Edit tour

Windows Analysis Report
7GXKafhbnD.exe

Overview

General Information

Sample name:	7GXKafhbnD.exe renamed because original name is a hash value
Original sample name:	5ef4cf46165c932ee117830e7cd38ccf.exe
Analysis ID:	1417461
MD5:	5ef4cf46165c932ee117830e7cd38ccf
SHA1:	d45fc4a83fcd2a1fec421d55635d51bf02646d37
SHA256:	3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7
Tags:	32exetrojan
Infos:

Detection

GCleaner

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected GCleaner

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64

7GXKafhbnD.exe (PID: 7392 cmdline: "C:\Users\user\Desktop\7GXKafhbnD.exe" MD5: 5EF4CF46165C932EE117830E7CD38CCF)

WerFault.exe (PID: 7472 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 740 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7540 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 732 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7620 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 744 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7680 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 776 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7736 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 996 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7796 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1016 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1084 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7920 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1368 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 7952 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "7GXKafhbnD.exe" /f & erase "C:\Users\user\Desktop\7GXKafhbnD.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8024 cmdline: taskkill /im "7GXKafhbnD.exe" /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

WerFault.exe (PID: 8032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1324 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
GCleaner		No Attribution	https://bazaar.abuse.ch/browse/signature/GCleaner/ https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 https://n1ght-w0lf.github.io/malware%20analysis/gcleaner-loader/ https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1780373665.000000000079F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10e8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1601096964.0000000000710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89

Unpacked PEs

Source	Rule	Description	Author
0.3.7GXKafhbnD.exe.710000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.7GXKafhbnD.exe.6e0e67.1.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.7GXKafhbnD.exe.6e0e67.1.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.7GXKafhbnD.exe.400000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.3.7GXKafhbnD.exe.710000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.7GXKafhbnD.exe.400000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 185.172.128.90

Timestamp:	03/29/24-11:16:56.193727
SID:	2856233
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: GET /cpa/ping.php?substr=one&s=two HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache

Source: 7GXKafhbnD.exe, 00000000.00000002.1780390439.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=one&s=two
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1780373665.000000000079F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00404610	0_2_00404610
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00409810	0_2_00409810
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00413C09	0_2_00413C09
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00413414	0_2_00413414
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00421D88	0_2_00421D88
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E4877	0_2_006E4877
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E9A77	0_2_006E9A77
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006F367B	0_2_006F367B

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: String function: 006E8C77 appears 37 times
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: String function: 00408A10 appears 38 times

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 740

Source: 7GXKafhbnD.exe, 00000000.00000002.1780731049.0000000002EB6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCmd.Exej% vs 7GXKafhbnD.exe

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: 7GXKafhbnD.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1780373665.000000000079F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/38@0/1

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Code function: 0_2_007A0116 CreateToolhelp32Snapshot,Module32First,

0_2_007A0116

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7392
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7960:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\f9b97b69-312e-4336-b9c5-b6d6e79c0fd4

Jump to behavior

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Command line argument: `a}{	0_2_00404610
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Command line argument: >p@	0_2_00404610
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Command line argument: 6p@	0_2_00404610
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Command line argument: `a}{	0_2_006E4877
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Command line argument: 4zB	0_2_006E4877
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Command line argument: yB	0_2_006E4877
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Command line argument: lyB	0_2_006E4877

Source: 7GXKafhbnD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "7GXKafhbnD.exe")

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7GXKafhbnD.exe

Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\7GXKafhbnD.exe "C:\Users\user\Desktop\7GXKafhbnD.exe"
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 740
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 732
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 744
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 776
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 996
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1016
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1084
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1368
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "7GXKafhbnD.exe" /f & erase "C:\Users\user\Desktop\7GXKafhbnD.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "7GXKafhbnD.exe" /f
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1324
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "7GXKafhbnD.exe" /f & erase "C:\Users\user\Desktop\7GXKafhbnD.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "7GXKafhbnD.exe" /f

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Unpacked PE file: 0.2.7GXKafhbnD.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Unpacked PE file: 0.2.7GXKafhbnD.exe.400000.0.unpack

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_0040852E push ecx; ret	0_2_00408541
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_0040FFFA push es; ret	0_2_0040FFFB
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006F41CF push esp; retf	0_2_006F41D7
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006F0261 push es; ret	0_2_006F0262
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006FC674 push edi; retf	0_2_006FC678
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006FC6C5 push es; retf	0_2_006FC6C9
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006F47CD push esp; retf	0_2_006F47CE
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E8795 push ecx; ret	0_2_006E87A8
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A2808 push 4AE86760h; ret	0_2_007A280E
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_0079F0EC push eax; retn 0079h	0_2_0079F0ED
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A312E push eax; iretd	0_2_007A3137
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A318E pushad ; ret	0_2_007A3192
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_0079F21C push eax; retf 0079h	0_2_0079F21D
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A22F8 push ecx; ret	0_2_007A22F9
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A2325 push 00000000h; ret	0_2_007A2333
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A4EF9 push ecx; ret	0_2_007A4EF8
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A4EB0 push ecx; ret	0_2_007A4EF8
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A0E9E pushad ; retf	0_2_007A0EB5
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_007A4E95 push ecx; ret	0_2_007A4EF8

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

API coverage: 8.4 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 7GXKafhbnD.exe, 00000000.00000002.1780731049.0000000002EA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 7GXKafhbnD.exe, 00000000.00000002.1780731049.0000000002EA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: 7GXKafhbnD.exe, 00000000.00000002.1780390439.0000000000854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@g
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Code function: 0_2_00405C50 std::_Lockit::_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,LdrInitializeThunk,std::_Facet_Register,std::_Lockit::~_Lockit,Concurrency::cancel_current_task,

0_2_00405C50

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Code function: 0_2_0040C12B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0040C12B

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00411142 mov eax, dword ptr fs:[00000030h]	0_2_00411142
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_0040C631 mov eax, dword ptr fs:[00000030h]	0_2_0040C631
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006EC898 mov eax, dword ptr fs:[00000030h]	0_2_006EC898
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E092B mov eax, dword ptr fs:[00000030h]	0_2_006E092B
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006F13A9 mov eax, dword ptr fs:[00000030h]	0_2_006F13A9
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E0D90 mov eax, dword ptr fs:[00000030h]	0_2_006E0D90
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_0079F9F3 push dword ptr fs:[00000030h]	0_2_0079F9F3

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Code function: 0_2_00416A3F GetProcessHeap,

0_2_00416A3F

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_0040C12B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040C12B
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00407C46 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00407C46
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_00408625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00408625
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_004087B9 SetUnhandledExceptionFilter,	0_2_004087B9
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E888C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006E888C
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E8A20 SetUnhandledExceptionFilter,	0_2_006E8A20
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006EC392 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006EC392
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: 0_2_006E7EAD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006E7EAD

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "7GXKafhbnD.exe" /f & erase "C:\Users\user\Desktop\7GXKafhbnD.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "7GXKafhbnD.exe" /f

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "7GXKafhbnD.exe" /f

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Code function: 0_2_00408823 cpuid

0_2_00408823

Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_004188F2
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_0041893D
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_004189D8
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_00411252
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418A63
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,	0_2_00418CB6
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00418DDC
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,	0_2_00418EE2
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,	0_2_00411774
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418FB1
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_006F9043
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,	0_2_006F9149
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,	0_2_006F19DB
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_006F9218
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_006F8B59
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_006F8BA4
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_006F8C3F
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_006F8CCA
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: EnumSystemLocalesW,	0_2_006F14B9
Source: C:\Users\user\Desktop\7GXKafhbnD.exe	Code function: GetLocaleInfoW,	0_2_006F8F1D

Source: C:\Users\user\Desktop\7GXKafhbnD.exe

Code function: 0_2_0040C9D1 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0040C9D1

