548111 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:32.089663029 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:32.093522072 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:32.093544960 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:32.093753099 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:32.093810081 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:32.094136000 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:32.139405966 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:32.411173105 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:32.411204100 CEST	443	49850	149.154.167.99	192.168.2.6
Oct 20, 2024 17:59:32.411245108 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:32.411309958 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:32.411425114 CEST	49850	443	192.168.2.6	149.154.167.99
Oct 20, 2024 17:59:32.411456108 CEST	443	49850	149.154.167.99	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 17:59:26.448151112 CEST	63216	53	192.168.2.6	1.1.1.1
Oct 20, 2024 17:59:26.455492973 CEST	53	63216	1.1.1.1	192.168.2.6
Oct 20, 2024 17:59:30.529553890 CEST	54141	53	192.168.2.6	1.1.1.1
Oct 20, 2024 17:59:30.537019014 CEST	53	54141	1.1.1.1	192.168.2.6
Oct 20, 2024 17:59:32.793426991 CEST	51030	53	192.168.2.6	1.1.1.1
Oct 20, 2024 17:59:32.803896904 CEST	53	51030	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 17:59:26.448151112 CEST	192.168.2.6	1.1.1.1	0x262b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 20, 2024 17:59:30.529553890 CEST	192.168.2.6	1.1.1.1	0x3d92	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Oct 20, 2024 17:59:32.793426991 CEST	192.168.2.6	1.1.1.1	0x89f9	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 17:59:26.455492973 CEST	1.1.1.1	192.168.2.6	0x262b	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 20, 2024 17:59:30.537019014 CEST	1.1.1.1	192.168.2.6	0x3d92	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

65.109.142.154

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49827	104.102.49.254	443	7404	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 15:59:27 UTC	119	OUT	GET /profiles/76561199786602107 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-20 15:59:28 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 20 Oct 2024 15:59:27 GMT Content-Length: 35803 Connection: close Set-Cookie: sessionid=12c5731a8e4f603c0364a5a5; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C0e3d185a3e106e73b244decdec33a0ea; Path=/; Secure; HttpOnly; SameSite=None
2024-10-20 15:59:28 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-20 15:59:28 UTC	16384	IN	Data Raw: 09 09 09 48 6f 6d 65 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 Data Ascii: Home</a><a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49839	65.109.142.154	443	7404	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 15:59:29 UTC	187	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 65.109.142.154 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49850	149.154.167.99	443	7404	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 15:59:32 UTC	86	OUT	GET /lpnjoke HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	11:58:58
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"
Imagebase:	0x790000
File size:	617'000 bytes
MD5 hash:	72162382680C702829C6CEED17D2E507
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:58:58
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe"
Imagebase:	0x790000
File size:	617'000 bytes
MD5 hash:	72162382680C702829C6CEED17D2E507
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000002.00000002.2446832574.0000000000481000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:58:59
Start date:	20/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 272
Imagebase:	0x450000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:59:32
Start date:	20/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:59:32
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:59:32
Start date:	20/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xc50000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.5%
Total number of Nodes:	220
Total number of Limit Nodes:	4

Executed Functions

Function 00791659 Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0080B730,000004E4,00000040,?), ref: 007916A6

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 754a6af6a514a369db7a820e7f3948c672f304e23ff218537218279ff1eb6a0c
Instruction ID: 9623438d318aad323812db8ea3ba2c08c68bc1251a28ce15dfaa85bbb00d38ae
Opcode Fuzzy Hash: 754a6af6a514a369db7a820e7f3948c672f304e23ff218537218279ff1eb6a0c
Instruction Fuzzy Hash: DCF0E976344505EFE205DB18E806E57B394EBC8720F21801AF605977C1C778FC11C9A0

Function 007A01A4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 007A022B
__alloca_probe_16.LIBCMT ref: 007A02EC
__freea.LIBCMT ref: 007A0353

Part of subcall function 00798A87: HeapAlloc.KERNEL32(00000000,?,?,?,00792778,?,?,?,?,?,00791051,?,?,?,007910E3,?), ref: 00798AB9

__freea.LIBCMT ref: 007A0368
__freea.LIBCMT ref: 007A0378

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: ce01f19ebcf6f1ddc3f8d3b42f69e5659209d188bd71f151fe3cc43fa7aaf0f7
Instruction ID: a2e0731688e21daf94dd6b8c13f0cfead7b8fabdafb5f8ce176c815a34133357
Opcode Fuzzy Hash: ce01f19ebcf6f1ddc3f8d3b42f69e5659209d188bd71f151fe3cc43fa7aaf0f7
Instruction Fuzzy Hash: 5451D37260020AEFEF259E64DC89EBF76A9EF86354F150629FD04D6150EB78CC1087E1

Function 0079841E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,007A0292,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00798452
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,007A0292,?,?,00000000,?,00000000), ref: 00798470

Strings

:!y, xrefs: 0079844C

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: String
String ID: :!y
API String ID: 2568140703-1945855279
Opcode ID: 538f1ff2e246a474e6832ea30b6e7ee80bee3f43395b2173724f6ea44f21d7ac
Instruction ID: ae13bb17f98c3d059c73d3907c37f688df400828e1b4bd4d1126a116d3fd071b
Opcode Fuzzy Hash: 538f1ff2e246a474e6832ea30b6e7ee80bee3f43395b2173724f6ea44f21d7ac
Instruction Fuzzy Hash: 46F07A3240415AFBCF125FA0EC09DDE3F26EF893A0F058110FA1865130CB7AC871AB95

Function 0079B4D1 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0079B001: GetOEMCP.KERNEL32(00000000,?,?,?,00000000), ref: 0079B02C

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0079B318,?,00000000,?,?,00000000), ref: 0079B532
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0079B318,?,00000000,?,?,00000000), ref: 0079B574

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 8b256409ed2c27c1422e7824ed5563b47c216bf404d8f3d374a95e4773058024
Instruction ID: 82f057848aa13c7b3ef0f13a019346d02a5c5ca77fb314a3f792cf6e22f1079f
Opcode Fuzzy Hash: 8b256409ed2c27c1422e7824ed5563b47c216bf404d8f3d374a95e4773058024
Instruction Fuzzy Hash: DE513670A003059EDF20CF75F984AABBBF5EF85300F19456ED09687262E77CA945CB50

Function 0079B0D5 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0079B324,0079B318,00000000), ref: 0079B107

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 2dc9474a874b8c24d678d9c7a6fffd5bcd84f76d8ab419b51a232c6500d4ee90
Instruction ID: f7279adee41ea7ecded1e6ff941fe1a93df1c387a45e63120d8a359108ef9cbc
Opcode Fuzzy Hash: 2dc9474a874b8c24d678d9c7a6fffd5bcd84f76d8ab419b51a232c6500d4ee90
Instruction Fuzzy Hash: 6351787150425C9ACF218F28EE84BEA7BBDEB56304F2405EDE59AC7142D378AD46DF20

Non-executed Functions

Function 0079E0E8 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0079E2CC

Strings

1#QNAN, xrefs: 0079E1FB
1#INF, xrefs: 0079E21E
1#SNAN, xrefs: 0079E1F4
1#IND, xrefs: 0079E1ED

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7cd35548898df6bc93bbcb13cba9c1e2217303bff1231b2546a27f81f112a5d0
Instruction ID: 5773257d007820dc9fd24a7dcd050839f470c1c3c0cb830824b3d57c7de6a6fb
Opcode Fuzzy Hash: 7cd35548898df6bc93bbcb13cba9c1e2217303bff1231b2546a27f81f112a5d0
Instruction Fuzzy Hash: 2ED22771E086288FDF65CE28ED447EAB7B5EB45305F1445EAD40EE7240EB78AE818F41

Function 00798F68 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00798FF5

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e742114cad1722125c79802c132c505b8aa059e1db89f26ea849efe0e0605f33
Instruction ID: c69d5f22ebc2148a584e54009ae478c4eb38845f80c993d44d8f7e46e0a34171
Opcode Fuzzy Hash: e742114cad1722125c79802c132c505b8aa059e1db89f26ea849efe0e0605f33
Instruction Fuzzy Hash: 81B1553290425AAFEF15CF6CD8857EEBBA5FF59310F14816EEA14AB241D2399D01C7A0

Function 00792178 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00792184
IsDebuggerPresent.KERNEL32 ref: 00792250
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00792269
UnhandledExceptionFilter.KERNEL32(?), ref: 00792273

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 18ce0d8478a3641dabc7516400d562393c335452df318c41e04eb053d314e4e6
Instruction ID: 86d1ec4fda048e4b520296adfb851e52ce1bef1762bab5f73ed3509895f0e547
Opcode Fuzzy Hash: 18ce0d8478a3641dabc7516400d562393c335452df318c41e04eb053d314e4e6
Instruction Fuzzy Hash: 1D311675D01218DBDF20EFA4E9497CDBBB8BF48300F1041EAE50CAB250EBB59A858F45

Function 007C427F Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

ov|, xrefs: 007C436A, 007C4316
x`C, xrefs: 007C430E
ov|, xrefs: 007C42C3
``C, xrefs: 007C42F5

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID: ``C$ov|$ov|$x`C
API String ID: 0-850246289
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 992c5c88953d39dd89870d4229738946a6241556ab4181e03f21e361ae5e8ec7
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: 4851C073900156ABEB18CF58C495BE973B1FFC8304F2684BED84AAF286EB345901CB50

Function 00796984 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00796A7C
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00796A86
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00796A93

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c6d2fedc1b1992db25137606390a92626af260294b5d34c95f2d0cb6dddc984e
Instruction ID: 1602c2a714c3e56f8625fa9abd26d548f3ccba65404c14caf52f441a07a68881
Opcode Fuzzy Hash: c6d2fedc1b1992db25137606390a92626af260294b5d34c95f2d0cb6dddc984e
Instruction Fuzzy Hash: 1131937590121CEBCF21DF68E88978DBBB8BF48710F5081DAE51CA6261E7749B858F48

Function 007C71E7 Relevance: 4.2, Strings: 3, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 007C7512
Rz|, xrefs: 007C7479, 007C7523
ov|, xrefs: 007C729A

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID: Rz|$UT$ov|
API String ID: 0-2482668390
Opcode ID: 0e5d514c79ef925c0a1ce41a7415018d9d52760b019abbb396943d1197465535
Instruction ID: 9d7772907336b35d655e01ec41da4cbfc126567edb5402d523113035cb2bf902
Opcode Fuzzy Hash: 0e5d514c79ef925c0a1ce41a7415018d9d52760b019abbb396943d1197465535
Instruction Fuzzy Hash: 6502A5B1D082688FDF29CF68C884B9E7BB5AF45300F1444EDD949A7246DB389E84CF95

Function 0079DC60 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b3df0f6a783b84a0005ec9b5b8d67f3646548f487e0ba2d8827565c9d32673
Instruction ID: 685ff296969b709ba31c1bc701bba2161f8ed7b42700769f92005d371b13b72b
Opcode Fuzzy Hash: 18b3df0f6a783b84a0005ec9b5b8d67f3646548f487e0ba2d8827565c9d32673
Instruction Fuzzy Hash: 3EF14171E002199FDF24CFA9D9806ADF7B2FF88314F258269E915AB385D734AD41CB90

Function 00795E4E Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00795FD8
-\y, xrefs: 00796178, 0079611A, 007960BC, 0079603D

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID: -\y$0
API String ID: 0-4072222311
Opcode ID: a19a32aac08044840b608dca22c57d7aef00580b635a541d20bb5af7704fefce
Instruction ID: 4cf0633da2369e6bcfe1ed1e6195de9fd4b80ccdffa479440293da46f33cbcbf
Opcode Fuzzy Hash: a19a32aac08044840b608dca22c57d7aef00580b635a541d20bb5af7704fefce
Instruction Fuzzy Hash: 0DB10370900A1ACBCF26CF68E595ABEB7B2AF05310F14061EE552EB291D73DEE05CB51

Function 007A2820 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,007A281B,?,?,00000008,?,?,007A2425,00000000), ref: 007A2A4D

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 37b45aee1e9ddc1af2534a978e52bf4c90950e989496949becb4cacbc2cd1553
Instruction ID: bee634ad1ab5d35fc29feea4f6be1a0917a1b388f178cc0d64fbc717d4016f8f
Opcode Fuzzy Hash: 37b45aee1e9ddc1af2534a978e52bf4c90950e989496949becb4cacbc2cd1553
Instruction Fuzzy Hash: 9AB12D31610609DFD729CF2CC486B657BA0FF86364F258658E8D9CF2A2C739E952CB40

Function 00792415 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0079242B

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 064ad510ca503ce99dee032211d764675de3d06275a155918ed535aee7a310c8
Instruction ID: 7d38d4c531e26d8af53e8d55dc02283b6211069dd1b083f83ad6c72485724ad3
Opcode Fuzzy Hash: 064ad510ca503ce99dee032211d764675de3d06275a155918ed535aee7a310c8
Instruction Fuzzy Hash: BAA18AB19016459FDB18CF58E8C16AFBBF0FB89324F14C22AD525EB7A2D3389845CB54

Function 0079A7CB Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb40d9da8776d8fbe0f50fa14bb9ba181a944e5eb99d2a5b1add28d196f20805
Instruction ID: 54f523d6573ee7153fad56ce585239aeae4fab57c6dc07a67ef75adb264c9ac7
Opcode Fuzzy Hash: cb40d9da8776d8fbe0f50fa14bb9ba181a944e5eb99d2a5b1add28d196f20805
Instruction Fuzzy Hash: 2541C2B5C0521DAFDF20DF69DC89EAABBB9EF45300F1442D9E448D3201EA399E858F50

Function 00792305 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00002311,00791B3B), ref: 0079230A

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 19679a5891a06da75c900aa0bc35f62538922ab03e4cd98348acfa5dc9fa5976
Instruction ID: 725fdaca0786f0963825bc5f1c66200f63b28f37eb4ad4551ab444642b47f4ac
Opcode Fuzzy Hash: 19679a5891a06da75c900aa0bc35f62538922ab03e4cd98348acfa5dc9fa5976
Instruction Fuzzy Hash:

Function 0079C45E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0079C45E

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 54814d4b6fa5830c64b486a3dd58da17bcbf9b883f7d6fb46757e08c2e39a003
Instruction ID: 223da6dbb4f8245ada40873107b7b68133763257f9c64187c93a055e7e6845a6
Opcode Fuzzy Hash: 54814d4b6fa5830c64b486a3dd58da17bcbf9b883f7d6fb46757e08c2e39a003
Instruction Fuzzy Hash: 22A002716031058B97404F355A4560A3695A58659170582555515C5160D76584546E05

Function 007D7AAE Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0cbe5cf4f3c382501015eb38ca5360e31d3c13d09ca3a9ee6b95cccfefd4dd
Instruction ID: 003891a2227622c66538fc80fe4bf2a1c751cc2398d6220a0d4e8c3b0c1a9daf
Opcode Fuzzy Hash: 8a0cbe5cf4f3c382501015eb38ca5360e31d3c13d09ca3a9ee6b95cccfefd4dd
Instruction Fuzzy Hash: 3A02A123D5E6B24B8B794EB948902267FB15E01B4031F46DBEDC03F396D21AED06D6E0

Function 007D8A9B Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 98e05ab99b385fb128f28feb0110a21d77563f59dd9c6b70e89fb80794be040d
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: DCC15D73D1F5B2458BB6462D481823AEE726F91B4131F8397DCD03F3C99A2AAD06D5E0

Function 007D86B3 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 365d39c02f4e217d17368cc7e6923a4ff94f41df42572b54cdb3d157bfe2de5e
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 7CC16D73D1F5B20987B5462D481823AEE726E91B4131F8393DCD03F389D62A6D06D5D1

Function 007D82E1 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: ff74187824b9e9cdf629e480d50662a91f33ec03847e73211bedc3ff088c0f6b
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 17C15E73D1F5B2498B76462D481823EEE726F81B4031F8396DCD03F3898A2AAD16D5D0

Function 007D7F43 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: f88f982755c29afb0a87e0f93cd9bc60fa37a3bdaedb84f4156e4eb42645c8f5
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 80B15D73D1F9B2098B75462D481822BEE726E81B4031FC396DCD03F389DA2AAD06D5D0

Function 00791317 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 9bbe4cf242ec5de15e57c003a102096e452308a81f57c8e9ffe6e3bf0f70bf4a
Instruction ID: 0c65ff504f1f4b1ba70a520972eccea831e23379da51262b204c8f60e6e551fe
Opcode Fuzzy Hash: 9bbe4cf242ec5de15e57c003a102096e452308a81f57c8e9ffe6e3bf0f70bf4a
Instruction Fuzzy Hash: 6651F972D1022B9BCF08DFB9D8855EEFBB5EB49310F54423AD914E7391D2399A12CB90

Function 007C6487 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: 37f9bf5b827b6cdb9e1e621cff4597cf93b5d47ed0184070c0604b28a39aac5b
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 54210D216B0AE306CB848FF8FCC062267D1CBCD21B76EC2BDCE54C9067D06DE6228590

Function 007AC1DD Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 04de3f6764e759254b6249b2df56df312f4c409687e6d7d5a53e96524bae1408
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: 28F05E32900100BBCF11CF95E804BAAF7B8FB87360F257164D409B3540C334ED109A98

Function 007ABE6B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction ID: ea3e4387b39ce806ce78312b7a9645757156f0a8d6b1af2c7d6898ca67931afe
Opcode Fuzzy Hash: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction Fuzzy Hash: 77F03072900A19AFD714CFADD5415DFFBF8EB48320B10856ED4AAF3260D630FA458B51

Function 007915F4 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b345e7f6422290e99a9778faa3e01c4f10bc71c1cff29f5c28bddaba4d8c40f
Instruction ID: fa4df9d9c239b1484dca8f4ba3cb12dc585d3891278da699aafe1d2bb2df5840
Opcode Fuzzy Hash: 9b345e7f6422290e99a9778faa3e01c4f10bc71c1cff29f5c28bddaba4d8c40f
Instruction Fuzzy Hash: D2E09B7060520497E3089B14E81A75776D5EBC5300F50C03DE24AC73D0DFBC98099786

Function 0079B9E5 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a531db49a4f3729ab887177585f355256e3b6d79a99a6b39f015d026f8895b42
Instruction ID: 273e40af35c4e8206db51af2ef31c70bef5ef616ddf826f70bb37740d20a8505
Opcode Fuzzy Hash: a531db49a4f3729ab887177585f355256e3b6d79a99a6b39f015d026f8895b42
Instruction Fuzzy Hash: 68E04632911228EBCB14DB98AA0898AF3BCEB4AB00B114096F501E3200C674DE00D7D0

Function 007C330C Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 0079765D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f8aa25285df3118817bb43e8fb066e78d4562735eb8b7e63a52ee34af13324
Instruction ID: ff3b274604986dfb644b2fbce332596f7edc070f4f18603bee512522a868f02a
Opcode Fuzzy Hash: c6f8aa25285df3118817bb43e8fb066e78d4562735eb8b7e63a52ee34af13324
Instruction Fuzzy Hash: 6EC08C74024E0086CE2D891CA6723A43378A3AA7C2F80048CC5020F752C61EAC82D600