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected GCleaner

Source: Yara match	File source: 0.3.7GXKafhbnD.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.6e0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7GXKafhbnD.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1601096964.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected GCleaner

Source: Yara match	File source: 0.3.7GXKafhbnD.exe.710000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.6e0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.6e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7GXKafhbnD.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7GXKafhbnD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1601096964.0000000000710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7GXKafhbnD.exe	42%	Virustotal		Browse
7GXKafhbnD.exe	100%	Avira	HEUR/AGEN.1316639
7GXKafhbnD.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.172.128.90/cpa/ping.php?substr=one&s=two	100%	Avira URL Cloud	malware
http://185.172.128.90/cpa/ping.php?substr=one&s=two	25%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.90/cpa/ping.php?substr=one&s=two	true	25%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417461
Start date and time:	2024-03-29 11:16:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7GXKafhbnD.exe renamed because original name is a hash value
Original Sample Name:	5ef4cf46165c932ee117830e7cd38ccf.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/38@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 15 Number of non-executed functions: 121
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:17:08	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.90	E2PuGKXg4o.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	mxsujj4FZz.exe	Get hash	malicious	GCleaner, RedLine	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	z5uPcOrP22.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=five&s=ab&sub=0
	a5P4EuInKl.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	Wz9s7ibPaf.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	JtBBqKs53G.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	G2dlg4qN4w.exe	Get hash	malicious	Glupteba	Browse	185.172.128.90/cpa/ping.php?substr=four&s=ab&sub=0
	xYre854h9s.exe	Get hash	malicious	Unknown	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
	VUPIfDyOZF.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=six&s=ab&sub=0
	file.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	l2ZKczbGRq.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	E2PuGKXg4o.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	mxsujj4FZz.exe	Get hash	malicious	GCleaner, RedLine	Browse	185.172.128.90
	z5uPcOrP22.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.209
	uQeIMs91Vh.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	oKum4jX2X3.exe	Get hash	malicious	GCleaner, Nymaim	Browse	185.172.128.90
	oKum4jX2X3.exe	Get hash	malicious	GCleaner, Nymaim	Browse	185.172.128.90
	a5P4EuInKl.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	Wz9s7ibPaf.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.172.128.26