Function 007AC1BA Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 007AC1D2 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 007CD2D6 Relevance: 54.3, APIs: 36, Instructions: 344
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

operator+.LIBCMT ref: 007CD2F1

Part of subcall function 007CA400: DName::DName.LIBCMT ref: 007CA413
Part of subcall function 007CA400: DName::operator+.LIBCMT ref: 007CA41A

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 35539629968e138beffd51becdf4c8dee185b9484c6757ffb25b44c6f192daa8
Instruction ID: ea153816e62ae4e49a8815f4dbcb13f126bfb17244ff2250676f024925be7aa1
Opcode Fuzzy Hash: 35539629968e138beffd51becdf4c8dee185b9484c6757ffb25b44c6f192daa8
Instruction Fuzzy Hash: 21D1FB71900249EFCB15DFA8D899FEEBBF8AF08305F14406DE605E7291DB389A85CB51

Function 007CE01E Relevance: 27.3, APIs: 18, Instructions: 274
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 007CE1BD
DName::operator=.LIBCMT ref: 007CE26B
DName::operator+=.LIBCMT ref: 007CE296
DName::DName.LIBCMT ref: 007CE2FB
DName::operator+.LIBCMT ref: 007CE302
DName::DName.LIBCMT ref: 007CE325
DName::operator+.LIBCMT ref: 007CE32C
DName::operator+=.LIBCMT ref: 007CE338
DName::operator=.LIBCMT ref: 007CE35F
DName::operator+=.LIBCMT ref: 007CE371
UnDecorator::getPtrRefType.LIBCMT ref: 007CE39A
operator+.LIBCMT ref: 007CE3AC

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 6dbec500bb396f51e2aa04729c82308d503cf4e8d877ee9f6af5757cd44cb17a
Instruction ID: 5d95936add3db1381e0d9703f350d229149edd9d4d9fd0e4fe5549918036e6f0
Opcode Fuzzy Hash: 6dbec500bb396f51e2aa04729c82308d503cf4e8d877ee9f6af5757cd44cb17a
Instruction Fuzzy Hash: FB918F71A04249EFCB28DE98C88AFAD7778BF15352F24426EF911E7291D73C9A40CB51

Function 007D3894 Relevance: 24.1, APIs: 16, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 007D38AD
__calloc_crt.LIBCMT ref: 007D38D1
_free.LIBCMT ref: 007D38DF
__calloc_crt.LIBCMT ref: 007D38ED
_free.LIBCMT ref: 007D38FD
_free.LIBCMT ref: 007D3903
__copytlocinfo_nolock.LIBCMT ref: 007D3912
__setlocale_nolock.LIBCMT ref: 007D391F
___removelocaleref.LIBCMT ref: 007D392B
___freetlocinfo.LIBCMT ref: 007D3932
_free.LIBCMT ref: 007D3938
__setmbcp_nolock.LIBCMT ref: 007D394A
_free.LIBCMT ref: 007D3958
___removelocaleref.LIBCMT ref: 007D395F
___freetlocinfo.LIBCMT ref: 007D3966
_free.LIBCMT ref: 007D396C

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 1a2a701ae00cb2bc5b9e02f9ebcd1257b20d2e0ca7344a16077e0f899fb72ce1
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: B021E731104611FBD7217F29D80AE1ABBF4EF41754B20442FF88966392DF7ED900E666

Function 00792E00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 00792E37
___except_validate_context_record.LIBVCRUNTIME ref: 00792E3F
_ValidateLocalCookies.LIBCMT ref: 00792EC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00792EF3
_ValidateLocalCookies.LIBCMT ref: 00792F48

Strings

:!y, xrefs: 00792F0C
csm, xrefs: 00792EDD

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: :!y$csm
API String ID: 1170836740-206657981
Opcode ID: f3929d1580c5b35bb30d6753870dedd4da4b53140c537cce089d9b4ec98e7d0c
Instruction ID: ac010d7a9795bdb0a809db07407ab0fc13e51544090991ed0156d94a36262be2
Opcode Fuzzy Hash: f3929d1580c5b35bb30d6753870dedd4da4b53140c537cce089d9b4ec98e7d0c
Instruction Fuzzy Hash: FF41B734A00208EBCF10EF68D888AAEBBF5EF45314F148155E8155B3A3D779DE56CB91

Function 007CA6C2 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getArgumentList.LIBCMT ref: 007CA6E7

Part of subcall function 007CA282: Replicator::operator[].LIBCMT ref: 007CA305
Part of subcall function 007CA282: DName::operator+=.LIBCMT ref: 007CA30D

DName::operator+.LIBCMT ref: 007CA740
DName::DName.LIBCMT ref: 007CA798

Strings

4;C, xrefs: 007CA77B
8;C, xrefs: 007CA733
D;C, xrefs: 007CA72C
(;C, xrefs: 007CA782

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: 00b4ba88f2529d6448c9a8a500a00b8311539c59f106ea20ca9a2e191a690bfb
Instruction ID: daafdee3cc9d74c08289786d0c2af3db16b348e032d6948318fe874893d0179f
Opcode Fuzzy Hash: 00b4ba88f2529d6448c9a8a500a00b8311539c59f106ea20ca9a2e191a690bfb
Instruction Fuzzy Hash: 99213C35600248AFCB15DF1CD444EA97BB4FF4574BB4480ADE845DB266C738EA46CB4A

Function 00793E5D Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00793F7C
___TypeMatch.LIBVCRUNTIME ref: 0079408A
CallUnexpected.LIBVCRUNTIME ref: 007941F7

Strings

csm, xrefs: 00793F07
csm, xrefs: 00793E9A
csm, xrefs: 00793FB3

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 7aa1a579ac44d4ddba5092aee05d689c806eae71af2be5ec04bd42dc4187fb16
Instruction ID: e1b76d12e159546060f332272ad9a7f56492cae227f2564b2f5aa72f4a51a1fb
Opcode Fuzzy Hash: 7aa1a579ac44d4ddba5092aee05d689c806eae71af2be5ec04bd42dc4187fb16
Instruction Fuzzy Hash: BDB14771C00209EFCF29DFA4E885DAEBBB5FF14310B15419AE8156B212D739DA92CF91

Function 00798127 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00798234,?,007910E3,?,00000000,?,?,007983AD,00000021,FlsSetValue,007A55B8,007A55C0,?), ref: 007981E8

Strings

ext-ms-, xrefs: 00798192
api-ms-, xrefs: 0079817E

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 31c6d971be12372c3c8f2b09a38b5b906ee44d9ac08f4154ad2c54c2733de9e4
Instruction ID: cddfeedc32f6ba1034acded78b5c575c4daf3e603eb49e56fb6b9362e04c7993
Opcode Fuzzy Hash: 31c6d971be12372c3c8f2b09a38b5b906ee44d9ac08f4154ad2c54c2733de9e4
Instruction Fuzzy Hash: 5821A871A41218E7CF619B64FC44B5B3759AB83760F250219ED05A7291DF78EE03C6E1

Function 007CC05B Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 007CC065
DName::DName.LIBCMT ref: 007CC071

Part of subcall function 007C9D3C: DName::doPchar.LIBCMT ref: 007C9D6D

UnDecorator::getScopedName.LIBCMT ref: 007CC0B0
DName::operator+=.LIBCMT ref: 007CC0BA
DName::operator+=.LIBCMT ref: 007CC0C9
DName::operator+=.LIBCMT ref: 007CC0D5
DName::operator+=.LIBCMT ref: 007CC0E2

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 7491704a406c1c578bfc7b1f4575f9842b7a48a94faccf0b99b655ecd725c168
Instruction ID: e17117f79ce3a7db41c5857434b39530a235df8f1260274b6044be796bb808c1
Opcode Fuzzy Hash: 7491704a406c1c578bfc7b1f4575f9842b7a48a94faccf0b99b655ecd725c168
Instruction Fuzzy Hash: EB11C671940248EFC715EB64CC5EFA97BB0AF10701F04409DE5069B2E6CB78DA81C751

Function 0079767F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,642DFF77,?,?,00000000,007A34CC,000000FF,?,0079760F,?,?,007975E3,00000000), ref: 007976B4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007976C6
FreeLibrary.KERNEL32(00000000,?,?,00000000,007A34CC,000000FF,?,0079760F,?,?,007975E3,00000000), ref: 007976E8

Strings

:!y, xrefs: 007976D7
mscoree.dll, xrefs: 007976AD
CorExitProcess, xrefs: 007976BE

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: :!y$CorExitProcess$mscoree.dll
API String ID: 4061214504-380778296
Opcode ID: cac3f18e10c0a319ff1f6282eaad7072fa86d7a57a1c567f185efe1163682473
Instruction ID: d2a34771e3ec4a98566971b4d722f15c0ed257fac9223db2358e68dac535f573
Opcode Fuzzy Hash: cac3f18e10c0a319ff1f6282eaad7072fa86d7a57a1c567f185efe1163682473
Instruction Fuzzy Hash: FF01A771518619EBDB018F54DC05BAFB7B8FBC5B10F004625F821A2690DBBD9D00CA54

Function 007CE07B Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 007CE26B

Part of subcall function 007CA03C: DName::doPchar.LIBCMT ref: 007CA065

DName::DName.LIBCMT ref: 007CE2FB
DName::operator+.LIBCMT ref: 007CE302
DName::DName.LIBCMT ref: 007CE325
DName::operator+.LIBCMT ref: 007CE32C
DName::operator+=.LIBCMT ref: 007CE338
DName::operator=.LIBCMT ref: 007CE35F
DName::operator+=.LIBCMT ref: 007CE371
DName::operator=.LIBCMT ref: 007CE385
UnDecorator::getPtrRefType.LIBCMT ref: 007CE39A
operator+.LIBCMT ref: 007CE3AC

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: d5f168979395f0da1b6397cfe65973bb30d2f1f47253cafc197db538ed263023
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: B321FE76A0054EAFCF58EEB8C94AFADBB78AB04301F14416DA515E7684DA3CDF05CA10

Function 007CE099 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 007CE26B

Part of subcall function 007CA03C: DName::doPchar.LIBCMT ref: 007CA065

DName::DName.LIBCMT ref: 007CE2FB
DName::operator+.LIBCMT ref: 007CE302
DName::DName.LIBCMT ref: 007CE325
DName::operator+.LIBCMT ref: 007CE32C
DName::operator+=.LIBCMT ref: 007CE338
DName::operator=.LIBCMT ref: 007CE35F
DName::operator+=.LIBCMT ref: 007CE371
DName::operator=.LIBCMT ref: 007CE385
UnDecorator::getPtrRefType.LIBCMT ref: 007CE39A
operator+.LIBCMT ref: 007CE3AC

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: de8582493bae4a3439c84459bb11c5c802aacb38eec96ddf834360d6ab8f076a
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: 3321FE76A0054EAFCF58EEB8C94AFADBB78BB04301F14416DA515E7684DA3CDB05C610

Function 007CE08F Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 007CE26B

Part of subcall function 007CA03C: DName::doPchar.LIBCMT ref: 007CA065

DName::DName.LIBCMT ref: 007CE2FB
DName::operator+.LIBCMT ref: 007CE302
DName::DName.LIBCMT ref: 007CE325
DName::operator+.LIBCMT ref: 007CE32C
DName::operator+=.LIBCMT ref: 007CE338
DName::operator=.LIBCMT ref: 007CE35F
DName::operator+=.LIBCMT ref: 007CE371
DName::operator=.LIBCMT ref: 007CE385
UnDecorator::getPtrRefType.LIBCMT ref: 007CE39A
operator+.LIBCMT ref: 007CE3AC

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: 211e350866af3071c463e949772efd37517675d248e019d8ffad31abf125fc09
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: 1421FE76A0054EAFCF58EEB8C94AFADBB78AF04301F14416DA515E7684DA3CDB05C611

Function 007CE085 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 007CE26B

Part of subcall function 007CA03C: DName::doPchar.LIBCMT ref: 007CA065

DName::DName.LIBCMT ref: 007CE2FB
DName::operator+.LIBCMT ref: 007CE302
DName::DName.LIBCMT ref: 007CE325
DName::operator+.LIBCMT ref: 007CE32C
DName::operator+=.LIBCMT ref: 007CE338
DName::operator=.LIBCMT ref: 007CE35F
DName::operator+=.LIBCMT ref: 007CE371
DName::operator=.LIBCMT ref: 007CE385
UnDecorator::getPtrRefType.LIBCMT ref: 007CE39A
operator+.LIBCMT ref: 007CE3AC

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: 20226086a6f12c6a37a00aeb302c0f47db50cb121b5514eea6848d72b0746e31
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: 9F21FE76A0054EAFCF58EEB8C94AFADBB78AB04301F14416DA515E7684DA3CDB05C610

Function 007934B1 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007934A8,0079317C,00792355), ref: 007934BF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 007934CD
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007934E6
SetLastError.KERNEL32(00000000,007934A8,0079317C,00792355), ref: 00793538

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 434ec5fc7bfe9f8d51bb49c8df4d8ee759e63d417db387d158c24cebfbc93884
Instruction ID: 42ccced08e80a557b941015c66c281664548b97dc82bf47a8eedfc1eae9b488c
Opcode Fuzzy Hash: 434ec5fc7bfe9f8d51bb49c8df4d8ee759e63d417db387d158c24cebfbc93884
Instruction Fuzzy Hash: 610126722083159EEE2527B4BCDAA3B2B84DB8AB747310339F520811F2FF9D4E119244

Function 007D2D2B Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 007D2C82

Part of subcall function 007C8AB0: __mtinitlocknum.LIBCMT ref: 007C8AC6
Part of subcall function 007C8AB0: __amsg_exit.LIBCMT ref: 007C8AD2

_free.LIBCMT ref: 007D2CA9
__lock.LIBCMT ref: 007D2CC2
___removelocaleref.LIBCMT ref: 007D2CD1
___freetlocinfo.LIBCMT ref: 007D2CEA
_free.LIBCMT ref: 007D2D07

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: f576442123b04c527e99995057e5f798a06d57a0fbdba5833e7da996cdf46145
Instruction ID: f8a1e069d7d85fd775b4b96f757a6cbac439786f33eebf7f4bc68a66168f4d5b
Opcode Fuzzy Hash: f576442123b04c527e99995057e5f798a06d57a0fbdba5833e7da996cdf46145
Instruction Fuzzy Hash: AE114C31611300EADB60AF799649B2D73B4AF10B10F20451FF85897396CF7D9D829669

Function 00793C06 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00793CCD
___AdjustPointer.LIBCMT ref: 00793CF0
___AdjustPointer.LIBCMT ref: 00793D8C

Strings

:!y, xrefs: 00793C65

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: :!y
API String ID: 1740715915-1945855279
Opcode ID: 00475935ba923abceb80427172e49fe16bf747cb67710bbf8d1a72a0bac9147a
Instruction ID: 63ccf33ead27559d736c41752db9dd1da79c6ec1ce487d3c93ed6a1689e945a1
Opcode Fuzzy Hash: 00475935ba923abceb80427172e49fe16bf747cb67710bbf8d1a72a0bac9147a
Instruction Fuzzy Hash: E151EE76601606EFDF289F54E856BBA73A5EF01710F24452DE802972A1E73DEE80CB90

Function 0079AD55 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe, xrefs: 0079AD71

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\Unlock_Tool_2.3.1.exe
API String ID: 0-189565579
Opcode ID: f73eb59541dd7fbdc73a9865acd79ddb990945ede0c9254fb5bdcb0e7f831b81
Instruction ID: 4c94ab2f104c0d9c726760c54ba469163133f292b666ce2de4b6f75f3446b779
Opcode Fuzzy Hash: f73eb59541dd7fbdc73a9865acd79ddb990945ede0c9254fb5bdcb0e7f831b81
Instruction Fuzzy Hash: 4A21FD31206215BFCF20EF70FC8692B77ADAF813647208568F91597551DB39EC108BE2

Function 007BFA38 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007BFABF
_memset.LIBCMT ref: 007BFAD0
_memset.LIBCMT ref: 007BFB98
_memset.LIBCMT ref: 007BFC04
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007BFD26

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: e34bf048b61c1259719f24b5a9ebcdb7e29330d4219f1e2d480e2a365f4dc5d7
Instruction ID: 275d877e5f19c54cae59b85fdb24d921d04216e5c613dcbed662eaf12250e0e7
Opcode Fuzzy Hash: e34bf048b61c1259719f24b5a9ebcdb7e29330d4219f1e2d480e2a365f4dc5d7
Instruction Fuzzy Hash: 64C106B2D0021AABCF21EF64DC49AEE777DAF08704F0141A5FA09A3151DB79AF858F51

Function 007CF897 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 007CF8AB
__init_pointers.LIBCMT ref: 007CF95D
__calloc_crt.LIBCMT ref: 007CF9CB
__initptd.LIBCMT ref: 007CF9F0

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: 0a94c54a7945867de6cfe35b03e58e96b0a908eff489fa3a921db52f6821de8f
Instruction ID: 3291b42fb148f3f89ad2adad8f6116d3014e2834c1c9869d3797319a770567d6
Opcode Fuzzy Hash: 0a94c54a7945867de6cfe35b03e58e96b0a908eff489fa3a921db52f6821de8f
Instruction Fuzzy Hash: 8F315831D08390DADB20AF79BC08B1A3BA5AF49722B10563EE415D36B2DB78D840CF5C

Function 007CA7A2 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 007CA7EB
DName::operator+.LIBCMT ref: 007CA7F2
DName::DName.LIBCMT ref: 007CA814
DName::operator+.LIBCMT ref: 007CA81B
DName::operator+.LIBCMT ref: 007CA822

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 07d7777d52dff5e113e7891794bf6f50c10d3f38d43dc9179de300c9a186e5fe
Instruction ID: 03972e1c7bd8109c0d7c1f9be67e9eeb09b029ecc63a697c28271c9afc9d85b6
Opcode Fuzzy Hash: 07d7777d52dff5e113e7891794bf6f50c10d3f38d43dc9179de300c9a186e5fe
Instruction Fuzzy Hash: 1101213060020DBFCF04EB64D85AFAD77B5AF44709F54405DF902AB291DA78EA458795

Function 007D2D36 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 007D2D42

Part of subcall function 007CF6D4: __getptd_noexit.LIBCMT ref: 007CF6D7
Part of subcall function 007CF6D4: __amsg_exit.LIBCMT ref: 007CF6E4

__calloc_crt.LIBCMT ref: 007D2D4D
__lock.LIBCMT ref: 007D2D83
___addlocaleref.LIBCMT ref: 007D2D8F
__lock.LIBCMT ref: 007D2DA3

Part of subcall function 007CE874: __getptd_noexit.LIBCMT ref: 007CE874

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: e1a2eccef77534c4c96ea4b3847fe8be0ad550a98ee4993f5fc2996ea686c99a
Instruction ID: 0a74d23141526060ca902cc9b5c75840e417778c02bf668e9d6f2e77037d4f1e
Opcode Fuzzy Hash: e1a2eccef77534c4c96ea4b3847fe8be0ad550a98ee4993f5fc2996ea686c99a
Instruction Fuzzy Hash: 27017171600704EAE720BFB4980BF1C77B1AF04720F20821EF4559A3D2CF7C99429B6A

Function 007D1499 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 007D14A5

Part of subcall function 007CF6D4: __getptd_noexit.LIBCMT ref: 007CF6D7
Part of subcall function 007CF6D4: __amsg_exit.LIBCMT ref: 007CF6E4

__getptd.LIBCMT ref: 007D14BC
__amsg_exit.LIBCMT ref: 007D14CA
__lock.LIBCMT ref: 007D14DA
__updatetlocinfoEx_nolock.LIBCMT ref: 007D14EE

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e5b528c2df55b90b8f95683bbe5c3f4538672bfb3054380b72a1938f3589f922
Instruction ID: 94637c43b85410be927fc97973491a3b43a47a0d871ed9f608fc2581f35845c4
Opcode Fuzzy Hash: e5b528c2df55b90b8f95683bbe5c3f4538672bfb3054380b72a1938f3589f922
Instruction Fuzzy Hash: 0DF09072A04750EBDBA1FBA9A80BB5D33A06F00720F59415FF406AB3D2DF6C5910DB5A

Function 0079177E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007917B1
Concurrency::cancel_current_task.LIBCPMT ref: 0079189D
std::_Xinvalid_argument.LIBCPMT ref: 007918AD

Strings

vector too long, xrefs: 007918A8

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_catchXinvalid_argumentstd::_
String ID: vector too long
API String ID: 4133478652-2873823879
Opcode ID: 31c75d20f71711cacb37c20bdfb18ef7f56ab3d50e2ed96d7b803c75e24fab53
Instruction ID: 552c1e367318577d139b55b054ba694586eff6db9332239d5ee01d1c729eda68
Opcode Fuzzy Hash: 31c75d20f71711cacb37c20bdfb18ef7f56ab3d50e2ed96d7b803c75e24fab53
Instruction Fuzzy Hash: 6C419F71A00107DFCF14DFACE8958AEBBA5FF45320B20861DE915D7681DB35AA60CB90

Function 007936D3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00793684,00000000,?,0080C104,?,?,?,00793827,00000004,InitializeCriticalSectionEx,007A4C68,InitializeCriticalSectionEx), ref: 007936E0
GetLastError.KERNEL32(?,00793684,00000000,?,0080C104,?,?,?,00793827,00000004,InitializeCriticalSectionEx,007A4C68,InitializeCriticalSectionEx,00000000,?,007935A7), ref: 007936EA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00793712

Strings

api-ms-, xrefs: 007936F7

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 66ac5e5708df7c4b4f78faa023fea48b3c7cd055130c8866bd1496c58284c7ba
Instruction ID: f4c5134d55b8b770ec43bc1522ce0c43fdcefb75282e4ca3953ab257cfec23ac
Opcode Fuzzy Hash: 66ac5e5708df7c4b4f78faa023fea48b3c7cd055130c8866bd1496c58284c7ba
Instruction Fuzzy Hash: F4E04FB1280204F7EF101FF0FC8AB2A3F55BB91B51F108060FA0DA80E1D7ABDA119959

Function 0079D02C Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(642DFF77,00000000,00000000,?), ref: 0079D08F

Part of subcall function 0079B857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,007A0349,?,00000000,-00000008), ref: 0079B903

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0079D2EA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0079D332
GetLastError.KERNEL32 ref: 0079D3D5

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6d63ecfc7bc5dc46a584d39f64c6fb3a453526c0d20ec0f1e290247ed9f1f557
Instruction ID: dad3f00663d26c0893ea8aaa80c9939939f2515ffd477bc85bc071d21699539f
Opcode Fuzzy Hash: 6d63ecfc7bc5dc46a584d39f64c6fb3a453526c0d20ec0f1e290247ed9f1f557
Instruction Fuzzy Hash: 1ED137B5D00258DFCF25CFA8E884AADBBB5FF49300F18816AE956EB351D734A941CB50

Function 007B8E8B Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007B8EBC
_memset.LIBCMT ref: 007B8EDC
_memset.LIBCMT ref: 007B8EED
_memset.LIBCMT ref: 007B8EFE

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 2b25e849923064d9b5a55e65d4fb1bd14e0dfe3207bfc449d4cf15b6a91fd711
Instruction ID: 4f9b0bbc45eaec6a9e4611ce4d3437a3b545e2a0ebe1988162cb9f131916f3a7
Opcode Fuzzy Hash: 2b25e849923064d9b5a55e65d4fb1bd14e0dfe3207bfc449d4cf15b6a91fd711
Instruction Fuzzy Hash: C6D1D3B191012DEADB20EBA4DC86BD9B778AF04304F5054E7AA08B7051DB74BF85CFA1

Function 007C2FE3 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C3008
_memset.LIBCMT ref: 007C3017
_memset.LIBCMT ref: 007C31D7
_memset.LIBCMT ref: 007C31E9

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 2a3a95c2239512ea1048ea6c83c2bce4995b7bd70dd19da3d1f381d2d0d0e092
Instruction ID: dddac3f0972a6913659ab196d94fe3ef12d562c9426bf838191daaf727156770
Opcode Fuzzy Hash: 2a3a95c2239512ea1048ea6c83c2bce4995b7bd70dd19da3d1f381d2d0d0e092
Instruction Fuzzy Hash: 3551C7B1D0022ADBCB25EF64CC86BDDB37CAB44704F4151E5AA08B3152DB74AF868F54

Function 007C122F Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C1254
_memset.LIBCMT ref: 007C12C8
_memset.LIBCMT ref: 007C133C
_memset.LIBCMT ref: 007C13B0

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 4606f376861381f818f80eaab977bb148334af8bbf25d557b91848da5220f5e8
Instruction ID: cb3ccf708f2d6ee9cf371edbb84207fb1b60280d6dc2f21aea8e0cafa7e6bc7c
Opcode Fuzzy Hash: 4606f376861381f818f80eaab977bb148334af8bbf25d557b91848da5220f5e8
Instruction Fuzzy Hash: DB41B671D4021CFACB24EB60EC4BFDD777CAB09300F148499B619E7191EAB8AB448F95

Function 0079A56B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0079B857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,007A0349,?,00000000,-00000008), ref: 0079B903

GetLastError.KERNEL32 ref: 0079A5CF
__dosmaperr.LIBCMT ref: 0079A5D6
GetLastError.KERNEL32(?,?,?,?), ref: 0079A610
__dosmaperr.LIBCMT ref: 0079A617

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 5faf71816b8eb0a1f78993b591137b503fa7b36af30c81d81a25f3edafb63c8d
Instruction ID: 56a195e59a300ec6c579c361c747b75165ff4df36a1fa2b55da61b5a4a794d8d
Opcode Fuzzy Hash: 5faf71816b8eb0a1f78993b591137b503fa7b36af30c81d81a25f3edafb63c8d
Instruction Fuzzy Hash: A121CFB1601206FFCF20AF65A88482BB7ADFF45360B118528FD16D7211DB79EC518BE2

Function 0079B945 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0079B94D

Part of subcall function 0079B857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,007A0349,?,00000000,-00000008), ref: 0079B903

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0079B985
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0079B9A5

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 6cf7745908fe1abae1c7753e84ea38cdb19b212e7467eec7c831e6f151afc9cd
Instruction ID: 2816697b1f1f367c207334f88a2a64cce30229983955224d2108005da2d6e933
Opcode Fuzzy Hash: 6cf7745908fe1abae1c7753e84ea38cdb19b212e7467eec7c831e6f151afc9cd
Instruction Fuzzy Hash: CA11EDB2915619FFAF2127B6BDCEC6F6A6CCF863A43214124F60192101EF6DAD0081B5

Function 007D1735 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 007D1741

Part of subcall function 007CF6D4: __getptd_noexit.LIBCMT ref: 007CF6D7
Part of subcall function 007CF6D4: __amsg_exit.LIBCMT ref: 007CF6E4

__amsg_exit.LIBCMT ref: 007D1761
__lock.LIBCMT ref: 007D1771
_free.LIBCMT ref: 007D17A1

Memory Dump Source

Source File: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: ede986ab11c6e57392b10305871a61c507c4d0a5f4112cf5c4421020098d088a
Instruction ID: 8e45af3c1798e726c5c4d4a86f5006c4589f6b293ce17efa83f3fcc06e01823b
Opcode Fuzzy Hash: ede986ab11c6e57392b10305871a61c507c4d0a5f4112cf5c4421020098d088a
Instruction Fuzzy Hash: 7301A972D01710FBCB21AB25A949B6D7370AF04B20F54012BE804A73A1CB3CA941CBCA

Function 007A1578 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000), ref: 007A158F
GetLastError.KERNEL32(?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000,?,?,?,0079D9B0,?), ref: 007A159B

Part of subcall function 007A1561: CloseHandle.KERNEL32(FFFFFFFE,007A15AB,?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000,?,?), ref: 007A1571

___initconout.LIBCMT ref: 007A15AB

Part of subcall function 007A1523: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,007A1552,007A0A1A,?,?,0079D429,?,00000000,00000000,?), ref: 007A1536

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000,?), ref: 007A15C0

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b081bce9885d9654ae913919ee989db31fe256d556df98cea49efb93a16e9389
Instruction ID: cf2972be63c6a8b79083ec1f3294d7de6e4616233386e0275975172fe4d8e75f
Opcode Fuzzy Hash: b081bce9885d9654ae913919ee989db31fe256d556df98cea49efb93a16e9389
Instruction Fuzzy Hash: 56F01C37800128BBCF222FD5DC0999A3FA6EBCA3A0F458150FA1985121C63A8920EBD5

Function 00794202 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00794227

Strings

MOC, xrefs: 00794239
RCC, xrefs: 00794241

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 25ef3ef6db8584a69b31dff201e5d79d727998065986241c31299e46a0d23d0b
Instruction ID: 94e9503364b36f0ca013b483a7f3eaeacde0ddf7aa49313762f663cccfb3d961
Opcode Fuzzy Hash: 25ef3ef6db8584a69b31dff201e5d79d727998065986241c31299e46a0d23d0b
Instruction Fuzzy Hash: 74415771900209EFCF16DFA4E981EEEBBB5FF48304F158199F914A7221D3399A51DB90

Function 0079894B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00798997
GetFileType.KERNEL32(00000000), ref: 007989A9

Strings

B, xrefs: 007989DA

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID: B
API String ID: 3000768030-778116840
Opcode ID: 2aa867db0bdc5b5245e03bc51c3e9527fea03c3c7be0aa82f700ae08ea08b205
Instruction ID: 7ca6c09a03733f48c394fa7d0ffb4f8af8381cdb80d8ddf6c86b54dfb13cc58e
Opcode Fuzzy Hash: 2aa867db0bdc5b5245e03bc51c3e9527fea03c3c7be0aa82f700ae08ea08b205
Instruction Fuzzy Hash: 1211B9721087514ACF704E3EAC88636BE94A797330B38071AD1BA965F2CB79F885D643

Function 007983D3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00798413

Strings

:!y, xrefs: 00798403
InitializeCriticalSectionEx, xrefs: 007983E3

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: :!y$InitializeCriticalSectionEx
API String ID: 2593887523-1094532196
Opcode ID: a58efc6c67c84928a3d2a3dc6b8002a2f87b318b7f0d656486a1c34be2c5f705
Instruction ID: 9b3992deb32c2bcaf64feaf8547ba1dffca28372ecf0f7499c8caf640c6f5f94
Opcode Fuzzy Hash: a58efc6c67c84928a3d2a3dc6b8002a2f87b318b7f0d656486a1c34be2c5f705
Instruction Fuzzy Hash: AEE06D36581258B7CF111F51EC09E9A3F22EBD2760B108110F91815160CBBA89619AD5

Function 007982D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00798308

Strings

:!y, xrefs: 007982FE
FlsAlloc, xrefs: 007982E4

Memory Dump Source

Source File: 00000000.00000002.2300140019.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.2300105330.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300198038.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300223851.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300334108.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300390718.000000000080C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300427095.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300457247.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: :!y$FlsAlloc
API String ID: 2773662609-1522199544
Opcode ID: 3b11d54e125d365b1f617d2544feaab8d8b4990e26cadf6cf60a6c942917ef68
Instruction ID: b19d515d601bd7b9cc50be6c4e065945c10684fda98ea1284fee560b9df38869
Opcode Fuzzy Hash: 3b11d54e125d365b1f617d2544feaab8d8b4990e26cadf6cf60a6c942917ef68
Instruction Fuzzy Hash: E3E0C232AC1228B78A1027A0EC0E99EBA56DBD3F62B414121FA1452150DEEE495192EA

Analysis Process: Unlock_Tool_2.3.1.exePID: 7404, Parent PID: 7336COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	1293
Total number of Limit Nodes:	38

Executed Functions

Function 0041C4B7 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 0041C56A
UT, xrefs: 0041C7E2

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 375b76cf62abd5f7dd4df4683fbf8252338f38d1a5fa21a65283e4b32dc89bc6
Instruction ID: 9787a365ec18c0bf1930f8717519833fdc736eeb0207a270142cd3a14faf4db2
Opcode Fuzzy Hash: 375b76cf62abd5f7dd4df4683fbf8252338f38d1a5fa21a65283e4b32dc89bc6
Instruction Fuzzy Hash: 8C026DB19442688BDF21DF64CC807EEBBB5AF45304F1440EAD949A7242D7389EC5CF99

Function 0041196C Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00411973
CoInitializeEx.OLE32(00000000,00000000,00000030,00413FA7,?,AV: ,004368CC,Install Date: ,004368B8,00000000,Windows: ,004368A8,Work Dir: In memory,00436890), ref: 00411982
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411993
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119AD
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004119E3
VariantInit.OLEAUT32(?), ref: 00411A32
VariantClear.OLEAUT32(?), ref: 00411A60

Strings

Unknown, xrefs: 00411A75
displayName, xrefs: 00411A44
WQL, xrefs: 004119FD
Unknown, xrefs: 00411A6E
Select * From AntiVirusProduct, xrefs: 004119F8
root\SecurityCenter2, xrefs: 004119C5
Unknown, xrefs: 00411A89

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: InitializeVariant$BlanketClearCreateH_prolog3_catchInitInstanceProxySecurity
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 3060130021-315474579
Opcode ID: 7f379c790eb099f24fc055ea34a0325628612ab894480d039f292940774d93bd
Instruction ID: 3fda5078456e7a0d609a00957094a3acbddb435200cc30907b6e8efe348fab49
Opcode Fuzzy Hash: 7f379c790eb099f24fc055ea34a0325628612ab894480d039f292940774d93bd
Instruction Fuzzy Hash: E2315471A40209BBCB20DB91DC49EEFBF7DEFC9B10F20425EF211A61A0C6795941CB68

Function 00406963 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 161
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000,00436993), ref: 004069C5
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50

Strings

ERROR, xrefs: 00406AB6
GET, xrefs: 00406A42
ERROR, xrefs: 00406BAB
@iA, xrefs: 00406976

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Internet$CloseConnectCrackFileHandleHttpOpenReadRequestSend
String ID: @iA$ERROR$ERROR$GET
API String ID: 1796428842-3546687611
Opcode ID: 0c02ab2dcbf62ab04cd99dd3ba698df3d28e16d0d46a3e4f9a19e9731555a9fe
Instruction ID: d8bde7e051fe936688ae94f634ee4e08a5faa0caa340d4fa3fbcfbce63435b0b
Opcode Fuzzy Hash: 0c02ab2dcbf62ab04cd99dd3ba698df3d28e16d0d46a3e4f9a19e9731555a9fe
Instruction Fuzzy Hash: 1251A0B1A00229AFDF20AF20DC85AEEB7B9FB04344F0181F6F549B2191CA755EC59F84

Function 0041147A Relevance: 4.6, APIs: 3, Instructions: 56processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0043670F,?,?), ref: 004114A9
Process32First.KERNEL32(00000000,00000128), ref: 004114B9
Process32Next.KERNEL32(00000000,00000128), ref: 00411517

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: 804b59de0022c0a22ffba1be1da70e1bd92732a17a177211fa0686da41351996
Instruction ID: 4ea20aa850d654643913a215028a8477d38f7f0d75996d48367efc27095c6f7e
Opcode Fuzzy Hash: 804b59de0022c0a22ffba1be1da70e1bd92732a17a177211fa0686da41351996
Instruction Fuzzy Hash: 3411A371A00218A7DB11FB219C85AEE73A9AF44704F00109AF90AB7291CB789FC58F59

Function 00410C28 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C34
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C3B
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C4F

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410DB0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E2C

Strings

/ , xrefs: 00410E48

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: /
API String ID: 2299586839-4001269591
Opcode ID: ce6f2f2ca10474b0a97e541b6f36cad0183382322380a2636a05f6b3ca651ab3
Instruction ID: cb4dd5b7474b79c5993221afdf8c45715871f25fde254037933c8c8e47344f7b
Opcode Fuzzy Hash: ce6f2f2ca10474b0a97e541b6f36cad0183382322380a2636a05f6b3ca651ab3
Instruction Fuzzy Hash: 0D31FA71900328ABDB20EB65DD89ADEB3B8BB04305F1045EAF519B7152CBB86EC58F54

Function 00410D03 Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?), ref: 00410D34

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: e053bf9d0ea2a25b27af1172a1bfc3f5b5eb9bf6fc4c3b7a4649e4a77b228e05
Instruction ID: feaee98c82f226e65d9751a1a55654853175a6affee0276e42e7902f2bb5e1d1
Opcode Fuzzy Hash: e053bf9d0ea2a25b27af1172a1bfc3f5b5eb9bf6fc4c3b7a4649e4a77b228e05
Instruction Fuzzy Hash: 19F0E971A00324ABEB04DBB4EC49BAB37B9AB04729F100295F515D72D0DB74AF858B95

Function 00410F8F Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FA9

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: f6cc537a8d259f33440bfcf2a59015abf239682aa6aea29871f9168d6b10e10c
Instruction ID: 3fe8b6109728b161727a24735e2f8503b38c563086272a1cf22f2bb380138bbb
Opcode Fuzzy Hash: f6cc537a8d259f33440bfcf2a59015abf239682aa6aea29871f9168d6b10e10c
Instruction Fuzzy Hash: 0EE092B0D1020D9BCF10DFA0EC45ADE77FCAB08308F0054B5A505D3180DA74ABC98F88

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418586), ref: 004014DF

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 0040E15B Relevance: 44.1, APIs: 11, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E18C
_memset.LIBCMT ref: 0040E1AC
_memset.LIBCMT ref: 0040E1BD
_memset.LIBCMT ref: 0040E1CE
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E202
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E233
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E292
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368D7), ref: 0040E34E
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3AE