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_0aead8bd-3d69-471e-88d4-9d281264b63e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8800631974519376
Encrypted:	false
SSDEEP:	96:PiMsZsxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9WEADKVL:AZs056rojhczuiF6Z24IO8q
MD5:	0298412F1B342699D1645E13FFA81CF9
SHA1:	6FA28B11D30139DBB0FD49B1143AF9F638F91D26
SHA-256:	5160FC6325B3C283880E702D0301EE917F557C6A050190445AC1F75695A6F41D
SHA-512:	D754290863ADF729C14F82C3D578B0D8942D9F5A5007AA8D130FCE8A1E9A651311E053EFF3C678AB3E994DAB7CF30D7C2EB96DCD209433D10C34270D55C97D02
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.5.0.8.0.7.9.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.a.e.a.d.8.b.d.-.3.d.6.9.-.4.7.1.e.-.8.8.d.4.-.9.d.2.8.1.2.6.4.b.6.3.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.e.1.a.6.4.3.8.-.0.a.9.3.-.4.b.b.9.-.8.4.0.8.-.6.b.e.5.9.d.f.b.c.d.2.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_2071ee8d-b7b5-4580-802a-4d51b6c53b0d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8371838702982257
Encrypted:	false
SSDEEP:	96:RCsKsxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9WEADKVhL:JKs056rojh6zuiF6Z24IO8q
MD5:	BD75434DC71BEC8E0BE44FD829A3DB79
SHA1:	6C7F4EEB0428EEC7636ED085692DD5F28757ED09
SHA-256:	8356370F0B5908F1FD0B651EFF4EF6A23C7D41D1D4F7B74E5CDC7A8AF950F10A
SHA-512:	AFFF5916769B78B1C05FFEE84B237360BE41CCE09E34403197C78EBB3AB82D0262C4BB69ADEFDF04DF91B3437E80F7E65FA1C464B54B44C6F7EFEE1CA7326827
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.1.2.1.2.8.0.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.0.7.1.e.e.8.d.-.b.7.b.5.-.4.5.8.0.-.8.0.2.a.-.4.d.5.1.b.6.c.5.3.b.0.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.7.b.a.d.8.f.-.8.b.4.1.-.4.b.f.5.-.a.f.3.b.-.2.f.0.9.d.5.c.f.9.a.6.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_31a3bfa8-276c-45f5-900e-ff34cdff71dc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8370442095000293
Encrypted:	false
SSDEEP:	96:SRNFs1sxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9WEADKf:sc1s056rojh6zuiF6Z24IO8q
MD5:	A70794080D0E244D47B2BC70D28BCECF
SHA1:	E4C21FECA73A09A6E5F6B16A12DBDC5CC74EBF54
SHA-256:	FE6AD80AC8B6B077D0CA0B2FBBD4891883F4DA771AA379C40E43025D3E70DF0D
SHA-512:	3A4216BC6EBEE29B97F211A39938BCD793C617726F6CF1840E4699EB4E9BBE5376E63B518EDE58B29F523D85EF271A831A5E8B5049F9A9CF72D37375B3208BFD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.2.7.2.0.6.2.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.a.3.b.f.a.8.-.2.7.6.c.-.4.5.f.5.-.9.0.0.e.-.f.f.3.4.c.d.f.f.7.1.d.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.8.e.3.5.6.e.-.f.c.2.5.-.4.9.c.e.-.9.7.9.5.-.4.8.b.f.0.b.d.1.f.8.b.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_5c5ac96f-d7e2-4949-80e3-2909ce5346b1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9344790159119628
Encrypted:	false
SSDEEP:	96:rvmspsxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9WEADKVd:/ps056rojhE7zuiF6Z24IO8q
MD5:	3F36F4FD14D4786DA7EA7DC7E4951E98
SHA1:	B6FB82E5CEFEA5CD938CCFD5A9148250275592D9
SHA-256:	5FF937037C009A8273DCE58832C7C0A298986DA4D360E08D2415861908498A07
SHA-512:	B378AE63F7A7FD756DAC8CD53DB1151CD9BE12EE6E954034BAA04FDE73C6C815AC111C26C3BC3ED0968721E312B4E51543F7023B910C0FAC500ADB23D2504627
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.7.5.5.7.1.4.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.5.a.c.9.6.f.-.d.7.e.2.-.4.9.4.9.-.8.0.e.3.-.2.9.0.9.c.e.5.3.4.6.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.f.0.3.6.3.c.-.5.6.a.a.-.4.1.a.b.-.b.a.b.6.-.2.5.e.4.5.8.5.0.7.2.4.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_7f753e3f-3102-41ca-ade0-19e5c0e39648\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8593283098330304
Encrypted:	false
SSDEEP:	96:assGsxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9WEADKVh3:QGs056rojhGzuiF6Z24IO8q
MD5:	4055EA2D808C960D0D7FC7D9723490EA
SHA1:	9C0321E30DC2719432D76E2E3F0921152B633BC9
SHA-256:	D30F88399EA07E647402C2721CA2B2B5AE8AD238F0B27C78D3B7D6C1434FE0B6
SHA-512:	1C36BCF1996FF665E747B77BD044B542807D56AAC6214F5F2AF0E42B49E94C76AC7930619C306815360308603301790D3D50238F7781C96DC9E6F1AD9CE36A12
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.4.4.7.8.7.6.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.7.5.3.e.3.f.-.3.1.0.2.-.4.1.c.a.-.a.d.e.0.-.1.9.e.5.c.0.e.3.9.6.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.8.1.0.4.e.b.d.-.d.c.1.b.-.4.6.f.6.-.9.e.9.1.-.a.a.6.e.8.5.1.c.7.7.e.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_807cc0ca-2485-4f33-9f4a-dfce8bfb587c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8370483785105234
Encrypted:	false
SSDEEP:	96:zqrDAyPsYYsxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9W6:OABPs056rojh6zuiF6Z24IO8q
MD5:	56FF819AA07A872363676230D59F5EAC
SHA1:	6FABD19C2CC11BD222F1D192A886EA9DAB380FA3
SHA-256:	2F434DFDA9AAB87B6AE389A140246E95BB33899A8430DAEB8672838BACB7D396
SHA-512:	4F91BC73651196BB22A238AC1EAB9DB0A8E30C0E025F95CF23E3D4756241F7384C55F63B363AE9A58B15639A5C407CF372A1E87C8CC34FC0374BFDA0504DFB32
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.1.9.3.4.6.7.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.7.c.c.0.c.a.-.2.4.8.5.-.4.f.3.3.-.9.f.4.a.-.d.f.c.e.8.b.f.b.5.8.7.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.1.0.2.7.c.1.3.-.1.a.0.e.-.4.8.b.f.-.9.3.1.c.-.d.5.9.5.b.6.1.a.6.1.1.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_92628ab3-bdbe-4a55-ae04-f985aafaaeec\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.852584714889518
Encrypted:	false
SSDEEP:	96:J0susrsxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9WEADK1:lrs056rojhwzuiF6Z24IO8q
MD5:	FAA3B1E010A8CF8E4F9204DB585578C9
SHA1:	36AAB37D3C41369EAF9011C6EC17D38C472C114A
SHA-256:	D64A098DE8CE6460E37716A061B551E4D810662BE79B36B9647F049BD4954AA8
SHA-512:	765CB4BDE9C8194E8A046EE8AC67B625D86F50969E9527FABC87FCF13057D764DC860E59CF8AE8326B7AB015B38B60A6A77F6210888E20EA5306EAD0197C5E40
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.3.8.4.4.0.0.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.6.2.8.a.b.3.-.b.d.b.e.-.4.a.5.5.-.a.e.0.4.-.f.9.8.5.a.a.f.a.a.e.e.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.5.4.d.3.d.0.1.-.0.8.a.8.-.4.1.2.9.-.a.0.3.b.-.9.4.b.0.1.9.5.8.2.0.e.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_c878b971-1e7f-4be1-90e3-8a1ccd8f2f2c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8371282400660914
Encrypted:	false
SSDEEP:	96:xmgxNshsxhDoA7RT6tQXIDcQnc6rCcEhcw3rT+HbHg/8BRTf32rLWIOy4H9WEADC:sgxehs056rojh6zuiF6Z24IO8q
MD5:	12583B86E629565F252C7FE3E3B4CA87
SHA1:	5E9C6C14D9DF3359D0C9EDF3CDEAC6806CFA4874
SHA-256:	76B2106F92D57CAE89D9A4E869472EE6CB1763FFC253EB8AE3A72569390E05C5
SHA-512:	5D8BAE67553CFCE9365874EF1962D1D9C6E766FF33FBDC1E33267D4D19F675EA62AF348562DA34676B63A24ECE02E3E0F2E6927B50C178D364DDFB5DE0E9AF51
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.3.2.5.3.4.8.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.7.8.b.9.7.1.-.1.e.7.f.-.4.b.e.1.-.9.0.e.3.-.8.a.1.c.c.d.8.f.2.f.2.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.9.2.7.1.a.6.-.b.9.c.9.-.4.a.d.c.-.b.3.9.4.-.9.9.7.9.3.e.f.f.f.c.7.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.2././.0.2.:.0.5.:.3.0.:.0.3.!.0.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_f059f8719164c84f855d378d9bb8bb5244bf721d_0465960d_2553eece-d477-4481-9dc0-ee4e029d95cd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9990182365205962
Encrypted:	false
SSDEEP:	96:+zB62sDsxhDj7efAQXIDcQSc6wQcEqcw3RP+HbHg/8BRTf32rLWIOy4H9WEADKV0:wBGDx0MUQAlUjhEYedzuiF6Z24IO8n
MD5:	454B22A50DD241D18B8DF66D38164DEB
SHA1:	723028A2D47B0DDA7C46F8B7F9608380E605D249
SHA-256:	FC359EF4E8D58C2123FAA218EB877E66E525E43A4C3489EEAE1E636193537285
SHA-512:	298E1D05E2432E2F3022B1302C2FCAFD2C64E41CCE178102888B455A500C9ADA01F488B111C08C7C188E87C5005590994A09B1DE2C86875E213FBCF2D23F6B56
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.8.3.9.6.7.1.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.6.1.8.1.0.1.8.9.9.0.4.6.6.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.5.3.e.e.c.e.-.d.4.7.7.-.4.4.8.1.-.9.d.c.0.-.e.e.4.e.0.2.9.d.9.5.c.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.6.d.d.9.3.3.3.-.e.2.f.f.-.4.c.b.7.-.a.f.a.6.-.8.3.3.3.2.b.0.2.f.b.8.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.G.X.K.a.f.h.b.n.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.e.0.-.0.0.0.1.-.0.0.1.4.-.3.3.2.e.-.e.4.3.6.c.2.8.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.0.d.c.6.3.d.6.0.b.7.b.2.a.6.b.9.b.0.e.c.7.6.0.5.5.9.3.4.3.a.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.5.f.c.4.a.8.3.f.c.d.2.a.1.f.e.c.4.2.1.d.5.5.6.3.5.d.5.1.b.f.0.2.6.4.6.d.3.7.!.7.G.X.K.a.f.h.b.n.D...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1064.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60774
Entropy (8bit):	2.175656964678194
Encrypted:	false
SSDEEP:	192:9d+YYXZn+dH8O2o5oNffN52UassfRMRdCWe7Io0kRRWVYqwUvL/m5LcjGDT007fN:eDn+dHzz5IfvsZMCryVYq/vL/m5hD/3
MD5:	FB9C400630E3F370BEF0409096261C6B
SHA1:	E2C82B134393FA30B3AF4B38CE934431449BE67A
SHA-256:	DEC6B8E3D4FFFBB7EC31837EB4BF81BA68998B682CA799779EE715DA9404AE95
SHA-512:	7D107D74E86832F2A86D6C81AA6DAF31EF9C4F71DDFBAD8F77EF797EF25B302ED98EA12DF14A1FCC2110FF503957AC41F77108234C12740AC066C2DE94C22A14
Malicious:	false
Preview:	MDMP..a..... ..........f........................\...........$....-..........T.......8...........T...........................X...........D...............................................................................eJ..............GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11DC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.706166979910624
Encrypted:	false
SSDEEP:	192:R6l7wVeJaq6XgL6Y9cSUEdgmfW8pBRC89bPesf+AMlm:R6lXJX6Xc6Y2SUEdgmfW47Pdfr
MD5:	BF85E4ABEF0DF577F71AF55EA8C58806
SHA1:	E826366918D5412058E42B228C1D50801A3B9C1A
SHA-256:	8B6E6FF1FE07D032E41FC53AFF54BD36F93792A1058061540E6E34E0232CE8DB
SHA-512:	C99AD92822E2003974773DD052DC14736B9DE20E907BC8A00E442978454E313D449F7A9AB49D6A20864748645A366A063BA44E9EF72340FD3D90C04DC63F04FF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11FD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.488090684859657
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYTYm8M4JiJFF+q8vHBMN/Td:uIjf0I7vD7V7JCKh2/Td
MD5:	1A75E533B08E897A01304971CB771471
SHA1:	0B24BE45E319EB6F493EDD9D5E6A613995588C80
SHA-256:	55FF198E2F0F07DCDE7428EB3396DB6980E6A432EB4BF1204910140EADEB2C86
SHA-512:	C15F281741FEF29585D27D86FAFBA1AD2B2B12A1EF36C0F9F064BF533F51A840B6BD7CBFC736E4F98736EB9755D889EB07CC93F1E27838E0729CD623B2DD4AEC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1381.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	70446
Entropy (8bit):	1.9294194592958627
Encrypted:	false
SSDEEP:	192:9+03xQXdeSH7gLO2oL3oNsU2St0s8I6zdsFTzWB7qNUvL/m5LcjrBQm4aI40Zu9H:Q0MeSH7gSzrbNsS8CqqvL/m5oBup/Kv
MD5:	98AC8438D37A5EBCAFC9518AF5416CAE
SHA1:	2753E4A92F64AEB2269A98849A363CBAE8152D5B
SHA-256:	8FF7DD23EA6FC5A52517D77E22FBA2C6A7B921013918DF86CD568A2107C39370
SHA-512:	5CD64A2610E98C762D2A91CA1607BA50E21F20B2DB5D361FB05E7D37F20AFEE82DEF66FDA613D7834775D24233A6D3B79687599BDEE7900832E80231AF787888
Malicious:	false
Preview:	MDMP..a..... ..........f............T...........\...\............3..........T.......8...........T...........(...........................................................................................................eJ......<.......GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13F0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.7048863562766914
Encrypted:	false
SSDEEP:	192:R6l7wVeJa165kK6Y9zSUZgrgmfW8pBa89bPesf1Dvlm:R6lXJo636YZSUZegmfWoPdf10
MD5:	8E492319A8D981666DB071F889B7858C
SHA1:	B1DD0E7650C85F48969B9C890D96B29C48A25F3E
SHA-256:	56CD6222F5E24F0BDD3CE6664922766C1A54F6B5DBB080518330AA497FC1CE69
SHA-512:	9EB6DD5ECE346A72D6F3D1C8A6678C2D653ABB33B757D1E254A84D94E5D126047C0A6802DFA811217482D37C8063099A309780AB3F3DA665C11FBFAF7092C41C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1400.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.489578977185828
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYVYm8M4JiJFq0P+q8vHBMN/Td:uIjf0I7vD7VtJD0PKh2/Td
MD5:	AB58FEC02DEA22FF13C379DA82381697
SHA1:	7DE1FB6C72A762BBDFACA0E6511B0CF0D25A2837
SHA-256:	A20A540605756621E45B0967C9ED7DF138C444C9B74374E41C1354FC31CF6AA5
SHA-512:	EB48B3143DCF0C01D5C63483E6ADAEB3444443FAD97C675DB36FBA4F4DBB101C7484493F5254CAB7A389170A46F8EE0F87FDA783F796FD8C4CA1029353A3B6A7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1585.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	70022
Entropy (8bit):	1.9450199532182377
Encrypted:	false
SSDEEP:	192:Q1H13xQXdeSHSO2oVuF6oNsU2nOqLqDDzWB7kiBusn5LNUvL/m5LcjMlDcprI2MK:yMeSHtzm6bheSkxs5LqvL/m5/lD+/T
MD5:	F9B343A91E2C5F30B26A3CB97F3238DD