Strings

UserName, xrefs: 0040E46B
HostName, xrefs: 0040E33C
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E1E0
Security, xrefs: 0040E228
Login: , xrefs: 0040E42E
PortNumber, xrefs: 0040E392
Password: , xrefs: 0040E4FE
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E288
passwords.txt, xrefs: 0040E637
UseMasterPassword, xrefs: 0040E223
:22, xrefs: 0040E402
Password, xrefs: 0040E4EA
Soft: WinSCP, xrefs: 0040E2D3
Host: , xrefs: 0040E2FF

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset$Value$Open
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 2191171593-2798830873
Opcode ID: 1b23a7cec8ce1a068f0904835dff8764a5d3e31adcc74daa50b1addd64c79da9
Instruction ID: 3de73c6830c2fad38347e0384e5faadb251f520f0b3c27047f30c6be6412ffb3
Opcode Fuzzy Hash: 1b23a7cec8ce1a068f0904835dff8764a5d3e31adcc74daa50b1addd64c79da9
Instruction Fuzzy Hash: D3D1F6B191012DABDB20EB91DC82BD9B779AF04348F1054EBA508B3091DAB47FC9CF65

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: f76aab6d78298610a3b7e28b579f52f37c4603c13cc720c1ac32be6eed9832ba
Instruction ID: 05fc87705062c45bfe73a5c894f0b3df5a3edf33da4a3e3f9b5da5ca26733804
Opcode Fuzzy Hash: f76aab6d78298610a3b7e28b579f52f37c4603c13cc720c1ac32be6eed9832ba
Instruction Fuzzy Hash: 2741D9B1D00218ABD7205F71AC4CF9F7B7DEB85715F1002BAF10AE10A1DA354A54CF28

Function 00405482 Relevance: 33.8, APIs: 3, Strings: 16, Instructions: 573
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

_memmove.LIBCMT ref: 00405CB4
_memmove.LIBCMT ref: 00405CD6
_memmove.LIBCMT ref: 00405D05

Strings

23a142269e47ce1692ccc9fb68473bc2, xrefs: 004059A7
block, xrefs: 00405E30
--, xrefs: 00405600
build_id, xrefs: 0040594F
------, xrefs: 00405605
------, xrefs: 0040589D
------, xrefs: 004059FF
file_data, xrefs: 00405C09
ERROR, xrefs: 00405F2F
", xrefs: 0040597B
------, xrefs: 0040573C
", xrefs: 00405C35
", xrefs: 00405AD8
", xrefs: 0040581B
------, xrefs: 00405B5D
ERROR, xrefs: 00405D79

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memmove$CrackInternet
String ID: ------$"$"$"$"$--$------$------$------$------$23a142269e47ce1692ccc9fb68473bc2$ERROR$ERROR$block$build_id$file_data
API String ID: 1366773753-1636173138
Opcode ID: 28771bb067b9c7fcd20c90bf186157bfb71e693ef21f2fa98bc3936b1868d248
Instruction ID: cffeca1b0dfeb35b510a7fd6e08703f5ef04152c4c5254e8e8f843b90d2d8adf
Opcode Fuzzy Hash: 28771bb067b9c7fcd20c90bf186157bfb71e693ef21f2fa98bc3936b1868d248
Instruction Fuzzy Hash: FC42B5719001699BDF21FB21DC45ADDB7B9BF04348F0085E6A589B3162CEB46FC69F88

Function 00418995 Relevance: 30.3, APIs: 6, Strings: 11, Instructions: 518
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(0041730C), ref: 00418E1A
LoadLibraryA.KERNEL32 ref: 00418E3C
LoadLibraryA.KERNEL32 ref: 00418E4D
LoadLibraryA.KERNEL32 ref: 00418E80
LoadLibraryA.KERNEL32 ref: 00418E91
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418EA1

Strings

CreateProcessA, xrefs: 00418D75
dbghelp.dll, xrefs: 00418E97
ResumeThread, xrefs: 00418DCD
WriteProcessMemory, xrefs: 00418DE3
GetThreadContext, xrefs: 00418D8B
SetThreadContext, xrefs: 00418DF9
HttpQueryInfoA, xrefs: 00419359
InternetSetOptionA, xrefs: 0041936F
VirtualAllocEx, xrefs: 00418DB7
ReadProcessMemory, xrefs: 00418DA1
SymMatchString, xrefs: 0041946E

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 1029625771-2740034357
Opcode ID: bc716f2625a0e41b2ed4bb766179c27d34b4bc4e0803ef392b74f70fe9059fed
Instruction ID: 21a79a8d855260e2828667f180bc927f9092200f68422498ddf411ab147124d7
Opcode Fuzzy Hash: bc716f2625a0e41b2ed4bb766179c27d34b4bc4e0803ef392b74f70fe9059fed
Instruction Fuzzy Hash: C852F975911312AFDF1ADFA0FD0A8243AABFB08203F11B565E91982274D7774B60EF15

Function 004117DC Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 143
comtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004117E3
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413F39,Install Date: ,004368B8,00000000,Windows: ,004368A8,Work Dir: In memory,00436890), ref: 004117F4
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411805
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041181F
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411855
VariantInit.OLEAUT32(?), ref: 004118B0

Part of subcall function 0041172C: __EH_prolog3_catch.LIBCMT ref: 00411733
Part of subcall function 0041172C: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF60,?,00000018,004118D6,?), ref: 00411756
Part of subcall function 0041172C: SysAllocString.OLEAUT32(?), ref: 00411763
Part of subcall function 0041172C: _wtoi64.MSVCRT ref: 00411796
Part of subcall function 0041172C: SysFreeString.OLEAUT32(?), ref: 004117AF
Part of subcall function 0041172C: SysFreeString.OLEAUT32(00000000), ref: 004117B6

FileTimeToSystemTime.KERNEL32(?,?), ref: 004118DF
VariantClear.OLEAUT32(?), ref: 00411931

Strings

WQL, xrefs: 0041186F
InstallDate, xrefs: 004118C2
Unknown, xrefs: 0041195A
%d/%d/%d %d:%d:%d, xrefs: 00411918
ROOT\CIMV2, xrefs: 00411837
Unknown, xrefs: 0041193F
Unknown, xrefs: 00411946
Select * From Win32_OperatingSystem, xrefs: 0041186A

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: String$CreateFreeInitializeInstanceTimeVariant$AllocBlanketClearFileH_prolog3_catchH_prolog3_catch_InitProxySecuritySystem_wtoi64
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2027821108-461178377
Opcode ID: 1ef878a160ac1b41e8f62bbabcbd42ce57b377d218792d6474371592b041e7d9
Instruction ID: 53c85eede228d83e8f8b7915dab758499af21cc48905de34fd7a3047e6c0012c
Opcode Fuzzy Hash: 1ef878a160ac1b41e8f62bbabcbd42ce57b377d218792d6474371592b041e7d9
Instruction Fuzzy Hash: 63415F71900209BBCB10DBD5DC89EEFBBBDEFC9B11F20411AF611A61A4D6789941CB38

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043A9EC), ref: 004012D0
lstrcatA.KERNEL32(?,0043A9F0), ref: 004012DE
lstrcatA.KERNEL32(?,0043A9F4), ref: 004012EC
lstrcatA.KERNEL32(?,0043A9F8), ref: 004012FA
lstrcatA.KERNEL32(?,0043A9FC), ref: 00401308
lstrcatA.KERNEL32(?,0043AA00), ref: 00401316
lstrcatA.KERNEL32(?,0043AA04), ref: 00401324
lstrcatA.KERNEL32(?,0043AA08), ref: 00401332
lstrcatA.KERNEL32(?,0043AA0C), ref: 00401340
lstrcatA.KERNEL32(?,0043AA10), ref: 0040134E
lstrcatA.KERNEL32(?,0043AA14), ref: 0040135C
lstrcatA.KERNEL32(?,0043AA18), ref: 0040136A
lstrcatA.KERNEL32(?,0043AA1C), ref: 00401378

Part of subcall function 00410C5A: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C66
Part of subcall function 00410C5A: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C6D
Part of subcall function 00410C5A: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410C81

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocComputerExitName
String ID:
API String ID: 1553874529-0
Opcode ID: 927124d3e7746fc297e5f2fe29e5e0df559b15ca6c40b02dbd458cf132794fcb
Instruction ID: 4641dc2a71a7f36ffdc22951e019d2d4c0538419c1ec9b6f3a97985c37de70f2
Opcode Fuzzy Hash: 927124d3e7746fc297e5f2fe29e5e0df559b15ca6c40b02dbd458cf132794fcb
Instruction Fuzzy Hash: EB4185B2E4422C66DB20DB719C59FDB7BAC9F14710F5005A3A8D8F3181D67C9A88CB98

Function 00405F39 Relevance: 21.5, APIs: 2, Strings: 10, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

_memmove.LIBCMT ref: 00406639
_memmove.LIBCMT ref: 00406662

Strings

23a142269e47ce1692ccc9fb68473bc2, xrefs: 00406471
------, xrefs: 00406206
mode, xrefs: 00406575
------, xrefs: 00406080
build_id, xrefs: 00406419
", xrefs: 004062E5
", xrefs: 00406445
", xrefs: 004065A1
------, xrefs: 004064C9
------, xrefs: 00406367

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memmove$CrackInternet
String ID: "$"$"$------$------$------$------$23a142269e47ce1692ccc9fb68473bc2$build_id$mode
API String ID: 1366773753-876234878
Opcode ID: 4440cca1a600d73118678efb8d12b9bcabc9c4373609f69306b83fe032a973dc
Instruction ID: 8eebda12c3b5d708eb83a5d718eaa1b7ac2e3c0f0341b99d1b213d601621e23a
Opcode Fuzzy Hash: 4440cca1a600d73118678efb8d12b9bcabc9c4373609f69306b83fe032a973dc
Instruction Fuzzy Hash: 4522A5719001699BCF21EB61CD46BCDB775AF08748F0184E7A64D73162CAB86FCA8F58

Function 0040E6A4 Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 289
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7

Part of subcall function 00411DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416973,?), ref: 00411E0C

strtok_s.MSVCRT ref: 0040E753

Part of subcall function 00416ED9: CreateThread.KERNEL32(00000000,00000000,00416E08,?,00000000,00000000), ref: 00416F78
Part of subcall function 00416ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F80

Strings

passwords.txt, xrefs: 0040EA22
Soft: FileZilla, xrefs: 0040E91D
Login: , xrefs: 0040E961
Password: , xrefs: 0040E983
<User>, xrefs: 0040E826
<Host>, xrefs: 0040E7AE
<Pass encoding="base64">, xrefs: 0040E85F
Host: , xrefs: 0040E929
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E6F4
<Port>, xrefs: 0040E7ED

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Create$AllocFileLocalObjectSingleThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 3608619850-935134978
Opcode ID: f5ebac40250988c8c527cc0ca342ace3a6a1faf6896128eed6d4f2dd9cfd2673
Instruction ID: 47ce7727287e9f9e0db6c8b5a9533b4c3b5eb338c4ff8911e2f23da32c202c50
Opcode Fuzzy Hash: f5ebac40250988c8c527cc0ca342ace3a6a1faf6896128eed6d4f2dd9cfd2673
Instruction Fuzzy Hash: C4A16372A00219BBCF01FBA1DD4AACD7779AF08705F105426F601F31A1DB79AF858B99

Function 004182B3 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004182D8
_memset.LIBCMT ref: 004182E7
ShellExecuteEx.SHELL32(?," & exit,/c timeout /t 10 & rd /s /q "C:\ProgramData\,004366DF,?,?,?,?,?,?), ref: 00418498
_memset.LIBCMT ref: 004184A7
_memset.LIBCMT ref: 004184B9
ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004184C9

Strings

" & exit, xrefs: 0041841C
" & exit, xrefs: 004183CB
" & rd /s /q "C:\ProgramData\, xrefs: 00418375
/c timeout /t 10 & del /f /q ", xrefs: 00418327
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004183D2

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset$ExecuteExitProcessShell
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 1705808515-1079830800
Opcode ID: 67862d2b9e0b9edf4d7bf7f7c9ffa5c11ab5342b88edd4b5672b512d9d8ae981
Instruction ID: f74f7938643bacf520262fce9bfc50d90f5039b285da77bfecd7a623ca8a8e1d
Opcode Fuzzy Hash: 67862d2b9e0b9edf4d7bf7f7c9ffa5c11ab5342b88edd4b5672b512d9d8ae981
Instruction Fuzzy Hash: 1251BBB1E402299BCB11EF25DD856DDB37CAB44748F4140EAA608B3152CA786FC68F58

Function 00417083 Relevance: 16.8, APIs: 1, Strings: 8, Instructions: 1029
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410C28: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C34
Part of subcall function 00410C28: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C3B
Part of subcall function 00410C28: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C4F

Part of subcall function 00412554: __EH_prolog3_catch_GS.LIBCMT ref: 0041255E
Part of subcall function 00412554: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417E73,.exe,00436CD4,00436CD0,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC), ref: 0041257D
Part of subcall function 00412554: Process32First.KERNEL32(00000000,00000128), ref: 0041258D
Part of subcall function 00412554: Process32Next.KERNEL32(00000000,00000128), ref: 0041259F

CreateDirectoryA.KERNEL32(?,00000000,004366D6), ref: 0041764C

Part of subcall function 00413A02: strtok_s.MSVCRT ref: 00413A33

Part of subcall function 004131D8: strtok_s.MSVCRT ref: 004131F7
Part of subcall function 004131D8: strtok_s.MSVCRT ref: 0041327A

Strings

cowod., xrefs: 00417EBD
23a142269e47ce1692ccc9fb68473bc2, xrefs: 0041774E
_DEBUG.zip, xrefs: 00417F77
org, xrefs: 00417F29
hopto, xrefs: 00417EE1
.exe, xrefs: 00417E46
http://, xrefs: 00417E99
.exe, xrefs: 0041758B

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: strtok_s$CreateHeapProcess32$AllocDirectoryFirstH_prolog3_catch_NameNextProcessSnapshotToolhelp32User
String ID: .exe$.exe$23a142269e47ce1692ccc9fb68473bc2$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 3631202960-3669155049
Opcode ID: 22e0d92267f419021a3e3f91358bcc69aeab730ecbe9545673ff5c84f2e79e03
Instruction ID: 8df2a6c4b46c73ca4ddf54cc8c0bb9bb361c8bd8d3ae006cdaff17597551342b
Opcode Fuzzy Hash: 22e0d92267f419021a3e3f91358bcc69aeab730ecbe9545673ff5c84f2e79e03
Instruction Fuzzy Hash: F3923E715083459BC620FF25D94268EB7E1FF84708F51482FF58477191DBB8AA8E8B8B

Function 004111D8 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 155registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670E,00000000,?,?), ref: 00411248
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00411285
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112D1
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411307
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E94), ref: 004113B1

Strings

?, xrefs: 00411238
- , xrefs: 004113BB
%s\%s, xrefs: 004112AC

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$Enum
String ID: - $%s\%s$?
API String ID: 2712010499-3278919252
Opcode ID: 137f9a5c3c5069f07d9af57b08a0430e085017ea7b5abc5e6f1b491645986798
Instruction ID: 1a7e4b7b75ff4232c8cdaa0c3999b5666d708685d756b362eb3ad491a7b64724
Opcode Fuzzy Hash: 137f9a5c3c5069f07d9af57b08a0430e085017ea7b5abc5e6f1b491645986798
Instruction Fuzzy Hash: A561077590022CABEF21DF15DD84ECAB7B9AB04704F1082E6A608B2161DF756FC9CF54

Function 004115A9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004115DC
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 004115FB
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 00411620
CharToOemA.USER32(?,?), ref: 00411640

Strings

MachineGuid, xrefs: 00411615
SOFTWARE\Microsoft\Cryptography, xrefs: 004115F1

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2355623204-1211650757
Opcode ID: 68cd65d66c8ef3e8d798de7d8bc93d3c2eb6c97baab99793a2fa708540bc2a72
Instruction ID: 0c83f0933e3d79f190a56af7a1f9b34225ce39da16332cf8d5c5010bc6302d27
Opcode Fuzzy Hash: 68cd65d66c8ef3e8d798de7d8bc93d3c2eb6c97baab99793a2fa708540bc2a72
Instruction Fuzzy Hash: FC111EB590031DAFDB10DF50DD89EEBB7BCEB14305F0041E6A659A2052D6759F888F14

Function 0041172C Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00411733
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043AF60,?,00000018,004118D6,?), ref: 00411756
SysAllocString.OLEAUT32(?), ref: 00411763
_wtoi64.MSVCRT ref: 00411796
SysFreeString.OLEAUT32(?), ref: 004117AF
SysFreeString.OLEAUT32(00000000), ref: 004117B6

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: 94a9f91ccacc7efa5da4f735102b9eaf6ebfce10aa4b3815ebcfd38f894d266d
Instruction ID: f8cdbbbe70d397e706f906296cdeba407d3bbd7863d046f8457389d6b98cb90c
Opcode Fuzzy Hash: 94a9f91ccacc7efa5da4f735102b9eaf6ebfce10aa4b3815ebcfd38f894d266d
Instruction Fuzzy Hash: 90114C74A0424ADFCF009FA4D8989EEBBB5AF49310F64417EF215E73A0DB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,0041850E), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: 45a9583896774015c5220384c9ed5eb294c525cf6862c07f2340da09953674c4
Instruction ID: 25c570db86decb207e4e4dfc09e078fb1bce2ee661320ecb4d87a6b80f7b96d5
Opcode Fuzzy Hash: 45a9583896774015c5220384c9ed5eb294c525cf6862c07f2340da09953674c4
Instruction Fuzzy Hash: 60F0C87238122477F22412763C6EF6B1A6C9B41F56F205035F309FB2D0D6699804967C

Function 00410977 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004109EA

Part of subcall function 00411659: GetCurrentHwProfileA.ADVAPI32(?), ref: 00411674
Part of subcall function 00411659: _memset.LIBCMT ref: 004116A3

Part of subcall function 004123AA: malloc.MSVCRT ref: 004123AF
Part of subcall function 004123AA: strncpy.MSVCRT ref: 004123C0

Strings

bwA, xrefs: 00410AF6
:\, xrefs: 004109DB
QuBi, xrefs: 004109FC
C, xrefs: 004109B4

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CurrentInformationProfileVolume_memsetmallocstrncpy
String ID: :\$C$QuBi$bwA
API String ID: 1802918048-1665024704
Opcode ID: 10eca5ba7591b1c9726683b6efb2efe54b45c38386d2ee730406ab5f7d6ba462
Instruction ID: b9c2e458b62d39f60936fb5c5f3cecbb2f8bdcade59f27643c81c3961379b96e
Opcode Fuzzy Hash: 10eca5ba7591b1c9726683b6efb2efe54b45c38386d2ee730406ab5f7d6ba462
Instruction Fuzzy Hash: 0441AFB1A042289BCB259F359D85ADEBBBDEF09304F0000EAF549E3121D6748FC58F68

Function 0041BC66 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,75BF74F0,?,0041CC33,?,0041CCC1,00000000,06400000,00000003,00000000,004175C1,.exe,00436C64), ref: 0041BCB3
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75BF74F0,?,0041CC33,?,0041CCC1,00000000,06400000,00000003,00000000), ref: 0041BCEB