SHA1:	0D170BF2CDDBD9D764D576DDF386255956B169C1
SHA-256:	B6F8371E59DD882C8AEFCF3F416D19065CF6C8586B4A481B71B3AC97720D272F
SHA-512:	DBAD81DFE3EA8C946CCA42C2C890BE1FDAF528605E871F0D7CAA1743DBAC4200239461CCDBC2F4D1F343B5DEA8D30C164CBFAD30CB247F8A29B501B29D563F73
Malicious:	false
Preview:	MDMP..a..... ..........f............T...........\...\.......$....3..........T.......8...........T...........(...^.......................................................................................................eJ......<.......GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1613.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.704987626043707
Encrypted:	false
SSDEEP:	192:R6l7wVeJaY65Z/6Y9ISUZgrgmfW8pBP89bGesfS0im:R6lXJV6H/6YiSUZegmfWbGdfSA
MD5:	8E6448EF806613C2BD8D6C5C9416D0A6
SHA1:	5EAC622276DE91C14CAC416F7944AAC334CAA665
SHA-256:	437443802A95631F280BC1D5759A7ADA8A7BB45109D6E9C364113B7167A39692
SHA-512:	0205EA7553CAB09729EAF86F05629C391007BBF476A0847333F08257F5FBDE10A39A5F77EF48F30FCBFF40D23DE523E4060B02C8AA86614C577CFDB2126D855E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1652.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.488676510021866
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYBYm8M4JiJFV+q8vHBMN/Td:uIjf0I7vD7VxJmKh2/Td
MD5:	2C601628A51E0BDD399D638E3E6760F6
SHA1:	89C6C2A3E09617FD9FC50A3B8F9D5D2F93422F08
SHA-256:	62B35C5AE9D2D1BB47DD54F176B97503665F88161B61F64847D49C69043D19C0
SHA-512:	33BFA6CB1676AEACCD5E8FB3912D60B727C6A4DDB7A3DDFF5E6689D554D3ACCDB104C8AF3736CB66E587AE6CDB1D1CC3B7B80BF7E7C9A736B825D536953290A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER17D7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	77066
Entropy (8bit):	1.9046326848213526
Encrypted:	false
SSDEEP:	384:Aiu7z4UzRbn+ss1FdXi/m5oaGXVAI8ltxE:0n4UzRb+FdXmoE
MD5:	ABBC31943B8F9AEF4BA5370C0AE28A09
SHA1:	1D7E1E8CAAA2AD8CF520A0395B46FC4772ED27ED
SHA-256:	31A0822C2BD22A9A64FC84CC61B371778BEFC4E3B9A5953BF513DA153D6077B0
SHA-512:	0CFD357515E4805EE8DC60CC9A4662F98E4CE81099C1AEF59D8489177A40082D1106AB03211A757692CBE2A409748052CA8B0C8DDB95F824DEAEB13D7C7FE7B1
Malicious:	false
Preview:	MDMP..a..... ..........f........................4...........D....7..........T.......8...........T............&..:.......................................................................................................eJ......D.......GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1835.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.7042223462408335
Encrypted:	false
SSDEEP:	192:R6l7wVeJaG6nc6Y9vSUZgrgmfW8pB089bGesfXim:R6lXJr6c6YVSUZegmfWaGdfj
MD5:	3787A250FE51557EB208CECD26CECBC2
SHA1:	328568588DC8F1E879F83CC7514B644CB6FF4E1D
SHA-256:	CA12105E49218081B1AA13ADF03E08B97FB4A7EC3D8CB3F385FE05924BA404D0
SHA-512:	A4225E1F2C45F4456F6C4E98217BB5E39552EDC7C294E02098B0730CFA94A006449A7E16E7226817850FA36DE9AC747AB5BDFF4B24E8E9AE2EA0A1BC1A8FEA8C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1856.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.487387999588773
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYaYm8M4JiJF8+q8vHBMN/Td:uIjf0I7vD7VeJXKh2/Td
MD5:	7F676A678C027EA075DE23734E95C7C0
SHA1:	0EF7DDEFA7541A45A1160742630BEADBA7F22911
SHA-256:	8C64D46B8EF3C9BB390E086840BC801F262F4135A3BA8D5431917917FB8F3235
SHA-512:	BDA4E4448C9BB51A1A64D328138CA8E44F184A4B338578D8A1DB8CB056770A97AD1439DB84B9B9FA54D5D4BBBFEE0505E50266C0C7FA8A98818198E86322A2AB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A57.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85160
Entropy (8bit):	1.9490286585420362
Encrypted:	false
SSDEEP:	384:a/Ef1z0hbcRsnV6IYkPOSptAXi/m5o0RaGOyvh:uy1z0hbcRzIYAO6+X6i
MD5:	222BCEA7498B50EF874116B0071376C2
SHA1:	2C34261782620A77F16BB0FFCE8298D3C57A4973
SHA-256:	F3F49BFDDF0C4CCF47C8E69822BC83B47DDAD71E7C1B80410B24A6BB0E0DB8A7
SHA-512:	F68CB4EC35F884F567AF19701D5D19850F2DA3393547A07943080905499ECF4E4B3D3216236580540677BD4903BF6890F05B07524FC29B4DC67C31AC17780BAC
Malicious:	false
Preview:	MDMP..a..... ..........f........................................8;..........T.......8...........T...........p'..8%..........\...........H...............................................................................eJ..............GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AC6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.702954776287513
Encrypted:	false
SSDEEP:	192:R6l7wVeJaM6Xyw6Y9bSUIgKgmfW8pBa89b5esfYzm:R6lXJh6D6YBSUIPgmfWo5dfR
MD5:	335A0893D20A0E10E9ECE3736FCFB8DD
SHA1:	D87F1937924A3B909245B6E786806B070429A1E9
SHA-256:	3D890A9953F1FA599C73E4E704378B8BABB4D058ED836AACE4769467FC13F915
SHA-512:	A263944F5BA740B080DBCE59A59F864CB403D8F914800B4A03333E9D1BA98B271372E3A6C8AA798B4EF8CC27D8419D8A7AE1B723D890981C1AC37A7D11ABD392
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AE6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.486931913687568
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYiYm8M4JiJF9j+q8vHBMN/Td:uIjf0I7vD7VWJyjKh2/Td
MD5:	2B8491DED40B57895B895D6B24809C6D
SHA1:	A2D909CB686C6EFF72D1A7A4A2520912129FF2FF
SHA-256:	DA126E98D9534F1CD0E6579609FEBC1606F7C25F69C35022A21218784F37075A
SHA-512:	40A7A0FA6B7F69763420BDF22D3F22CAEDE4AC1DFE6B21D0A6BBFFE59FB6FCB2D1CAFB407AD40972D27B918CCE5684DDFBE66733549936B1B1667D2D4658FF7F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CB9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	95508
Entropy (8bit):	1.9967945536656557
Encrypted:	false
SSDEEP:	384:HYmp/1dzVvBbc4idmKauvuJJp96EXi/m51szzEJ3rcLDXtXB3+HnOeUzj:42TzjbMdmKauv4JDJXX93v
MD5:	77581104E5F0C66E1A468B9FF2022BFC
SHA1:	20B607A045D6E5B4231AABF96D04DC8D93A22D6C
SHA-256:	91A4144A2AFD3C64FC501D039D21D831B62547B3FB8C1143D15D91790058CB3A
SHA-512:	D51C187ACFD548957CE49237A62D1544A131596C1C09FE7E2799C4434CC698D6D858A7214D2EE6055A2AA0E6873DF3E22EE51084AA18CF8E13F84F288A272C18
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................?..........T.......8...........T...........`-...G......................................................................................................eJ......T.......GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D75.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.704562602752272
Encrypted:	false
SSDEEP:	192:R6l7wVeJa66Ob06Y9evSUIgKgmfW8pBG89bwesfPwm:R6lXJn6x6YEvSUIPgmfWEwdf9
MD5:	E12E1B18C8B1EF19086B193754D97310
SHA1:	5CB02E9552C8370035CFB1F56CC6D319C094EB34
SHA-256:	BF5A51BEBDE7418B714FB2122A5010E29379D8C71D8F233AF7BD2EF8B1448F76
SHA-512:	8B81E110D0DAF4F83AB9F5795238E59459EBC97F1CED6C6D513AF73ABA88984E5D4475D6BF8B104901455F65476048F22C4AB0F2D7A53D9D3EDD300824C8CCBB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D95.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.488507295254293
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYhPYm8M4JiJFo+q8vHBMN/Td:uIjf0I7vD7VxJfKh2/Td
MD5:	7A3D8496D9721D5BBFA265C1E17E7119
SHA1:	30C2223119F42FDBAF2A652376BDC050D0900131
SHA-256:	85778B85E2697B0CC25626D3084A45ECAD012CE8813EDC7BE5096DC99F56E6C5
SHA-512:	5E7BC20E3411ECF9D9B5D58795D6B890DCD83104AC3E39D2029C81125F4D08F2C61D736FD0483A52A2140A03C313395341912E1138CE6DA96C158B454AAD51BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER265D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	106154
Entropy (8bit):	2.0637235881966087
Encrypted:	false
SSDEEP:	384:fvRCpEAL5zF3OGbc1s3gkr7lyBf2nzb+oSVKnX8lUF1m5JuBgqOrDr4Ar/c+Dr:fY+c5zBbc1QdJSkfSVKnXn9MrDrHl
MD5:	7906FB6DCA887C3A504C104F7C36E21D
SHA1:	177306CD361F0BBAB571BDD53BB8368E4C26DF90
SHA-256:	DA593FB516F2F967361AA559756D6048A06E6793906FECAB520313A6BF5A7485
SHA-512:	8D60C925E8269A17CB1F3E8E7427B14E0294FDB4816C8F4E19426B2A0532466E354DAB32B462DB56740F9BE60738D6046B60938FCD8A72B85CFA9ACE070746DB
Malicious:	false
Preview:	MDMP..a..... ..........f........................D................G..........T.......8...........T...........X5..Ri..........`...........L...............................................................................eJ..............GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER26EB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.704773300725653
Encrypted:	false
SSDEEP:	192:R6l7wVeJa1696Y9RSUNgn6GgmfW8pB089biesfYvWm:R6lXJY696Y7SUN+gmfWaidf4
MD5:	E04349F132BD431504037C2481DD2740
SHA1:	A92471C662D288E16653508709E6336A5DFEA696
SHA-256:	BAACF683BD70BFE5C7274A1A746B7C061824B68A0E589203CDBF1FEFFD613B1F
SHA-512:	85EF8F19386D3BE3884DE9D637E01623DC0A4C95DD26F1DB92E677503B5D2C3E7F99B3F6AF2A4C47FA4699AAAFBC038D60DD16350AD1D67F4E97728133EA5768
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER270B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.487223738628957
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYTYm8M4JiJFm/K+q8vHBMN/Td:uIjf0I7vD7VDJXiKh2/Td
MD5:	C1F222E3912CF70C180E25A6345AB028
SHA1:	CF69B92151B0906C9B1C26CA87BB892B13C5A0D2
SHA-256:	353026E5CB91C96FD4D4A0E5F655C440B185ABB37F890FC9E3C30DA926824C71
SHA-512:	9F1262F0BC2394A5768CB329A8F44BD3376CB973D71D509454DA56BF7F4606C6CDCCEE8DC5818335D6CAE9C61907EBD757FCCFEA489BA769321E125A6469EC7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29A9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	44130
Entropy (8bit):	2.6219495869549707
Encrypted:	false
SSDEEP:	384:YiGn+tQsRzUeqyJxmGy42iYUz5JyXof2:i+SsRznsiYgf
MD5:	ED0D06AAFF2E5525F5A3A8D6EC81C1DB
SHA1:	A647E00792E70980754543981C40BB462E27E179
SHA-256:	911728A248A8ADED4CEAFE933A7F720D90308DD533FDC9293D10060B17B180F5
SHA-512:	748766B5725160E3D80E5DB2E0B4E976DC14B096244581EBE18C46707D5F9C0056CF93EA08DDA5643F1BB75ED2888C092A2674A0C93A456475F43FA96BA9E73E
Malicious:	false
Preview:	MDMP..a..... ..........f............4...............<.......t...Z...........T.......8...........T...........P8...t..........L...........8!..............................................................................eJ.......!......GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B02.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8316
Entropy (8bit):	3.7033561042259735
Encrypted:	false
SSDEEP:	192:R6l7wVeJaj6IpXu7w6Y9DSUt64GgmfrrsipDa89bVesfFanm:R6lXJu6Ipe7w6YZSUt8gmfrgcVdfFz
MD5:	F0312278B2184630418A53E27E28227F
SHA1:	7572927A2B8D09FF355B401DC4F4F6AB4B7D66FB
SHA-256:	93E1FEB9BD0CF936D37AD632E5E38F69AEF5368C3B0E2E8B74AF7A9E91D6AC1E
SHA-512:	B3B97FDC56FC105C3DFF735AFD289162000AA2D45761F860E0B05023DAFD640085FF83E5C22E0ADF407650EF8A79BA0F21DBA9488CF005A614E55F05EFD95CC2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B32.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.470365382482564
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VYX3Ym8M4JiWFAF+q8UZMN/Td:uIjf0I7vD7VTJsX2/Td
MD5:	06F846D36F2E30900B9B22EC9440BE6C
SHA1:	29CA6E181601A1CB066C3B759EF613B85827DCAE
SHA-256:	556FAF9921AA20EFEDE868CD50378701C89A1E886EB93F4E42339A3EA49949DD
SHA-512:	C35E5F0240BA0658BDB918D676EEF5B5C1F7C64EF6886BC7A9F966AD215D10764AF290878F7FBFD45DFDEDC10676917BF40AD3E72ADEA39AD280081EA0ABBBB4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 29 10:16:51 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60882
Entropy (8bit):	2.150038023698374
Encrypted:	false
SSDEEP:	384:P5Dn+dHnz1nskz8NfZfGyVYq/vL/m52jT+8w:P56HzlwNVGyVYq/+3
MD5:	71B48E08C5D11B7087B3FD841FA34BCF
SHA1:	296C58544F34A9B478F8EBD6028C8FEE44682474
SHA-256:	2CBD06CAED7515D942C0BEC74FAD6AA03593DC31EF3520EE853913FDE5FA5DC3
SHA-512:	4F335CAAFD455A5722D922392831681316AA5079544055CB3900EBB440BD354BD14B9B23403633732FCB8DE735DE6F52E6A9859B2092A2B65162070E574F432D
Malicious:	false
Preview:	MDMP..a..... ..........f........................\...........$....-..........T.......8...........T........... ...............X...........D...............................................................................eJ..............GenuineIntel............T..............f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.705507528289536
Encrypted:	false
SSDEEP:	192:R6l7wVeJaz68ke6Y9JSU7LgmfW8pBH89bUesfVA8m:R6lXJW6e6YDSU7LgmfWTUdfV6
MD5:	B421ABFC84D749025DD9801D238DEFFC
SHA1:	D7996BBC1FC571D9C9EE0333334189E350575A85
SHA-256:	71836630C3C73EBD79288A9D4650AAC70D5680BFDFB373A2BC0FF61AF4D1E383
SHA-512:	0435C59DF799D6FA9D6B2C3EDEE1A15E02AB8D43415A2D7FC5AE86ABC4F658000F8F684C36BE891634BF599265AF4E69F994D63695DCAC4805758107A68541D7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.488592867304526
Encrypted:	false
SSDEEP:	48:cvIwWl8zs+Jg77aI9ciCWpW8VY3Ym8M4JiJF5N+q8vHBMN/Td:uIjf0I7vD7VrJkKh2/Td
MD5:	0C7EBB1A4BAF9F1212034E9B29948C36
SHA1:	D239F129157765B681D8223EB2276FA98DF10174
SHA-256:	B1F4917B3F20DA725A593C848A0A09AFA54D7964B98D825352777DD3B811C7D7
SHA-512:	C2D7524FE4B09E2B784F42AA653B628A48B4D088FCB2DD2AAA9167F9A8CFCE1B1C089F4C942AB99C6A787654A72F384F817EC750FF51D9BDF2299BB40E94406E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="256399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Download File

Process:	C:\Users\user\Desktop\7GXKafhbnD.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46543540889398
Encrypted:	false
SSDEEP:	6144:VIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN7dwBCswSbd:WXD94+WlLZMM6YFH9+d
MD5:	7BC76060C43DF705FCD87AE0EC9198DA
SHA1:	C64BF93937F7DFCC3D32B2D1285AD161255EE4F2
SHA-256:	9FD6A13E1A29DCF7041A7D3EB6933BFF911A3F206AA7DE7446F77CEA6E6039FB
SHA-512:	769B563D568FBC2293E53999E877BFB0AFBD4D19A8595420748D5A49F49DC1FFB7A2BA19DFC9B2ABEB9ADFD9EAC9095A95B631EE5BD2091F36503E9DD27354CB
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmz.=7.................................................................................................................................................................................................................................................................................................................................................+.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.72210431191036
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7GXKafhbnD.exe
File size:	265'728 bytes
MD5:	5ef4cf46165c932ee117830e7cd38ccf
SHA1:	d45fc4a83fcd2a1fec421d55635d51bf02646d37
SHA256:	3ffdada986edc6412a966b49b35d63b38d836252f77c4c6488b3b564653f3af7
SHA512:	33a5d66a67e4e81b105a7ce4f4e4c82fb5d42cd8d3de4b0ac42f2cf2825b65d3699d7987ecbd323de69a7ac72227e9f934c73478c48ab9add9fa6bf7edd536be
SSDEEP:	6144:crMgT9iXeD45U2VHSmAuLfNqeo7FGN1MFlsWY:QT9iXg45UAHJjNqeWFLc
TLSH:	6044D0D177E0C873D567163168B887A20A7A7D326A70C98B3758EB7E5EB03D04A36713
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y...6.'.A...6...-...6...~...P.*.P...Y...2...6...X...6.#.X...6.$.X...RichY...................PE..L......e...........