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: cb5c2f7eaaff30269fafad0aed59c048329575cccc762fe3435784ccc124e2e0
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: 1D3187B0504B45DFDB349F25A8C47A77AE8EB14318F108B2FF59682640D33898C4CBD9

Function 00404AB6 Relevance: 6.0, APIs: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CrackInternet
String ID:
API String ID: 1381609488-0
Opcode ID: 98310aa1f434478e7fb8539daea0c8874a8af54bde3e2f4e3fe51e91d8b2aa84
Instruction ID: 606110043d28a64a3cf3047e57e5fece759b363c0f9d5b5b09730ac45ad85936
Opcode Fuzzy Hash: 98310aa1f434478e7fb8539daea0c8874a8af54bde3e2f4e3fe51e91d8b2aa84
Instruction Fuzzy Hash: 03015B32D00218ABCF049BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A018B94

Function 00412554 Relevance: 6.0, APIs: 4, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041255E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417E73,.exe,00436CD4,00436CD0,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC), ref: 0041257D
Process32First.KERNEL32(00000000,00000128), ref: 0041258D
Process32Next.KERNEL32(00000000,00000128), ref: 0041259F

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstH_prolog3_catch_NextSnapshotToolhelp32
String ID:
API String ID: 2623756784-0
Opcode ID: df2519ba6d108fdc8b71c082039c9bc3bb26964c19a844e6744d04e068c13488
Instruction ID: dfa50e9b2d92f41fe19a6e116423a8dfd4d95ce18993e0e6c6816f44e1c7b9ae
Opcode Fuzzy Hash: df2519ba6d108fdc8b71c082039c9bc3bb26964c19a844e6744d04e068c13488
Instruction Fuzzy Hash: C8018671500224ABDB249B60DD44FEE7BBD9F04301F8400E6E40DD2291D7788F949B25

Function 00411659 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 00411674
_memset.LIBCMT ref: 004116A3

Part of subcall function 004123AA: malloc.MSVCRT ref: 004123AF
Part of subcall function 004123AA: strncpy.MSVCRT ref: 004123C0

Strings

Unknown, xrefs: 00411711

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CurrentProfile_memsetmallocstrncpy
String ID: Unknown
API String ID: 455225556-1654365787
Opcode ID: f644913eff35c1bea0ebd6b3338a588dfdbe38cf0212d1c473d842671d84e224
Instruction ID: bbe101daec5a89a31c14a1391deaf042981834e050b350a90ece11c042c44c38
Opcode Fuzzy Hash: f644913eff35c1bea0ebd6b3338a588dfdbe38cf0212d1c473d842671d84e224
Instruction Fuzzy Hash: 8E113675A0021CABDB11EB65DC85BDD73B8AB08704F4004AAB645F7191DA78AEC88F5C

Function 00410B05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436890,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B4E
RegQueryValueExA.KERNEL32(00436890,00000000,00000000,00000000,000000FF,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B6A

Strings

Windows 11, xrefs: 00410B31

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: Windows 11
API String ID: 4153817207-2517555085
Opcode ID: eff4407981480f29a3e8c3abb8119370cc6538536529693400870beae5f7a9d1
Instruction ID: 0bec989384f0a7c66584ec76c5164b6df09d4e667c826edd8b17caab73b46526
Opcode Fuzzy Hash: eff4407981480f29a3e8c3abb8119370cc6538536529693400870beae5f7a9d1
Instruction Fuzzy Hash: 49F04475600304FBEF149BD1DC4EFAE7A6EEB44705F141055B601961E0D7B5AA80D725

Function 00410B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436890,?,?,?,00410BF0,00410B2D,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410BB7
RegQueryValueExA.KERNEL32(00436890,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410BF0,00410B2D,?,?,?,00413ED5,Windows: ), ref: 00410BD2

Strings

CurrentBuildNumber, xrefs: 00410BCA

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: CurrentBuildNumber
API String ID: 4153817207-1022791448
Opcode ID: 3182c4627f195be221e76e344ca264d351bdd3646ceab104d6e5169a5afc3c7d
Instruction ID: 16525d27e18a6f6eb50ada141e8e48f6afa079728c5f11f74ebe8399e0be2e3b
Opcode Fuzzy Hash: 3182c4627f195be221e76e344ca264d351bdd3646ceab104d6e5169a5afc3c7d
Instruction Fuzzy Hash: B4F09071640304FBFF149B91DC0FFAE7A7EEB44B06F140059F701A50A0D6B2AB809B14

Function 00410C5A Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C66
HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C6D
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410C81

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6c13bdc48f24620c1458262451df69a1fa4e50b82ce9a072ad0b58c7c76c57f0
Instruction ID: f6aeb2de1523635185e516c3bea9f441b1e125238e9ebec13057e88de697580f
Opcode Fuzzy Hash: 6c13bdc48f24620c1458262451df69a1fa4e50b82ce9a072ad0b58c7c76c57f0
Instruction Fuzzy Hash: 49E08CB1200204BBD7448B99AC8DF8E7BBCDB84711F000235F605D2250E6B4C9848B68

Function 00407FAC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7

Strings

+@, xrefs: 00408042

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: +@
API String ID: 823142352-396005422
Opcode ID: d2fff167fb3d7733026eac0e62b508efa91648d8dc83ae773f2aa49c1a23bce4
Instruction ID: 807723f2e51248c8f2f98e616b696bb7d0540dc5137f9c813bae56d6ea2df898
Opcode Fuzzy Hash: d2fff167fb3d7733026eac0e62b508efa91648d8dc83ae773f2aa49c1a23bce4
Instruction Fuzzy Hash: 38115B70900204EFDF25DFA4DD88EAF7BB9EB48741F20056AF481B6290DB769A85DB11

Function 004110EE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411129

Strings

%d MB, xrefs: 00411149

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: %d MB
API String ID: 1890195054-2651807785
Opcode ID: 72a52e70201ad22aec00983051af57702ef65c70131e266f08feed65ab004bf9
Instruction ID: b03481c602d06677a198dbb5353ea4b7396302b30250a932e355f2735c5afa91
Opcode Fuzzy Hash: 72a52e70201ad22aec00983051af57702ef65c70131e266f08feed65ab004bf9
Instruction Fuzzy Hash: F301AEB1E00318ABEB04DFB4DC45AFEB7B8EF08705F44006AF601D7190DA759D818765

Function 0041221F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0041225C

Strings

*>A, xrefs: 00412232, 00412237

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: *>A
API String ID: 514040917-2324000863
Opcode ID: 682d7451b07059949ef688f4e67d0a59911f18ee68ef595ae0e870f89720a860
Instruction ID: 6633d685373ab45c8211bc738bf5b9d0ac44cdf8922bbde8cb97f055ad548524
Opcode Fuzzy Hash: 682d7451b07059949ef688f4e67d0a59911f18ee68ef595ae0e870f89720a860
Instruction Fuzzy Hash: 8BF0B475600208ABDB14EB68DC45FEE7BBC9B44B04F00006AF641D7290DEB4DAC58B99

Function 00416ED9 Relevance: 3.1, APIs: 2, Instructions: 70synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00416E08,?,00000000,00000000), ref: 00416F78
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F80

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 1461ab507dc6dfd35255e810fb889321eefe54f3dc9c2a7f5414d00745edce53
Instruction ID: 92bf923f0917d822374c23a0111adfdcc0c83fadde586f70278f9170f8a7b62b
Opcode Fuzzy Hash: 1461ab507dc6dfd35255e810fb889321eefe54f3dc9c2a7f5414d00745edce53
Instruction Fuzzy Hash: 4821483290021CABCF14EF55EC858DE7BB9FF44395F11812AF906A3151C779AA86CB98

Function 00410F26 Relevance: 3.0, APIs: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436890,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ), ref: 00410F5F
RegQueryValueExA.KERNEL32(00436890,00000000,00000000,00000000,000000FF,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000), ref: 00410F7B

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 267a369b0f9252e087d037b2a4430d55cc5b2cc9540841a28167b2b4da7fd567
Instruction ID: 9d2ba58619f1d31ec1eed97cb1b3f411898d7f1aad353569fe744808fca98e41
Opcode Fuzzy Hash: 267a369b0f9252e087d037b2a4430d55cc5b2cc9540841a28167b2b4da7fd567
Instruction Fuzzy Hash: 72F03075640304FFEF248B90DC0EFAA7A7EEB44B06F141155F701A51A0D7B29B509B20

Function 00411DF4 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416973,?), ref: 00411E0C

Strings

siA, xrefs: 00411E1C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: siA
API String ID: 3494564517-470986483
Opcode ID: fb61fe623097888cf65d3814ddf1640f9bdc70486a4c33bd704b3484e22c8f94
Instruction ID: 346925838d3b14811ea8838da46691f13996bcddb0819abdd03295e02f918ba5
Opcode Fuzzy Hash: fb61fe623097888cf65d3814ddf1640f9bdc70486a4c33bd704b3484e22c8f94
Instruction Fuzzy Hash: FBE02B3AA017115B87224BFAD8146A7BB5A9FC5B61B08416BEF48CB325C5B5CC4186E4

Function 0041CBFD Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CC0E

Part of subcall function 0041BBB1: lstrlenA.KERNEL32(?,0041CC1F,0041CCC1,00000000,06400000,00000003,00000000,004175C1,.exe,00436C64,00436C60,00436C5C,00436C58,00436C54,00436C50,00436C4C), ref: 0041BBE3
Part of subcall function 0041BBB1: malloc.MSVCRT ref: 0041BBEB
Part of subcall function 0041BBB1: lstrcpyA.KERNEL32(00000000,?), ref: 0041BBF6

malloc.MSVCRT ref: 0041CC4B

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: f9200b95373ff1b7789a744542eff742420212f49676e2a89c92c5c195539ba2
Instruction ID: 8df7538632d2272994aaaaf24c21eca96cdb497c3d92377313da6f1428c14af4
Opcode Fuzzy Hash: f9200b95373ff1b7789a744542eff742420212f49676e2a89c92c5c195539ba2
Instruction Fuzzy Hash: ABF024726442125BC7206F6AEC819DBBB98EB447A0F054127FE0C97340EA34DC4083F8

Function 00418685 Relevance: 1.7, APIs: 1, Instructions: 154libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00418504), ref: 004188BF

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2dbbfc929b8f993913bf6cc8f40ee179c9bfe20a2ea7c03f75fbc9e0dd5c09c8
Instruction ID: e15db10cd0fdf5c8d7ae2cec0182c2fa1046cf6aaa80e190bc6e5928fe16da9b
Opcode Fuzzy Hash: 2dbbfc929b8f993913bf6cc8f40ee179c9bfe20a2ea7c03f75fbc9e0dd5c09c8
Instruction Fuzzy Hash: F1710975911322AFDF1ADFA0FD4A8243AABFB08203F11B526E91982274D7774B60DF15

Function 00405237 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

RtlAllocateHeap.NTDLL(00000000), ref: 00405285

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: AllocateCrackHeapInternet
String ID:
API String ID: 1086229106-0
Opcode ID: 47051449f07eae40fed238264bbf433b4517496b6ab93af0b5c71253d9c134c2
Instruction ID: 7bf317583300bf6ad83df286ffbbc128525ff46f9f5d6ae9615f57ce5c13ed7d
Opcode Fuzzy Hash: 47051449f07eae40fed238264bbf433b4517496b6ab93af0b5c71253d9c134c2
Instruction Fuzzy Hash: 76114CB1800A2CAFEF20DFA49C84AAB7BBDEB08746F0040A5B908A7150D6355F919F90

Function 00412516 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 0041254C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 4db8ebf57bc6107b71b5ba4193d59d5f03bca1d24e9a0919771ad3cddd4420d4
Instruction ID: eaea2de8574f2c4140e53920b4a13b58a368e230bb1e65c66a238f6e4d3fc1a7
Opcode Fuzzy Hash: 4db8ebf57bc6107b71b5ba4193d59d5f03bca1d24e9a0919771ad3cddd4420d4
Instruction Fuzzy Hash: ABE075B0D0420E9FCF44EFA596152DDBAF4AB48308F00916AC115F2240E3B482058BA9

Function 0041C372 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C383

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 493a35f909d201759c05811b0783fd6409673068aaaac69e2073ebd1e81572ae
Instruction ID: c2910aac78a4d1c0d0fc858b8a2476ce5a7129681263563ecaa76da9588f87e4
Opcode Fuzzy Hash: 493a35f909d201759c05811b0783fd6409673068aaaac69e2073ebd1e81572ae
Instruction Fuzzy Hash: DB211674200714CFC320DF6ED484996B7F5FF49328B14486EEA8A8B722D776E881CB15

Non-executed Functions

Function 0040F51F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 130injectionthreadmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F551
GetThreadContext.KERNEL32(?,00000000), ref: 0040F599
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5B7
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5CD
WriteProcessMemory.KERNEL32(?,00000000,00412DA1,?,00000000), ref: 0040F5FC
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F632
WriteProcessMemory.KERNEL32(?,?,D6D9E8F4,00000004,00000000), ref: 0040F659
SetThreadContext.KERNEL32(?,00000000), ref: 0040F66B

Strings

(, xrefs: 0040F63B
C:\Windows\System32\cmd.exe, xrefs: 0040F570

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: MemoryProcess$Write$ContextThread$AllocReadVirtual_memset
String ID: ($C:\Windows\System32\cmd.exe
API String ID: 1852632844-4087486346
Opcode ID: fc6958dfbf358ad115f9979f5327a80d9ab071de5378f2a28a16158bd4d0b81a
Instruction ID: 3ae57a7eb54b080212c2adebd7e2c133790e565b2c83da63b575b4611208c390
Opcode Fuzzy Hash: fc6958dfbf358ad115f9979f5327a80d9ab071de5378f2a28a16158bd4d0b81a
Instruction Fuzzy Hash: FF414872A00208BFDB11DF94DC85FAABBB9FF48705F104075FA01E6161D775AE448B24

Function 00415182 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00415202
_memset.LIBCMT ref: 00415225
GetDriveTypeA.KERNEL32(?), ref: 0041522E

Part of subcall function 00414D08: _memset.LIBCMT ref: 00414D8F
Part of subcall function 00414D08: _memset.LIBCMT ref: 00414DA0
Part of subcall function 00414D08: _memset.LIBCMT ref: 00414E68

Strings

*%DRIVE_REMOVABLE%*, xrefs: 004151CF
%DRIVE_FIXED%, xrefs: 00415270
*%DRIVE_FIXED%*, xrefs: 0041519E
%DRIVE_REMOVABLE%, xrefs: 00415255

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset$Drive$LogicalStringsType
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 2132072831-147700698
Opcode ID: e5c5d29f18521d925315bfd8a257a194eb4ce0c346b90177c3109ac5f0b7b103
Instruction ID: 053258c5bb1b64546686566c734b2c50377afb1b03b5d253bdbdf7ee91f387e0
Opcode Fuzzy Hash: e5c5d29f18521d925315bfd8a257a194eb4ce0c346b90177c3109ac5f0b7b103
Instruction Fuzzy Hash: 5A513DB190021CAFDF219FA4DC85BEE7BB9FB05304F1041AAEA08A7111E7355E89CF59

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 0042B11C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B785,?,00428536,?,000000BC,?), ref: 0042B15B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B785,?,00428536,?,000000BC,?), ref: 0042B184
GetACP.KERNEL32(?,?,0042B785,?,00428536,?,000000BC,?), ref: 0042B198

Strings

ACP, xrefs: 0042B12B
OCP, xrefs: 0042B13C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: dabdef429acf28403b0f87105750c87aa7dd444468e3f7da184b66417ca4622f
Instruction ID: bab2fb771c86b1a66c882929dcacf4a7e915e9f6e329ecc6f4a62be70c8f3a49
Opcode Fuzzy Hash: dabdef429acf28403b0f87105750c87aa7dd444468e3f7da184b66417ca4622f
Instruction Fuzzy Hash: 8301FC31701616BAEB219B61BC16F6B33B8EF04398F60406BF501E51D0E768CE9192DC

Function 0041D05A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D492
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D4A7
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D4B2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D4CE
TerminateProcess.KERNEL32(00000000), ref: 0041D4D5

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 0be4ccc36355f57da2dd84c823a7aa655c5a2e2b1389c81ad29a2517ab6cb058
Instruction ID: e473dba1badf48f1c5e4f0788e14c81c1bc8c7bf2b41c3635b46f961f92df15a
Opcode Fuzzy Hash: 0be4ccc36355f57da2dd84c823a7aa655c5a2e2b1389c81ad29a2517ab6cb058
Instruction Fuzzy Hash: E321A0B5800304DFD760DF65FC84A483BB5FB08B1AF50913AE509972A2E7B4D5868F5D

Function 00798F68 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00798FF5

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e742114cad1722125c79802c132c505b8aa059e1db89f26ea849efe0e0605f33
Instruction ID: c69d5f22ebc2148a584e54009ae478c4eb38845f80c993d44d8f7e46e0a34171
Opcode Fuzzy Hash: e742114cad1722125c79802c132c505b8aa059e1db89f26ea849efe0e0605f33
Instruction Fuzzy Hash: 81B1553290425AAFEF15CF6CD8857EEBBA5FF59310F14816EEA14AB241D2399D01C7A0

Function 00792178 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00792184
IsDebuggerPresent.KERNEL32 ref: 00792250
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00792269
UnhandledExceptionFilter.KERNEL32(?), ref: 00792273

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 18ce0d8478a3641dabc7516400d562393c335452df318c41e04eb053d314e4e6
Instruction ID: 86d1ec4fda048e4b520296adfb851e52ce1bef1762bab5f73ed3509895f0e547
Opcode Fuzzy Hash: 18ce0d8478a3641dabc7516400d562393c335452df318c41e04eb053d314e4e6
Instruction Fuzzy Hash: 1D311675D01218DBDF20EFA4E9497CDBBB8BF48300F1041EAE50CAB250EBB59A858F45

Function 0040DC75 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB54: lstrlenA.KERNEL32(?,75B65460,?,00000000), ref: 0040DB90
Part of subcall function 0040DB54: strchr.MSVCRT ref: 0040DBA2

HeapFree.KERNEL32(00000000), ref: 0040DCFC
strcpy_s.MSVCRT ref: 0040DD18
HeapFree.KERNEL32(00000000), ref: 0040DD37
HeapFree.KERNEL32(00000000), ref: 0040DD6F
HeapFree.KERNEL32(00000000), ref: 0040DD99
strcpy_s.MSVCRT ref: 0040DDAF
HeapFree.KERNEL32(00000000), ref: 0040DDC8
HeapFree.KERNEL32(00000000), ref: 0040DDED
HeapFree.KERNEL32(00000000), ref: 0040DE17
strcpy_s.MSVCRT ref: 0040DE27
HeapFree.KERNEL32(00000000), ref: 0040DE40
HeapFree.KERNEL32(00000000), ref: 0040DE6F
HeapFree.KERNEL32(00000000), ref: 0040DE9F
strcpy_s.MSVCRT ref: 0040DEB2
HeapFree.KERNEL32(00000000), ref: 0040DECB
lstrlenA.KERNEL32(00000000), ref: 0040DED4
lstrlenA.KERNEL32(00000000), ref: 0040DF09