File Icon


Icon Hash:	1369454529370f17

Static PE Info

General

Entrypoint:	0x4028b2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6518D4D7 [Sun Oct 1 02:09:27 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	257369aa226cb4b09879eb1a5063d4d0

Entrypoint Preview

Instruction
call 00007F597C81F520h
jmp 00007F597C81B1CEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00411270h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F597C81B34Eh
test byte ptr [eax], 00000008h
je 00007F597C81B349h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [004110B8h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00439358h], eax
mov dword ptr [00439354h], ecx
mov dword ptr [00439350h], edx
mov dword ptr [0043934Ch], ebx
mov dword ptr [00439348h], esi
mov dword ptr [00439344h], edi
mov word ptr [00439370h], ss
mov word ptr [00439364h], cs
mov word ptr [00439340h], ds
mov word ptr [0043933Ch], es
mov word ptr [00439338h], fs
mov word ptr [00439334h], gs
pushfd
pop dword ptr [00439368h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0043935Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00439360h], eax
lea eax, dword ptr [ebp+08h]

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x364b4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13c000	0x7fa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x35ae8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35aa0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfe03	0x10000	4cccaf6f1dc9d2d34e05898692d80d0b	False	0.5941009521484375	data	6.641755435184662	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x25dda	0x25e00	c109ae0e87715279c2f562d109f94b5a	False	0.7511280424917491	data	6.876609517052601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x1032e4	0x2200	cbb46c41e8183385fa1121a9ee063c8a	False	0.20335477941176472	data	2.335031179825399	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x13b000	0x9cd	0xa00	b85f229e4962d23b2bc27d3fefa72e8e	False	0.010546875	data	0.004986070829181356	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13c000	0x7fa8	0x8000	c4b8da47629fbad4be85db1975aae629	False	0.54833984375	data	5.557271483281829	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x142d08	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_CURSOR	0x142e50	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"			0.75
RT_ICON	0x13c490	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Spanish	Peru	0.43550106609808104
RT_ICON	0x13d338	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Spanish	Peru	0.5708483754512635
RT_ICON	0x13dbe0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Spanish	Peru	0.6382488479262672
RT_ICON	0x13e2a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Spanish	Peru	0.7124277456647399
RT_ICON	0x13e810	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Spanish	Peru	0.5570539419087137
RT_ICON	0x140db8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Spanish	Peru	0.5895872420262664
RT_ICON	0x141e60	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Spanish	Peru	0.6676229508196722
RT_ICON	0x1427e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Spanish	Peru	0.7118794326241135
RT_DIALOG	0x143190	0x98	data			0.7631578947368421
RT_STRING	0x143228	0xee	data			0.5588235294117647
RT_STRING	0x143318	0x6e2	data			0.42622020431328034
RT_STRING	0x143a00	0x160	data			0.4971590909090909
RT_STRING	0x143b60	0x448	data			0.458029197080292
RT_ACCELERATOR	0x142cc8	0x40	data			0.859375
RT_GROUP_CURSOR	0x142e38	0x14	data			1.15
RT_GROUP_CURSOR	0x142f88	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x142c50	0x76	data	Spanish	Peru	0.6610169491525424
RT_VERSION	0x142fa0	0x1f0	MS Windows COFF PowerPC object file			0.5705645161290323

Imports

DLL	Import
KERNEL32.dll	CreateFileA, GetNumaProcessorNode, DebugActiveProcessStop, GetConsoleAliasExesLengthA, SetUnhandledExceptionFilter, InterlockedIncrement, HeapFree, WaitForSingleObject, SetComputerNameW, ConnectNamedPipe, GetModuleHandleW, ReadConsoleOutputA, GlobalFindAtomA, LoadLibraryW, GetLocaleInfoW, GetFileAttributesA, HeapCreate, lstrcpynW, GetAtomNameW, GetModuleFileNameW, FindNextVolumeMountPointW, SetConsoleTitleA, GetLastError, GetLongPathNameW, GetThreadLocale, GetProcAddress, CreateHardLinkW, SetConsoleDisplayMode, FindAtomA, SetSystemTime, SetConsoleTitleW, HeapSetInformation, GetCurrentDirectoryA, DeleteCriticalSection, SetCalendarInfoA, FindAtomW, CreateFileW, ReadFile, FlushFileBuffers, HeapReAlloc, GetStringTypeW, HeapAlloc, ExitProcess, DecodePointer, GetCommandLineA, GetStartupInfoW, RaiseException, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, IsProcessorFeaturePresent, WriteFile, GetStdHandle, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, InterlockedDecrement, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, Sleep, RtlUnwind, MultiByteToWideChar, HeapSize, SetStdHandle, WriteConsoleW, LCMapStringW, CloseHandle
USER32.dll	CopyRect, GetMonitorInfoW, LoadIconA
ole32.dll	CoTaskMemFree
WINHTTP.dll	WinHttpAddRequestHeaders, WinHttpCloseHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Peru

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/29/24-11:16:56.193727	TCP	2856233	ETPRO TROJAN Win32/Unknown Loader Related Activity (GET)	49730	80	192.168.2.4	185.172.128.90

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 11:16:56.009535074 CET	49730	80	192.168.2.4	185.172.128.90
Mar 29, 2024 11:16:56.193474054 CET	80	49730	185.172.128.90	192.168.2.4
Mar 29, 2024 11:16:56.193556070 CET	49730	80	192.168.2.4	185.172.128.90
Mar 29, 2024 11:16:56.193727016 CET	49730	80	192.168.2.4	185.172.128.90
Mar 29, 2024 11:16:56.378149986 CET	80	49730	185.172.128.90	192.168.2.4
Mar 29, 2024 11:16:57.738781929 CET	80	49730	185.172.128.90	192.168.2.4
Mar 29, 2024 11:16:57.738862038 CET	49730	80	192.168.2.4	185.172.128.90
Mar 29, 2024 11:17:02.744152069 CET	80	49730	185.172.128.90	192.168.2.4
Mar 29, 2024 11:17:02.744321108 CET	49730	80	192.168.2.4	185.172.128.90
Mar 29, 2024 11:17:09.252444029 CET	49730	80	192.168.2.4	185.172.128.90

HTTP Request Dependency Graph

185.172.128.90

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.172.128.90	80	7392	C:\Users\user\Desktop\7GXKafhbnD.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 11:16:56.193727016 CET	411	OUT	GET /cpa/ping.php?substr=one&s=two HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache
Mar 29, 2024 11:16:57.738781929 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 10:16:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Target ID:	0
Start time:	11:16:50
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\7GXKafhbnD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7GXKafhbnD.exe"
Imagebase:	0x400000
File size:	265'728 bytes
MD5 hash:	5EF4CF46165C932EE117830E7CD38CCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1780373665.000000000079F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000003.1601096964.0000000000710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:16:51
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 740
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:16:51
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 732
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:16:52
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 744
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:16:53
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 776
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:16:53
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 996
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:16:54
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1016
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:16:54
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1084
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:16:57
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1368
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:16:58
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "7GXKafhbnD.exe" /f & erase "C:\Users\user\Desktop\7GXKafhbnD.exe" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:16:58
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:16:58
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "7GXKafhbnD.exe" /f
Imagebase:	0x2c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:16:58
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 1324
Imagebase:	0x60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	6.6%
Signature Coverage:	14.4%
Total number of Nodes:	423
Total number of Limit Nodes:	6

Executed Functions

Function 00404610 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 004047A9
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040496A

Strings

6p@, xrefs: 00404934
>p@, xrefs: 00404902
`a}{, xrefs: 00404753

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: 6p@$>p@$`a}{
API String ID: 3517786926-1460091040
Opcode ID: 4116bc1b733db3f759454d808376f374c31df4ef3e36e9cbd6d5a02df735b19b
Instruction ID: 330590cedc6ef4925a5e0697131a6f7a61ca84ef3ed2f2ac8bf25f3c7495cd07
Opcode Fuzzy Hash: 4116bc1b733db3f759454d808376f374c31df4ef3e36e9cbd6d5a02df735b19b
Instruction Fuzzy Hash: FFE1E5B5A002048FCB18DF58C885B9EB7B1FF89304F1481AEE945A73D1D778AD85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00405C50 Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00405C86
std::_Lockit::_Lockit.LIBCPMT ref: 00405CA9
std::_Lockit::~_Lockit.LIBCPMT ref: 00405CC9
std::_Facet_Register.LIBCPMT ref: 00405D2B
std::_Lockit::~_Lockit.LIBCPMT ref: 00405D43
Concurrency::cancel_current_task.LIBCPMT ref: 00405D66

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 899f7139b836413b060b75f0cb5eb09086772f94760495f253f9d0dbdea36c85
Instruction ID: 08ab94ca2a9d4c73b185bdcdb8e6c83304dc4aeac17ecd44b05eb03c633fd5d4
Opcode Fuzzy Hash: 899f7139b836413b060b75f0cb5eb09086772f94760495f253f9d0dbdea36c85
Instruction Fuzzy Hash: 6931A9B1E046558BCB20DF54D984AAFB7B0EB04324F51417BE8057B3C1DB38A902CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C631 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040C630,00000000,?,?,00000000,?,00410FA0), ref: 0040C653
TerminateProcess.KERNEL32(00000000,?,0040C630,00000000,?,?,00000000,?,00410FA0), ref: 0040C65A
ExitProcess.KERNEL32 ref: 0040C66C

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: 17531388b83ad1dd69705f2554a9baa2d2ec43643a1fbb1fffde3edaa8be7e69
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: AAE0B675400108FFCB216F65DC49E993F6AEB48B45F048939F90596271CB3AED82DA8C

Uniqueness

Uniqueness Score: -1.00%

Function 007A0116 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 007A013E
Module32First.KERNEL32(00000000,00000224), ref: 007A015E

Memory Dump Source

Source File: 00000000.00000002.1780373665.000000000079F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0079F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 76a6bfc839fe914cbc0ae539768c483e2ef01db297f79091e0bbfc0428cd1e71
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 49F0C2312003146BD7203AB8E88CBAF76E8AF8A325F100A28E642924C0DA74E80586A1