Part of subcall function 0040F0FD: std::_Xinvalid_argument.LIBCPMT ref: 0040F113

strcpy_s.MSVCRT ref: 0040DF4A
HeapFree.KERNEL32(00000000), ref: 0040DF7D
lstrlenA.KERNEL32(?), ref: 0040DF82
HeapFree.KERNEL32(00000000), ref: 0040DFB3
strcpy_s.MSVCRT ref: 0040DFC1
HeapFree.KERNEL32(00000000), ref: 0040DFD5
HeapFree.KERNEL32(00000000), ref: 0040E011
strcpy_s.MSVCRT ref: 0040E03A
HeapFree.KERNEL32(00000000), ref: 0040E053
HeapFree.KERNEL32(00000000), ref: 0040E0FE
HeapFree.KERNEL32(00000000), ref: 0040E14F

Part of subcall function 0040DB54: strchr.MSVCRT ref: 0040DBC7
Part of subcall function 0040DB54: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCCC), ref: 0040DBE9
Part of subcall function 0040DB54: strcpy_s.MSVCRT ref: 0040DC44

Strings

_@, xrefs: 0040DC93

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: FreeHeap$strcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID: _@
API String ID: 219400098-466146849
Opcode ID: 9f0045c30a09c34ff4b6ec70d6048ce7fbddb1753deef394bb0464aa14a9fcd2
Instruction ID: 264ceb0be135a5a7d918390b30d24df8278dbd2fe0c2fac3f8f65e357691b9f1
Opcode Fuzzy Hash: 9f0045c30a09c34ff4b6ec70d6048ce7fbddb1753deef394bb0464aa14a9fcd2
Instruction Fuzzy Hash: 8EE13C72C00219AFEF20AFF5DC88ADEBF79AF48305F14446AF205B3152DA3A59849F54

Function 00424B67 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424B6F
__mtterm.LIBCMT ref: 00424B7B

Part of subcall function 0042483A: DecodePointer.KERNEL32(FFFFFFFF), ref: 0042484B
Part of subcall function 0042483A: TlsFree.KERNEL32(FFFFFFFF), ref: 00424865

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424B91
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424B9E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424BAB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424BB8
TlsAlloc.KERNEL32 ref: 00424C08
TlsSetValue.KERNEL32(00000000), ref: 00424C23
__init_pointers.LIBCMT ref: 00424C2D
EncodePointer.KERNEL32 ref: 00424C3E
EncodePointer.KERNEL32 ref: 00424C4B
EncodePointer.KERNEL32 ref: 00424C58
EncodePointer.KERNEL32 ref: 00424C65
DecodePointer.KERNEL32(Function_000249BE), ref: 00424C86
__calloc_crt.LIBCMT ref: 00424C9B
DecodePointer.KERNEL32(00000000), ref: 00424CB5
__initptd.LIBCMT ref: 00424CC0
GetCurrentThreadId.KERNEL32 ref: 00424CC7

Strings

FlsFree, xrefs: 00424BAD
FlsGetValue, xrefs: 00424B93
KERNEL32.DLL, xrefs: 00424B6A
FlsAlloc, xrefs: 00424B8B
FlsSetValue, xrefs: 00424BA0

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 0a94c54a7945867de6cfe35b03e58e96b0a908eff489fa3a921db52f6821de8f
Instruction ID: 342ea3fdfc67916c9f1319b2c0e4fcf8768d432b58525999a292328997d6bcd9
Opcode Fuzzy Hash: 0a94c54a7945867de6cfe35b03e58e96b0a908eff489fa3a921db52f6821de8f
Instruction Fuzzy Hash: 99314935E093609ADB21AF7ABC086073FA4EF84726B51163BE410D36A1DB78D840CB5C

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043ABCC,?), ref: 00401A2E

Strings

malware, xrefs: 004019CD
timmy, xrefs: 004019AF
virus, xrefs: 004019EB
milozs, xrefs: 0040199B
Hong Lee, xrefs: 00401973
Miller, xrefs: 00401991
test user, xrefs: 004019E1
IT-ADMIN, xrefs: 0040197D
Emily, xrefs: 0040195F
HAPUBWS, xrefs: 00401969
Johnson, xrefs: 00401987
Peter Wilson, xrefs: 004019A5
maltest, xrefs: 004019D7
sandbox, xrefs: 004019C3
user, xrefs: 004019B9
WDAGUtilityAccount, xrefs: 004019FF
John Doe, xrefs: 004019F5
Sand box, xrefs: 00401955
CurrentUser, xrefs: 0040194B

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: 3f0af724c2dcbc4c0c866c45427fa56f2bbf27492d3fc28d0ab31a611d6431bd
Instruction ID: d9236fb4f0ff957f0166239cbbf2c5784357e6586ba14347c128fa04638c492f
Opcode Fuzzy Hash: 3f0af724c2dcbc4c0c866c45427fa56f2bbf27492d3fc28d0ab31a611d6431bd
Instruction Fuzzy Hash: 342103B194526C8BCB20CF159D4C6DDBBB4AB5D308F00B1DAD5886A210C7B85ED9CF4D

Function 0041B8B5 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,762283C0,00000000,0041C5A0,?), ref: 0041B8BA
StrCmpCA.SHLWAPI(762283C0,0043613C), ref: 0041B8E8
StrCmpCA.SHLWAPI(762283C0,.zip), ref: 0041B8F8
StrCmpCA.SHLWAPI(762283C0,.zoo), ref: 0041B904
StrCmpCA.SHLWAPI(762283C0,.arc), ref: 0041B910
StrCmpCA.SHLWAPI(762283C0,.lzh), ref: 0041B91C
StrCmpCA.SHLWAPI(762283C0,.arj), ref: 0041B928
StrCmpCA.SHLWAPI(762283C0,.gz), ref: 0041B934
StrCmpCA.SHLWAPI(762283C0,.tgz), ref: 0041B940

Strings

.zip, xrefs: 0041B8F2
.gz, xrefs: 0041B92E
.arj, xrefs: 0041B922
.zoo, xrefs: 0041B8FE
.lzh, xrefs: 0041B916
.tgz, xrefs: 0041B93A
.arc, xrefs: 0041B90A

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: a6acff1ce351d4c2d08f5f7e1dd5765e0b6a09ac0655d91721820eb3858dbec9
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: 7A019231B8132BB55A6236219E42EFF1A5C8D97F917155037E800E21C8EB4C988365FE

Function 004164FF Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00416524
_memset.LIBCMT ref: 00416598
_memset.LIBCMT ref: 0041660C
_memset.LIBCMT ref: 00416680

Strings

\.aws\, xrefs: 004165CB
Azure\.aws, xrefs: 004165E7
Azure\.azure, xrefs: 00416573
\.azure\, xrefs: 00416554
\.IdentityService\, xrefs: 0041663F
*.*, xrefs: 00416578
*.*, xrefs: 004165EC
Azure\.IdentityService, xrefs: 0041665B
msal.cache, xrefs: 00416660

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2102423945-974132213
Opcode ID: bf252c35c8b55aa2f47da0acf7c4516a3fa7683d86b1e94a602c03db96ee7b73
Instruction ID: 3cefbc2560fae273e5afeb2847eac18d6cd6927558b4bb74fdd557bb6d377028
Opcode Fuzzy Hash: bf252c35c8b55aa2f47da0acf7c4516a3fa7683d86b1e94a602c03db96ee7b73
Instruction Fuzzy Hash: B441B971D4022D7ADB24EB61EC4BFDD7778AB08304F1444AAB605F70D1DAB8AB848F59

Function 00414D08 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00414D8F
_memset.LIBCMT ref: 00414DA0
_memset.LIBCMT ref: 00414E68
strtok_s.MSVCRT ref: 00414EC2
_memset.LIBCMT ref: 00414ED4
strtok_s.MSVCRT ref: 00414F02
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FF6
strtok_s.MSVCRT ref: 00415027

Strings

%s\*.*, xrefs: 00414D50
%s\%s, xrefs: 00414E50
%s\%s, xrefs: 00414DFC
%s\%s\%s, xrefs: 00414E39

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset$strtok_s$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 2378718607-332874205
Opcode ID: 906c4d521f01e6e342adc7cfc72de3dfdf3114fc934318aaa3c07627eb2d389c
Instruction ID: ac959522ac8161a8c59de6a03dc3e9916ed04c50c613448a2b432023ce8b070b
Opcode Fuzzy Hash: 906c4d521f01e6e342adc7cfc72de3dfdf3114fc934318aaa3c07627eb2d389c
Instruction Fuzzy Hash: D6C13BB1D0021AABCF22EF60DC45AEE777DAB48304F0140A6FA09B3151DB799B858F59

Function 00428B64 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428B7D

Part of subcall function 004240C2: Sleep.KERNEL32(00000000,?), ref: 004240EA

__calloc_crt.LIBCMT ref: 00428BA1
_free.LIBCMT ref: 00428BAF
__calloc_crt.LIBCMT ref: 00428BBD
_free.LIBCMT ref: 00428BCD
_free.LIBCMT ref: 00428BD3
__copytlocinfo_nolock.LIBCMT ref: 00428BE2
__setlocale_nolock.LIBCMT ref: 00428BEF
_free.LIBCMT ref: 00428C08
__setmbcp_nolock.LIBCMT ref: 00428C1A
_free.LIBCMT ref: 00428C28
_free.LIBCMT ref: 00428C3C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 0bc65d7e22c7fdf9df02714a717bc1bc287677933603e426b8eb902575a055b2
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: 962137B1306120EAD7217F27F80294FBBE0DF81B18BA0442FF58496252DF3DAC808A5D

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 0042665D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426684
_free.LIBCMT ref: 00426692
_free.LIBCMT ref: 0042669D
_free.LIBCMT ref: 00426671

Part of subcall function 0041D98B: HeapFree.KERNEL32(00000000,00000000,?,0041D1D3,00000000,0043B6F4,0041D21A,0040EE93,?,?,0041D304,0043B6F4,?,?,0042EC88,0043B6F4), ref: 0041D9A1
Part of subcall function 0041D98B: GetLastError.KERNEL32(?,?,?,0041D304,0043B6F4,?,?,0042EC88,0043B6F4,?,?,?), ref: 0041D9B3

___free_lc_time.LIBCMT ref: 004266BB
_free.LIBCMT ref: 004266C6
_free.LIBCMT ref: 004266EB
_free.LIBCMT ref: 00426702
_free.LIBCMT ref: 00426711

Strings

xLC, xrefs: 004266AB

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: 75c8617aa577018b802f999097e256e29a76f75524ffb918136c170e5bfc19f7
Instruction ID: 49b3ec72b6b2c094beee6f0e5666a09e04043e36b45bb43ec530869945208503
Opcode Fuzzy Hash: 75c8617aa577018b802f999097e256e29a76f75524ffb918136c170e5bfc19f7
Instruction Fuzzy Hash: CF11B6F16107159BDF206F66E885A9AB395AB4170DF59093FF10597241CB3C9C90CE28

Function 0041B9D6 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,?), ref: 0041BA0A
GetFileSize.KERNEL32(?,00000000), ref: 0041BA83
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BA9F
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BAB3
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BABC
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BACC
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BAEA
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BAFA

Strings

, xrefs: 0041BA56

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: c0fb2db621269d954561ef5db822be1f18ad4306e372f21deb85d8fd3cc2ab73
Instruction ID: f057a21d600b3b22fe9ce4a4ad899485fc4b8af774a3bef2e9074c408679b76e
Opcode Fuzzy Hash: c0fb2db621269d954561ef5db822be1f18ad4306e372f21deb85d8fd3cc2ab73
Instruction Fuzzy Hash: 2151F5B1D00218AFDB28DFA5D981AEEBBB9EF44304F10442AE515E7660D738AD85CF94

Function 0041F992 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041F9B7

Part of subcall function 0041F552: Replicator::operator[].LIBCMT ref: 0041F5D5
Part of subcall function 0041F552: DName::operator+=.LIBCMT ref: 0041F5DD

DName::operator+.LIBCMT ref: 0041FA10
DName::DName.LIBCMT ref: 0041FA68

Strings

,..., xrefs: 0041F9FC, 0041FA08
void, xrefs: 0041FA60
..., xrefs: 0041FA4B, 0041FA57
,<ellipsis>, xrefs: 0041FA03
<ellipsis>, xrefs: 0041FA52

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: cbd467bd594783157b11b8f65c6b9ca11f902f73757fc4ad6040fd7a65445d3d
Instruction ID: fb54d07a68d6be51e8ce47b648e01284641db43b2701e064647495a662b2e82f
Opcode Fuzzy Hash: cbd467bd594783157b11b8f65c6b9ca11f902f73757fc4ad6040fd7a65445d3d
Instruction Fuzzy Hash: 0F213D307012449FCB15DF5CD4449A97BF4EF4939AB4480A6E849DB367C738EA87CB49

Function 0042132B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00421335
DName::DName.LIBCMT ref: 00421341

Part of subcall function 0041F00C: DName::doPchar.LIBCMT ref: 0041F03D

UnDecorator::getScopedName.LIBCMT ref: 00421380
DName::operator+=.LIBCMT ref: 0042138A
DName::operator+=.LIBCMT ref: 00421399
DName::operator+=.LIBCMT ref: 004213A5
DName::operator+=.LIBCMT ref: 004213B2

Strings

void, xrefs: 00421391

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 88dbe5eb7ff6c0574109cc730e57ac6624d6c1ec8f8b0c341c280c3a547b1e03
Instruction ID: 4ad8086984012fe6e396dd634d951fd617e344818dca446778c829ad9440c5de
Opcode Fuzzy Hash: 88dbe5eb7ff6c0574109cc730e57ac6624d6c1ec8f8b0c341c280c3a547b1e03
Instruction Fuzzy Hash: 4111C671A00208AFD714EB25D856BED7BA0AF24305F44409BE8029B6E2CB389A86C749

Function 0040BF22 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 420COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,Opera,0043683B,0043683A,00436837,00436836,00436833,00436832,0043682F), ref: 0040C060
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C06E
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C07C

Strings

Opera Crypto, xrefs: 0040C074
Opera GX, xrefs: 0040C066
Opera, xrefs: 0040C058
\*.*, xrefs: 0040BF48

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID:
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 0-1710495004
Opcode ID: ba3c3280e43c410dcd590412856208ecd2083af9cf8d9d35a7cd81e77f195fe9
Instruction ID: 79937c07745840ca59eddc5a5cdfa6df5c628ddd8be8d0246969757881689052
Opcode Fuzzy Hash: ba3c3280e43c410dcd590412856208ecd2083af9cf8d9d35a7cd81e77f195fe9
Instruction Fuzzy Hash: 1A021C71A001299BCB21FB26DD466CD7771AF14308F4151EBB948B3191DBB86FC98F88

Function 0040FB02 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB27
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB53
_memset.LIBCMT ref: 0040FB96
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FCEC

Part of subcall function 0040F005: _memmove.LIBCMT ref: 0040F01F

Strings

N0ZWFt, xrefs: 0040FC53

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 898c51137a7cc0ead4e363bda5b9ea1602847eab9fbb75ffd378713a9d89c653
Instruction ID: 20d42e2015e456c1747424349194f0c6a0577cf11073bf2f021c8e6848fe4d5e
Opcode Fuzzy Hash: 898c51137a7cc0ead4e363bda5b9ea1602847eab9fbb75ffd378713a9d89c653
Instruction Fuzzy Hash: B75182B1D0022C9BDB309F14DC85AEDB7B9AB44304F0001FAA609B7592DB796E88CF59

Function 0040F8EA Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBB8,?,00000000,00000000,?,?), ref: 0040F909
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBB8,?,00000000,00000000), ref: 0040F933
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F980
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040F9D9
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA31
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBB8,?,00000000,00000000,?,?), ref: 0040FA42

Strings

@, xrefs: 0040F94C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: e19652b96a8f31f04c1644d4b4c156224b0badc17b6e07d08097c67cb35c2b0c
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: 9C41BE32A00209BFDF209FA1DC45BDF7B76EF44760F14803AFA04A6690D7788955DB94

Function 00792E00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00792E37
___except_validate_context_record.LIBVCRUNTIME ref: 00792E3F
_ValidateLocalCookies.LIBCMT ref: 00792EC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00792EF3
_ValidateLocalCookies.LIBCMT ref: 00792F48

Strings

:!y, xrefs: 00792F0C
csm, xrefs: 00792EDD

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: :!y$csm
API String ID: 1170836740-206657981
Opcode ID: f3929d1580c5b35bb30d6753870dedd4da4b53140c537cce089d9b4ec98e7d0c
Instruction ID: ac010d7a9795bdb0a809db07407ab0fc13e51544090991ed0156d94a36262be2
Opcode Fuzzy Hash: f3929d1580c5b35bb30d6753870dedd4da4b53140c537cce089d9b4ec98e7d0c
Instruction Fuzzy Hash: FF41B734A00208EBCF10EF68D888AAEBBF5EF45314F148155E8155B3A3D779DE56CB91

Function 00793E5D Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00793F7C
___TypeMatch.LIBVCRUNTIME ref: 0079408A
CallUnexpected.LIBVCRUNTIME ref: 007941F7

Strings

csm, xrefs: 00793E9A
csm, xrefs: 00793F07
csm, xrefs: 00793FB3

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 7aa1a579ac44d4ddba5092aee05d689c806eae71af2be5ec04bd42dc4187fb16
Instruction ID: e1b76d12e159546060f332272ad9a7f56492cae227f2564b2f5aa72f4a51a1fb
Opcode Fuzzy Hash: 7aa1a579ac44d4ddba5092aee05d689c806eae71af2be5ec04bd42dc4187fb16
Instruction Fuzzy Hash: BDB14771C00209EFCF29DFA4E885DAEBBB5FF14310B15419AE8156B212D739DA92CF91

Function 004125E1 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 224synchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004127F1
_memset.LIBCMT ref: 004128F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00412972

Strings

23a142269e47ce1692ccc9fb68473bc2, xrefs: 0041281B
.exe, xrefs: 00412624
EMPTY, xrefs: 0041287A

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset$ObjectSingleWait
String ID: .exe$23a142269e47ce1692ccc9fb68473bc2$EMPTY
API String ID: 12478032-2199943196
Opcode ID: b799e55be2d5ac1ccf5fc4e0a91b30e673d6d24515a90444e9f79190fbec8b07
Instruction ID: 7120b0bcb209939396e98daef681599c2d67828aa6ca78812403a899de2e5871
Opcode Fuzzy Hash: b799e55be2d5ac1ccf5fc4e0a91b30e673d6d24515a90444e9f79190fbec8b07
Instruction Fuzzy Hash: 7D9121B1E0012DABCF11EF65DD46BCD7779AB04309F4150AAB608B30A1CA796FC98F58

Function 0040DB54 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75B65460,?,00000000), ref: 0040DB90
strchr.MSVCRT ref: 0040DBA2
strchr.MSVCRT ref: 0040DBC7
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCCC), ref: 0040DBE9
strcpy_s.MSVCRT ref: 0040DC44