Uniqueness

Uniqueness Score: -1.00%

Function 00401D70 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 311
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof.LIBCMT ref: 00401EE0
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 00401EFB
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 00401F1E
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 00401F3F
HttpOpenRequestA.WININET(00000000,GET,00000000,00000000,00000000,00000000,80400000,00000001), ref: 00401F70
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00401F8B
InternetCloseHandle.WININET(00000000), ref: 00401FA2

Part of subcall function 00401D70: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401915
Part of subcall function 00401D70: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401934
Part of subcall function 00401D70: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 004019C8

InternetCloseHandle.WININET(00000000), ref: 00401FA5

Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017C7
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017ED
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401813
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401839

InternetCloseHandle.WININET(00000000), ref: 00401FAB

Strings

Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017CB
text, xrefs: 00401B6C
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401789
GET, xrefs: 00401F6A
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017F1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401817

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Internet$Http$Request$Headers$CloseHandle$FileOpen$ConnectInfoOptionPointerQueryReadSend__cftof
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text
API String ID: 3687058084-3782612381
Opcode ID: 24661e67dc6db6cb83d786c4d615048626c16ae4d5d7c2b38e8fdc9fd0d18510
Instruction ID: 8f143026f94f73492138068a5a98ea511c7c5b72d19facec5f7afc1a8a398599
Opcode Fuzzy Hash: 24661e67dc6db6cb83d786c4d615048626c16ae4d5d7c2b38e8fdc9fd0d18510
Instruction Fuzzy Hash: 86A1F571E00205AFDB14DFA8CC85BEEBBB5EF44704F14812AE911B72D1D7B89945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004034C0 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,72FC82FE), ref: 0040354A
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 00403713
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000001), ref: 00403727
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 00403740
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 0040391E
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000000,00000001), ref: 00403928

Strings

L]Z\, xrefs: 00404153
TMPDIR, xrefs: 00403766
open, xrefs: 00403E3D
.exe, xrefs: 00403BCF, 00403BE3
APPDATA, xrefs: 00403573

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CreateDirectoryErrorLastPath$FolderTemp
String ID: .exe$APPDATA$L]Z\$TMPDIR$open
API String ID: 519037321-3822968767
Opcode ID: 58084325f0d2424d399cb90bc3b994fead7f012210b2eb71262e5fbdb3723f90
Instruction ID: d77e3bfb0af0c483fd6f5a8190ee2423e64d65fb9548ade8e1ffb7d789cd644e
Opcode Fuzzy Hash: 58084325f0d2424d399cb90bc3b994fead7f012210b2eb71262e5fbdb3723f90
Instruction Fuzzy Hash: C2E1D371A102149BDB24DF28CC89B9DBBB5EF45304F1042EEE409A72D1D779AB84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006E003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006E024D

Strings

kernel32.dll, xrefs: 006E008F, 006E0095
cess, xrefs: 006E018D

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 0e35a6c12bade70b1b465d455dd422e68b4f7a7e37c090aa8174b37a3a36a116
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 12527874A01269DFDB64CF59C984BA8BBB1BF09304F1480D9E90DAB351DB70AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004032E0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(72FC82FE), ref: 0040330C

Part of subcall function 00403240: OpenProcess.KERNEL32(00000410,00000000), ref: 0040326B
Part of subcall function 00403240: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00403286
Part of subcall function 00403240: CloseHandle.KERNEL32(00000000), ref: 0040328D

GetCurrentProcessId.KERNEL32 ref: 00403328

Part of subcall function 00403140: OpenProcess.KERNEL32(00000410,00000000), ref: 004031A0
Part of subcall function 00403140: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031BD
Part of subcall function 00403140: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 004031DA
Part of subcall function 00403140: FindCloseChangeNotification.KERNELBASE(00000000), ref: 004031E1

ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 004033C9

Strings

" /f & erase ", xrefs: 0040334D
C:\Windows\System32\cmd.exe, xrefs: 004033C0
" & exit, xrefs: 0040336F
/c taskkill /im ", xrefs: 0040333C

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentModuleNameOpen$BaseChangeEnumExecuteFileFindHandleModulesNotificationShell
String ID: " & exit$" /f & erase "$/c taskkill /im "$C:\Windows\System32\cmd.exe
API String ID: 2036142635-793869484
Opcode ID: 1fc0ff93ad068b49a9079ccaac3e6d9fc4ff41ba9429363fd9a7e6fe0b6bfd17
Instruction ID: 0a13b2c22dad37968416a02aaaeafd7e907ad2634b2dd3acc7a01ebb54e0daa4
Opcode Fuzzy Hash: 1fc0ff93ad068b49a9079ccaac3e6d9fc4ff41ba9429363fd9a7e6fe0b6bfd17
Instruction Fuzzy Hash: 85215E30E152589BC710FBA5CC4ABDDB7B9AB14704F90407AE105B31D2EF782A49CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403140 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 004031A0
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031BD
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 004031DA
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004031E1

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Process$BaseChangeCloseEnumFindModuleModulesNameNotificationOpen
String ID:
API String ID: 1316604328-0
Opcode ID: 14553a7ce87c60a6aeedd6eb402924b7545987d6ff5dec190bfdfdcf3d436e72
Instruction ID: 7294671fdb2e756325182d4017c7ef5669c12871dac2d8cc872c5616c87decec
Opcode Fuzzy Hash: 14553a7ce87c60a6aeedd6eb402924b7545987d6ff5dec190bfdfdcf3d436e72
Instruction Fuzzy Hash: C521D675D00219ABD721DF55CC05BEABBB8AF09304F0041EAE548A7280DBF55BC5CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00403240 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 0040326B
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00403286
CloseHandle.KERNEL32(00000000), ref: 0040328D

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: caf5535d8d037548a90d51b39cd60138a826a1176cb6a43968f7ea5c440397ae
Instruction ID: 9bafab4ef3323dfb20cff85678fac51d935c0a874428e4ad99a880520db4f931
Opcode Fuzzy Hash: caf5535d8d037548a90d51b39cd60138a826a1176cb6a43968f7ea5c440397ae
Instruction Fuzzy Hash: 2311C474A00218ABD720DF15DC09BEABBB8EB45714F0041EDE58597280DBB95A8A8FD9

Uniqueness

Uniqueness Score: -1.00%

Function 00403FB0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L]Z\, xrefs: 00404153

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: L]Z\
API String ID: 1518329722-3060477307
Opcode ID: 2b5f4a951ad129ff6d00af33eaa579879453084f4b0cd8ac3cabf6d46d953e8b
Instruction ID: 9cc40f45d5dc763a333a47b871f2974c5973981472dcd7adb46b70870f9cdcdb
Opcode Fuzzy Hash: 2b5f4a951ad129ff6d00af33eaa579879453084f4b0cd8ac3cabf6d46d953e8b
Instruction Fuzzy Hash: 9BA1AEB0900258DBEB20DF15CD59BDEBB70AB42308F5481E9D5083B2C2D7B95B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 006E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006E0223,?,?), ref: 006E0E19
SetErrorMode.KERNELBASE(00000000,?,?,006E0223,?,?), ref: 006E0E1E

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5910df1618b4d58ae791dba76823746767ea92d9917d6bbb5d2ec6216bae3b2e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 4AD0123114522877D7002A95DC09BCD7B1CDF05B62F008421FB0DD9180C7B0994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00407E43 Relevance: 1.6, APIs: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004016AE

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 3b247bca9bf16a203419a19f0753c4518292e8aa13ca12a8cd9f00add86ef068
Instruction ID: 8bcf0cb3b95335924cfa7b88c9f0ad56c75d556d63f0b86ff4cd70f58fab397a
Opcode Fuzzy Hash: 3b247bca9bf16a203419a19f0753c4518292e8aa13ca12a8cd9f00add86ef068
Instruction Fuzzy Hash: 3101F27180430D67CB10AEA9EC0198A77AC9E01364B50867BF614BA2D0FB78F991C6DE

Uniqueness

Uniqueness Score: -1.00%

Function 0041239F Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00408FCB,?,?,?,004010