Strings

0123456789ABCDEF, xrefs: 0040DB6E

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: lstrlenstrchr$strcpy_s
String ID: 0123456789ABCDEF
API String ID: 1957064729-2554083253
Opcode ID: 8a80138f6bd7a7f2679b34f9e534e62fa066860175bf704f797071b7d644e1de
Instruction ID: f8fd079a78b2ff1c2deed706dfff43d30c371303101ee63b350453b9db15b758
Opcode Fuzzy Hash: 8a80138f6bd7a7f2679b34f9e534e62fa066860175bf704f797071b7d644e1de
Instruction Fuzzy Hash: 36315E72D002199FDB10DFE8DC89ADEBBB5AF08315F110179E901FB281DB79A909CB54

Function 00798127 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00798234,?,007910E3,?,00000000,?,?,007983AD,00000021,FlsSetValue,007A55B8,007A55C0,?), ref: 007981E8

Strings

api-ms-, xrefs: 0079817E
ext-ms-, xrefs: 00798192

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 31c6d971be12372c3c8f2b09a38b5b906ee44d9ac08f4154ad2c54c2733de9e4
Instruction ID: cddfeedc32f6ba1034acded78b5c575c4daf3e603eb49e56fb6b9362e04c7993
Opcode Fuzzy Hash: 31c6d971be12372c3c8f2b09a38b5b906ee44d9ac08f4154ad2c54c2733de9e4
Instruction Fuzzy Hash: 5821A871A41218E7CF619B64FC44B5B3759AB83760F250219ED05A7291DF78EE03C6E1

Function 0041FA72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FABB
DName::operator+.LIBCMT ref: 0041FAC2
DName::DName.LIBCMT ref: 0041FAE4
DName::operator+.LIBCMT ref: 0041FAEB
DName::operator+.LIBCMT ref: 0041FAF2

Strings

throw(, xrefs: 0041FAB3, 0041FADC

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: 6bcf798ea22f69823d702c871f8da28da09a6e3f13a520559632ccd68f072322
Instruction ID: ce185b860f32254eac45faa161dbbb74df866feaa3f5b4bc6d1d263faa69c407
Opcode Fuzzy Hash: 6bcf798ea22f69823d702c871f8da28da09a6e3f13a520559632ccd68f072322
Instruction Fuzzy Hash: 5F017E34600209AFCF04EF64D856EED7BB5EF44748F50407AF9059B292DB78E98A874C

Function 0079767F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,007A34CC,000000FF,?,0079760F,?,?,007975E3,00000000), ref: 007976B4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007976C6
FreeLibrary.KERNEL32(00000000,?,?,00000000,007A34CC,000000FF,?,0079760F,?,?,007975E3,00000000), ref: 007976E8

Strings

mscoree.dll, xrefs: 007976AD
:!y, xrefs: 007976D7
CorExitProcess, xrefs: 007976BE

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: :!y$CorExitProcess$mscoree.dll
API String ID: 4061214504-380778296
Opcode ID: cac3f18e10c0a319ff1f6282eaad7072fa86d7a57a1c567f185efe1163682473
Instruction ID: d2a34771e3ec4a98566971b4d722f15c0ed257fac9223db2358e68dac535f573
Opcode Fuzzy Hash: cac3f18e10c0a319ff1f6282eaad7072fa86d7a57a1c567f185efe1163682473
Instruction Fuzzy Hash: FF01A771518619EBDB018F54DC05BAFB7B8FBC5B10F004625F821A2690DBBD9D00CA54

Function 007934B1 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007934A8,0079317C,00792355), ref: 007934BF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 007934CD
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007934E6
SetLastError.KERNEL32(00000000,007934A8,0079317C,00792355), ref: 00793538

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 434ec5fc7bfe9f8d51bb49c8df4d8ee759e63d417db387d158c24cebfbc93884
Instruction ID: 42ccced08e80a557b941015c66c281664548b97dc82bf47a8eedfc1eae9b488c
Opcode Fuzzy Hash: 434ec5fc7bfe9f8d51bb49c8df4d8ee759e63d417db387d158c24cebfbc93884
Instruction Fuzzy Hash: 610126722083159EEE2527B4BCDAA3B2B84DB8AB747310339F520811F2FF9D4E119244

Function 00793C06 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00793CCD
___AdjustPointer.LIBCMT ref: 00793CF0
___AdjustPointer.LIBCMT ref: 00793D8C

Strings

:!y, xrefs: 00793C65

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: AdjustPointer
String ID: :!y
API String ID: 1740715915-1945855279
Opcode ID: 00475935ba923abceb80427172e49fe16bf747cb67710bbf8d1a72a0bac9147a
Instruction ID: 63ccf33ead27559d736c41752db9dd1da79c6ec1ce487d3c93ed6a1689e945a1
Opcode Fuzzy Hash: 00475935ba923abceb80427172e49fe16bf747cb67710bbf8d1a72a0bac9147a
Instruction Fuzzy Hash: E151EE76601606EFDF289F54E856BBA73A5EF01710F24452DE802972A1E73DEE80CB90

Function 0040826D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040830C

Strings

gC, xrefs: 00408350, 00408387, 00408353
v10, xrefs: 004082D3
v20, xrefs: 00408286
ERROR_V128, xrefs: 004082C3

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset
String ID: ERROR_V128$v10$v20$gC
API String ID: 2102423945-2588172476
Opcode ID: d1fe65eb4172e1b061751ccf6830125739748993e648a78769eb2abe3019f6f4
Instruction ID: 32784a6a2cbcc3eaceeec4e79e4bc4ec165ad58523598210bf75c3a83be39c19
Opcode Fuzzy Hash: d1fe65eb4172e1b061751ccf6830125739748993e648a78769eb2abe3019f6f4
Instruction Fuzzy Hash: 2E41B5B2A00118ABCF20DF65CD45ADE7BA8AF84714F15413FFD40F7280EB7899859699

Function 0041C00B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,762283C0,00000000,?,?,?,?,?,?,0041C5D4,?,00416F69,?), ref: 0041C05E
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C5D4,?,00416F69), ref: 0041C08E
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C5D4,?,00416F69,?), ref: 0041C0BA
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C5D4,?,00416F69,?), ref: 0041C0C8

Part of subcall function 0041B9D6: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,?), ref: 0041BA0A

Strings

ioA, xrefs: 0041C01B

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID: ioA
API String ID: 3986731826-1543057363
Opcode ID: ea0d16ab0233029f2f6670c4ec71d0e05b8e894d5f5014189c3cd8366d21292b
Instruction ID: a3ae9b5ee02e06381242bb1180d8469c0c66a3ab8020e6489cedce7931a59bc5
Opcode Fuzzy Hash: ea0d16ab0233029f2f6670c4ec71d0e05b8e894d5f5014189c3cd8366d21292b
Instruction Fuzzy Hash: C1415B71900249DBCF14DF69C884ADEBBF8FF48314F14426AE855EA266D3349985CFA4

Function 0040F286 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F29C

Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECAA
Part of subcall function 0042EC95: __CxxThrowException@8.LIBCMT ref: 0042ECBF
Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECD0

std::_Xinvalid_argument.LIBCPMT ref: 0040F2BB
_memmove.LIBCMT ref: 0040F2F5

Strings

string too long, xrefs: 0040F2B6
invalid string position, xrefs: 0040F297

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 8e12207a144c445ab2d6e2887baac1ed13184b9167c9d4f836ba2983239090cc
Instruction ID: 5262f2a1c1bb7fc98e9b32af02b56188c6a606b0020a3752bba0e92898a3303c
Opcode Fuzzy Hash: 8e12207a144c445ab2d6e2887baac1ed13184b9167c9d4f836ba2983239090cc
Instruction Fuzzy Hash: 70110E753002019FCB24DE69D881A1973A8FF05324B50057AF812EBAC2C379E848CB9C

Function 007A01A4 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007A022B
__alloca_probe_16.LIBCMT ref: 007A02EC
__freea.LIBCMT ref: 007A0353

Part of subcall function 00798A87: HeapAlloc.KERNEL32(00000000,?,?,?,00792778,?,?,?,?,?,00791051,?,?,?,007910E3,?), ref: 00798AB9

__freea.LIBCMT ref: 007A0368
__freea.LIBCMT ref: 007A0378

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: ce01f19ebcf6f1ddc3f8d3b42f69e5659209d188bd71f151fe3cc43fa7aaf0f7
Instruction ID: a2e0731688e21daf94dd6b8c13f0cfead7b8fabdafb5f8ce176c815a34133357
Opcode Fuzzy Hash: ce01f19ebcf6f1ddc3f8d3b42f69e5659209d188bd71f151fe3cc43fa7aaf0f7
Instruction Fuzzy Hash: 5451D37260020AEFEF259E64DC89EBF76A9EF86354F150629FD04D6150EB78CC1087E1

Function 00425763 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00425771
_free.LIBCMT ref: 00425784

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 798a7c87ef51105fd5ff8b2a4ac34650f7d7e6e40ee0a51e7d15eb3ccc968397
Instruction ID: 1fe24d055b231caadb3bac1077d0b41ea54537017262c08fa21935ffde822665
Opcode Fuzzy Hash: 798a7c87ef51105fd5ff8b2a4ac34650f7d7e6e40ee0a51e7d15eb3ccc968397
Instruction Fuzzy Hash: 5A11EB32B40A35EBCF312F35BC05A5A3BA4AF84775FB0412BF948DA251DB3C8840869D

Function 00426769 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00426775

Part of subcall function 004249A4: __getptd_noexit.LIBCMT ref: 004249A7
Part of subcall function 004249A4: __amsg_exit.LIBCMT ref: 004249B4

__getptd.LIBCMT ref: 0042678C
__amsg_exit.LIBCMT ref: 0042679A
__lock.LIBCMT ref: 004267AA
__updatetlocinfoEx_nolock.LIBCMT ref: 004267BE

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e5b528c2df55b90b8f95683bbe5c3f4538672bfb3054380b72a1938f3589f922
Instruction ID: 3cb0b0a6c2691d8e3da6a29315b7f2120c55896ae2d56be74b6963c8fc1e9199
Opcode Fuzzy Hash: e5b528c2df55b90b8f95683bbe5c3f4538672bfb3054380b72a1938f3589f922
Instruction Fuzzy Hash: 94F09672F007309ADA21FB79740275E32D0AF8072DF92011FF400972D2CB2C5940CA5E

Function 004135E8 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041362A
strtok_s.MSVCRT ref: 004139CF

Strings

true, xrefs: 004136E6
false, xrefs: 00413705

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: false$true
API String ID: 3330995566-2658103896
Opcode ID: 26323a4b7be200d82d01d47cc2cf62ad8e034699c249e2f89ea46934ec275041
Instruction ID: 4b9006c81de5cbe442b288e1576c32e24171c8e14767bb27393f0de91e811dc5
Opcode Fuzzy Hash: 26323a4b7be200d82d01d47cc2cf62ad8e034699c249e2f89ea46934ec275041
Instruction Fuzzy Hash: B8B138B59002189BCF60EF64DC89ADA77B5BF18305F0001EAE549A72A1DB75AFD4CF44

Function 0079177E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007917B1
Concurrency::cancel_current_task.LIBCPMT ref: 0079189D
std::_Xinvalid_argument.LIBCPMT ref: 007918AD

Strings

vector too long, xrefs: 007918A8

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_catchXinvalid_argumentstd::_
String ID: vector too long
API String ID: 4133478652-2873823879
Opcode ID: 31c75d20f71711cacb37c20bdfb18ef7f56ab3d50e2ed96d7b803c75e24fab53
Instruction ID: 552c1e367318577d139b55b054ba694586eff6db9332239d5ee01d1c729eda68
Opcode Fuzzy Hash: 31c75d20f71711cacb37c20bdfb18ef7f56ab3d50e2ed96d7b803c75e24fab53
Instruction Fuzzy Hash: 6C419F71A00107DFCF14DFACE8958AEBBA5FF45320B20861DE915D7681DB35AA60CB90

Function 0041004C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041006F

Part of subcall function 0042EC48: std::exception::exception.LIBCMT ref: 0042EC5D
Part of subcall function 0042EC48: __CxxThrowException@8.LIBCMT ref: 0042EC72
Part of subcall function 0042EC48: std::exception::exception.LIBCMT ref: 0042EC83

__EH_prolog3_catch.LIBCMT ref: 0041010E
std::_Xinvalid_argument.LIBCPMT ref: 00410122

Strings

vector<T> too long, xrefs: 0041006A, 0041011D

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: adf4a1d7e1d46ad6525c877d91ff94b5ad02ee86ab9dfb939e1f121fe8ea235d
Instruction ID: 9177247471c649631c17fecc10ba8c632ccc4c075d8dd84785c2030fa8e5253b
Opcode Fuzzy Hash: adf4a1d7e1d46ad6525c877d91ff94b5ad02ee86ab9dfb939e1f121fe8ea235d
Instruction Fuzzy Hash: CD313872B003229BDB08EF69EC456DE77A2A708311F11106FE520E7254D7BE8DC08B48

Function 007936D3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00793684,00000000,?,0080C104,?,?,?,00793827,00000004,InitializeCriticalSectionEx,007A4C68,InitializeCriticalSectionEx), ref: 007936E0
GetLastError.KERNEL32(?,00793684,00000000,?,0080C104,?,?,?,00793827,00000004,InitializeCriticalSectionEx,007A4C68,InitializeCriticalSectionEx,00000000,?,007935A7), ref: 007936EA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00793712

Strings

api-ms-, xrefs: 007936F7

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 66ac5e5708df7c4b4f78faa023fea48b3c7cd055130c8866bd1496c58284c7ba
Instruction ID: f4c5134d55b8b770ec43bc1522ce0c43fdcefb75282e4ca3953ab257cfec23ac
Opcode Fuzzy Hash: 66ac5e5708df7c4b4f78faa023fea48b3c7cd055130c8866bd1496c58284c7ba
Instruction Fuzzy Hash: F4E04FB1280204F7EF101FF0FC8AB2A3F55BB91B51F108060FA0DA80E1D7ABDA119959

Function 0040F252 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F257

Part of subcall function 0042EC48: std::exception::exception.LIBCMT ref: 0042EC5D
Part of subcall function 0042EC48: __CxxThrowException@8.LIBCMT ref: 0042EC72
Part of subcall function 0042EC48: std::exception::exception.LIBCMT ref: 0042EC83

std::_Xinvalid_argument.LIBCPMT ref: 0040F262

Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECAA
Part of subcall function 0042EC95: __CxxThrowException@8.LIBCMT ref: 0042ECBF
Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECD0

Strings

string too long, xrefs: 0040F252
invalid string position, xrefs: 0040F25D

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 41ce4b4c9a099b4f77c2236bcd3da0778ecbb1318769d225bcb20bb342a12378
Instruction ID: cd7342fa11c39e7fd804ac9e9ab6cb37250b783395530856443caf81d1d171bb
Opcode Fuzzy Hash: 41ce4b4c9a099b4f77c2236bcd3da0778ecbb1318769d225bcb20bb342a12378
Instruction Fuzzy Hash: B7D012A5A4020C7BCB04EBDAE806ACDBAE99B58715F20016BB605D3641EAB856004569

Function 00411D36 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004122D6,?), ref: 00411D41
HeapAlloc.KERNEL32(00000000), ref: 00411D48
wsprintfW.USER32 ref: 00411D59

Strings

%hs, xrefs: 00411D53

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 2d0c07c98a0cbaf1e898a5dc3ff862fa4a54b983e479ff33ffb3668d4474b514
Instruction ID: 62812af7f09d9c33686cfcbb8b381ddf7a09e976e7f1ad92f6c956f3b95a8282
Opcode Fuzzy Hash: 2d0c07c98a0cbaf1e898a5dc3ff862fa4a54b983e479ff33ffb3668d4474b514
Instruction Fuzzy Hash: 6FD0A73134031477C6101BD4BC0DF9A3F2CDB057A2F001130FA0DD5151C96548144BED

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: cf640d80628ad4e74f3d38171acba973207c28ae387d92be87cd61cc0b75c439
Instruction ID: 9bbdd1ee4896165f6ac39e3e5efd8c25d27bca58a6bb0b57e2a538c7cae0429d
Opcode Fuzzy Hash: cf640d80628ad4e74f3d38171acba973207c28ae387d92be87cd61cc0b75c439
Instruction Fuzzy Hash: C9D012353C030477E1781B50BC5FF1A2934D7C5F02F201124F312580D046A41402963E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

ntdll.dll, xrefs: 004018B5
EtwEventWrite, xrefs: 004018C5

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: e7173cbc659f646d90c6637380379b2e67bafee961351022300d75924a4236c6
Instruction ID: fa0301676ac4a0b35d6f0bad7f9db5a069fcd374a286a1e4a3065c0da922a8bc
Opcode Fuzzy Hash: e7173cbc659f646d90c6637380379b2e67bafee961351022300d75924a4236c6
Instruction Fuzzy Hash: 84B09B7078020097CD1467756D5DF07766566457027506165A645D0160D77C5514551D

Function 0079D02C Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0079D08F

Part of subcall function 0079B857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,007A0349,?,00000000,-00000008), ref: 0079B903

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0079D2EA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0079D332
GetLastError.KERNEL32 ref: 0079D3D5

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6d63ecfc7bc5dc46a584d39f64c6fb3a453526c0d20ec0f1e290247ed9f1f557
Instruction ID: dad3f00663d26c0893ea8aaa80c9939939f2515ffd477bc85bc071d21699539f
Opcode Fuzzy Hash: 6d63ecfc7bc5dc46a584d39f64c6fb3a453526c0d20ec0f1e290247ed9f1f557
Instruction Fuzzy Hash: 1ED137B5D00258DFCF25CFA8E884AADBBB5FF49300F18816AE956EB351D734A941CB50

Function 0041BDC5 Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BE0A
_memmove.LIBCMT ref: 0041BE1E
_memmove.LIBCMT ref: 0041BE6B
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,00000001,?,?,0041AEB0,?,00000001,?,?,?), ref: 0041BE8A

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: 2f32b6d30d6ea6acfcbf4458e2c3a94141a5c390d0cdfed8c56d90b68290345c
Instruction ID: bda922fd8d2430ead1ad56b0b84c20489616fa0042db1156ae38f56ccbdc6197
Opcode Fuzzy Hash: 2f32b6d30d6ea6acfcbf4458e2c3a94141a5c390d0cdfed8c56d90b68290345c
Instruction Fuzzy Hash: B6316B71600704AFDB21DF65D980BE7B7F8FB48310F40892EEA4687A00EB74F9458B94

Function 0079A56B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0079B857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,007A0349,?,00000000,-00000008), ref: 0079B903

GetLastError.KERNEL32 ref: 0079A5CF
__dosmaperr.LIBCMT ref: 0079A5D6
GetLastError.KERNEL32(?,?,?,?), ref: 0079A610
__dosmaperr.LIBCMT ref: 0079A617

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 5faf71816b8eb0a1f78993b591137b503fa7b36af30c81d81a25f3edafb63c8d
Instruction ID: 56a195e59a300ec6c579c361c747b75165ff4df36a1fa2b55da61b5a4a794d8d
Opcode Fuzzy Hash: 5faf71816b8eb0a1f78993b591137b503fa7b36af30c81d81a25f3edafb63c8d
Instruction Fuzzy Hash: A121CFB1601206FFCF20AF65A88482BB7ADFF45360B118528FD16D7211DB79EC518BE2

Function 0079AD55 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73eb59541dd7fbdc73a9865acd79ddb990945ede0c9254fb5bdcb0e7f831b81
Instruction ID: 4c94ab2f104c0d9c726760c54ba469163133f292b666ce2de4b6f75f3446b779
Opcode Fuzzy Hash: f73eb59541dd7fbdc73a9865acd79ddb990945ede0c9254fb5bdcb0e7f831b81
Instruction Fuzzy Hash: 4A21FD31206215BFCF20EF70FC8692B77ADAF813647208568F91597551DB39EC108BE2

Function 0079B945 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0079B94D

Part of subcall function 0079B857: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,007A0349,?,00000000,-00000008), ref: 0079B903

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0079B985
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0079B9A5

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 6cf7745908fe1abae1c7753e84ea38cdb19b212e7467eec7c831e6f151afc9cd
Instruction ID: 2816697b1f1f367c207334f88a2a64cce30229983955224d2108005da2d6e933
Opcode Fuzzy Hash: 6cf7745908fe1abae1c7753e84ea38cdb19b212e7467eec7c831e6f151afc9cd
Instruction Fuzzy Hash: CA11EDB2915619FFAF2127B6BDCEC6F6A6CCF863A43214124F60192101EF6DAD0081B5

Function 007A1578 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000), ref: 007A158F
GetLastError.KERNEL32(?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000,?,?,?,0079D9B0,?), ref: 007A159B

Part of subcall function 007A1561: CloseHandle.KERNEL32(FFFFFFFE,007A15AB,?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000,?,?), ref: 007A1571

___initconout.LIBCMT ref: 007A15AB

Part of subcall function 007A1523: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,007A1552,007A0A1A,?,?,0079D429,?,00000000,00000000,?), ref: 007A1536

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,007A0A2D,00000000,00000001,00000000,?,?,0079D429,?,00000000,00000000,?), ref: 007A15C0

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b081bce9885d9654ae913919ee989db31fe256d556df98cea49efb93a16e9389
Instruction ID: cf2972be63c6a8b79083ec1f3294d7de6e4616233386e0275975172fe4d8e75f
Opcode Fuzzy Hash: b081bce9885d9654ae913919ee989db31fe256d556df98cea49efb93a16e9389
Instruction Fuzzy Hash: 56F01C37800128BBCF222FD5DC0999A3FA6EBCA3A0F458150FA1985121C63A8920EBD5

Function 0040A8EB Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B7F9), ref: 0040A9CC

Part of subcall function 0040A7AD: _memset.LIBCMT ref: 0040A7EA
Part of subcall function 0040A7AD: _memmove.LIBCMT ref: 0040A890

Strings

passwords.txt, xrefs: 0040AB5E
pe, xrefs: 0040A906

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memmove_memset
String ID: passwords.txt$pe
API String ID: 3555123492-1761351166
Opcode ID: 4ba74c0300faaac9d0ac9caf8617aa34d22e2591a994222f18aa993d6959168e
Instruction ID: e27997f465d681115f0956e8b9e535e529e63f10c620eade899f7ec572e64d44
Opcode Fuzzy Hash: 4ba74c0300faaac9d0ac9caf8617aa34d22e2591a994222f18aa993d6959168e
Instruction Fuzzy Hash: B3719D32501205ABCF15EFA1ED49D9E3BBAEF49306F001025FA01A31B1CB7A5A45DB6A

Function 0041584D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415885
_memset.LIBCMT ref: 00415896

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7

Strings

\A, xrefs: 0041586C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: _memset$CreateFile
String ID: \A
API String ID: 3749192340-4091869122
Opcode ID: 92c9d1e8c653f4c91b8bcd950fdf23dbef18e9cc29ec4074dc18328cbb963d67
Instruction ID: fda69334fbf686bf2d72d9e1e21117a25ea659b8b9295d412ef9a82b36a1cbfc
Opcode Fuzzy Hash: 92c9d1e8c653f4c91b8bcd950fdf23dbef18e9cc29ec4074dc18328cbb963d67
Instruction Fuzzy Hash: 9C715EB1C4022D9BDF20DF20DC45BCA77BAAF88314F0405E6E908E3250EA769BA58F55

Function 00401AB8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7

Part of subcall function 00416ED9: CreateThread.KERNEL32(00000000,00000000,00416E08,?,00000000,00000000), ref: 00416F78
Part of subcall function 00416ED9: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00416F80

Strings

.keys, xrefs: 00401B0D
\Monero\wallet.keys, xrefs: 00401B2F

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Create$FileObjectSingleThreadWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 548113856-3586502688
Opcode ID: af912836c80b8334a84c6b9d02feddd2ff0022e8962dea24ecfdb5788751a9a6
Instruction ID: 6f92dde0959b71e6213efb4dedd1dcdc38b1d1e79667daa33b59108eaaa6e09e
Opcode Fuzzy Hash: af912836c80b8334a84c6b9d02feddd2ff0022e8962dea24ecfdb5788751a9a6
Instruction Fuzzy Hash: B0510AB1E4012D9BCB21EB25DD466DD7779AF04308F4050BAA608B3192DA78AFC98F48

Function 00413A02 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413A33
strtok_s.MSVCRT ref: 00413B74

Strings

block, xrefs: 00413A0B

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: block
API String ID: 3330995566-2199623458
Opcode ID: 0cd00ea6f70d51830dcd949b582bedc8c9d369e319273a4f00376522836f950e
Instruction ID: d59fb6db9598feace06db38a85abc02bf4668801575a1cba740998495c8bbee7
Opcode Fuzzy Hash: 0cd00ea6f70d51830dcd949b582bedc8c9d369e319273a4f00376522836f950e
Instruction Fuzzy Hash: 6A4162F0E44306BBEF449F75DC49E9A7B6CFB14B07F205066E402D2192E739A6819B5C

Function 00412C30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285

_memset.LIBCMT ref: 00412D1F
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436718), ref: 00412D71

Strings

.exe, xrefs: 00412C7C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: AllocateCreateHeapProcess_memset
String ID: .exe
API String ID: 4288379676-4119554291
Opcode ID: 3f79d96ebe65ce9f60bf98a9ec1060deacb7e9440d6982d4f53f255cd694c0c6
Instruction ID: 1cbdd74ce5e2f54995cc1b0461791f526a41f78417fceba462659711e758d906
Opcode Fuzzy Hash: 3f79d96ebe65ce9f60bf98a9ec1060deacb7e9440d6982d4f53f255cd694c0c6
Instruction Fuzzy Hash: 1C416572A001197BDB11FBA6ED46ACE7774AF44348F110077F600B7191DAB86E8A8B99

Function 00794202 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00794227

Strings

MOC, xrefs: 00794239
RCC, xrefs: 00794241

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 25ef3ef6db8584a69b31dff201e5d79d727998065986241c31299e46a0d23d0b
Instruction ID: 94e9503364b36f0ca013b483a7f3eaeacde0ddf7aa49313762f663cccfb3d961
Opcode Fuzzy Hash: 25ef3ef6db8584a69b31dff201e5d79d727998065986241c31299e46a0d23d0b
Instruction Fuzzy Hash: 74415771900209EFCF16DFA4E981EEEBBB5FF48304F158199F914A7221D3399A51DB90

Function 00413299 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004132B8
strtok_s.MSVCRT ref: 004133B1

Strings

!xA, xrefs: 004132AB, 004132AE

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: !xA
API String ID: 3330995566-552826685
Opcode ID: e22b9a80b889634fb84a1a602b9536d33de6bd553385c31e20c0b465d2548ce6
Instruction ID: 3fe8997732ba686d3a560fed94bb41f929e857440078fb9370e0589d3031cea3
Opcode Fuzzy Hash: e22b9a80b889634fb84a1a602b9536d33de6bd553385c31e20c0b465d2548ce6
Instruction Fuzzy Hash: D3319671E00209AFCB15CF64CC85BAAB7A8AB18717F11505BEC16DB191DB38CB859B4C

Function 00413518 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413537
strtok_s.MSVCRT ref: 004135C9

Strings

!yA, xrefs: 00413529, 0041352C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: !yA
API String ID: 3330995566-971523708
Opcode ID: b762d46454894bb02d857de4279976665da993c44a40d47f4e48ba8b97d39194
Instruction ID: 8daaa68a4849a336b57da01ae9ccec3ff93276654c479072e654c29869aa4826
Opcode Fuzzy Hash: b762d46454894bb02d857de4279976665da993c44a40d47f4e48ba8b97d39194
Instruction Fuzzy Hash: 9E21B571900509FBCB14DF54C881ADAB7AEFF08706F10909BE805EB245E774DB958B98

Function 004133D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004133EF
strtok_s.MSVCRT ref: 00413464

Strings

dxA, xrefs: 004133E1, 004133E4

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: dxA
API String ID: 3330995566-1453471766
Opcode ID: b202c6e826b63aed6aafe9f09b9d2ed0cf3ef15fd7c1ef6828ed005ff2ae795d
Instruction ID: 6dbdc327abe0b7bdd62296a97cc44212dd7b8b5fcf646ffcf01bf3631009289d
Opcode Fuzzy Hash: b202c6e826b63aed6aafe9f09b9d2ed0cf3ef15fd7c1ef6828ed005ff2ae795d
Instruction Fuzzy Hash: EE117F71D00205BBDB01DF54C945BDAB7BCAF1430AF118067E805EB192EB78DB888B99

Function 0040F068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0AB
_memmove.LIBCMT ref: 0040F0D9

Strings

string too long, xrefs: 0040F0A6

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 9ab7ffb0b2f326456677b1f79b79f2c098f1a111591ca759752f296dba124a34
Instruction ID: 16e103bfe31d37185bf5c7de33bb9638cae5392d9fcef40893c2fcaba1ae33d0
Opcode Fuzzy Hash: 9ab7ffb0b2f326456677b1f79b79f2c098f1a111591ca759752f296dba124a34
Instruction Fuzzy Hash: 4E11E371300201ABDB349F2DD840A26B36AEF85314754013BF811A7FC3D77AEC59C2AA

Function 0041347F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004134A5
strtok_s.MSVCRT ref: 00413500

Strings

wA, xrefs: 00413497, 0041349A

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: wA
API String ID: 3330995566-2241071787
Opcode ID: 03c9d05ba65a6471ac5d7dd26cdd6ef2a9fe879898745d5af2ce2928e3329650
Instruction ID: dd06b3abd3b646703b1e960a5a46f236944b89903e4829c3616115ef650a42d7
Opcode Fuzzy Hash: 03c9d05ba65a6471ac5d7dd26cdd6ef2a9fe879898745d5af2ce2928e3329650
Instruction Fuzzy Hash: 24115B32904009BBCB01DF98D981EDAB7BCEB18315F144066ED09A7281E738FF898B94

Function 0040F0FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F113

Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECAA
Part of subcall function 0042EC95: __CxxThrowException@8.LIBCMT ref: 0042ECBF
Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECD0

Part of subcall function 0040F20D: std::_Xinvalid_argument.LIBCPMT ref: 0040F217

_memmove.LIBCMT ref: 0040F165

Strings

invalid string position, xrefs: 0040F10E

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 830cd19bc87ebd4e9a428bdd184161be238bb4b90864cf033e6eb64a8d59b0ac
Instruction ID: 0f2a2e5d1042d6142e24e23fb3187576949ae71e1aabcf4daa3e713127503f5f
Opcode Fuzzy Hash: 830cd19bc87ebd4e9a428bdd184161be238bb4b90864cf033e6eb64a8d59b0ac
Instruction Fuzzy Hash: 1511E531700210DBCB24AE6DEC8095A73A5AF19364744053BF819AFBC2C378EC4887D9

Function 0040F322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F331

Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECAA
Part of subcall function 0042EC95: __CxxThrowException@8.LIBCMT ref: 0042ECBF
Part of subcall function 0042EC95: std::exception::exception.LIBCMT ref: 0042ECD0

memmove.MSVCRT(0040EE93,0040EE93,C6C68B00,0040EE93,0040EE93,0040F134,?,?,?,0040F1B4,?,?,?,76230440,?,-00000001), ref: 0040F367

Strings

invalid string position, xrefs: 0040F32C

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 389f0c4840b7d1541f829097ee8e6f8f304199d2df2ed63ef39a589171cd9ddd
Instruction ID: cdd25209bcd68f1a3d16c884ec3f7ab82b6f6a003171765248ebeed3a1be3c3e
Opcode Fuzzy Hash: 389f0c4840b7d1541f829097ee8e6f8f304199d2df2ed63ef39a589171cd9ddd
Instruction Fuzzy Hash: 5E01A2313007018BD7349E79898452AB2A2E785B21764093ED882D7B85D77CEC4F8398

Function 0042821D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 0042822E
__invoke_watson.LIBCMT ref: 00428282

Part of subcall function 004280BD: _strcat_s.LIBCMT ref: 004280DC

Strings

,NC, xrefs: 0042826D

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction ID: 887ac42e1f57a759d752bdf1b5693751cd5b436693fdf8cbc82bc90985ef9ef6
Opcode Fuzzy Hash: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction Fuzzy Hash: 48F046B2641228BBCF112EA1DC02EDB3F6DEF40310F8480ABFA080A012D736ED14C7A4

Function 0041247D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412487
CloseHandle.KERNEL32(00000000), ref: 004124F6

Strings

steam.exe, xrefs: 0041248C, 004124D5

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: CloseH_prolog3_catch_Handle
String ID: steam.exe
API String ID: 860495366-2826358650
Opcode ID: 1f1d547a7b855ff9034f6da7222f6d51af6dd329fee223ce5cabf189c78c11ae
Instruction ID: cf4753bf5f8f3a473b35f1a87767389bf5426fe253dbbe0f85a1726b48fb5a1b
Opcode Fuzzy Hash: 1f1d547a7b855ff9034f6da7222f6d51af6dd329fee223ce5cabf189c78c11ae
Instruction Fuzzy Hash: 50011E70A002289BDB60DF64DD44BDE77B8AB08301F8401A6A409E22A0DB789F918B55

Function 0040EF87 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040EF9C

Part of subcall function 0042EC48: std::exception::exception.LIBCMT ref: 0042EC5D
Part of subcall function 0042EC48: __CxxThrowException@8.LIBCMT ref: 0042EC72
Part of subcall function 0042EC48: std::exception::exception.LIBCMT ref: 0042EC83

Strings

string too long, xrefs: 0040EF97
a@, xrefs: 0040EFBF

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: a@$string too long
API String ID: 1823113695-2520057392
Opcode ID: d7edcf562317307c36e651cb406e568009eb5bdc608ba4bb1eee05260a702fdd
Instruction ID: 636e3eac73b0fad8778dd92469e3ad4607b5323e4d3f1a542e8950d6790ab08e
Opcode Fuzzy Hash: d7edcf562317307c36e651cb406e568009eb5bdc608ba4bb1eee05260a702fdd
Instruction Fuzzy Hash: 25F0F031308242ABC704AF2E8841910FBA6BF513207080A7AF452AB7D2C779E870C3DA

Function 0041F409 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F43E
DName::DName.LIBCMT ref: 0041F44A

Strings

{flat}, xrefs: 0041F439

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: f0e67f0bd425649b1243776bf99fc72a1a75bb9619be83989c24d2c9795622b6
Instruction ID: 860f8910574c7f5b93a329a82e866fcf87d70aea3f1f23aa4500cbc6c74e443d
Opcode Fuzzy Hash: f0e67f0bd425649b1243776bf99fc72a1a75bb9619be83989c24d2c9795622b6
Instruction Fuzzy Hash: 6CF085312402089FCB10AF58D805AE63BA1AF8575AF088096F94C0F296C624D8C3CB9A

Function 007983D3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00798413

Strings

:!y, xrefs: 00798403
InitializeCriticalSectionEx, xrefs: 007983E3

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: :!y$InitializeCriticalSectionEx
API String ID: 2593887523-1094532196
Opcode ID: a58efc6c67c84928a3d2a3dc6b8002a2f87b318b7f0d656486a1c34be2c5f705
Instruction ID: 9b3992deb32c2bcaf64feaf8547ba1dffca28372ecf0f7499c8caf640c6f5f94
Opcode Fuzzy Hash: a58efc6c67c84928a3d2a3dc6b8002a2f87b318b7f0d656486a1c34be2c5f705
Instruction Fuzzy Hash: AEE06D36581258B7CF111F51EC09E9A3F22EBD2760B108110F91815160CBBA89619AD5

Function 007982D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00798308

Strings

:!y, xrefs: 007982FE
FlsAlloc, xrefs: 007982E4

Memory Dump Source

Source File: 00000002.00000002.2447332766.0000000000791000.00000020.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: true

Associated: 00000002.00000002.2447316780.0000000000790000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447356615.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447378391.00000000007AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447419333.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2447437565.0000000000810000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_790000_Unlock_Tool_2.jbxd

Similarity

API ID: Alloc
String ID: :!y$FlsAlloc
API String ID: 2773662609-1522199544
Opcode ID: 3b11d54e125d365b1f617d2544feaab8d8b4990e26cadf6cf60a6c942917ef68
Instruction ID: b19d515d601bd7b9cc50be6c4e065945c10684fda98ea1284fee560b9df38869
Opcode Fuzzy Hash: 3b11d54e125d365b1f617d2544feaab8d8b4990e26cadf6cf60a6c942917ef68
Instruction Fuzzy Hash: E3E0C232AC1228B78A1027A0EC0E99EBA56DBD3F62B414121FA1452150DEEE495192EA

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000002.00000002.2446832574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Unlock_Tool_2.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: 53f8373e70c9b3f2ad4edb26b660f9fb934cc4b7cfd11dbf86275af389dbaa33
Instruction ID: 3f45e969e00d53325eeeeb0d61c2f771aa6840bd7d13b4847dbbb2bfcabd8c63
Opcode Fuzzy Hash: 53f8373e70c9b3f2ad4edb26b660f9fb934cc4b7cfd11dbf86275af389dbaa33
Instruction Fuzzy Hash: 0AE0B8F1D0020C9BDB14DFA5E946B5D77F89B08708F5000299A05F7181D674BA098659

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Unlock_Tool_2.3.1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Unlock_Tool_2.3._2aeb643dce4cdcbeeaaa9deab94801d87eb2245_2e620264_e4511507-1d45-44dd-b311-3e06606d6c77\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER813B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8320.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83DD.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199786602107[1].htm

C:\Users\user\AppData\Local\Temp\delays.tmp

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Windows Analysis Report
Unlock_Tool_2.3.1.exe

Function 00791659 Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMON

Function 007A01A4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 0079841E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Function 0079B4D1 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 0079B0D5 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre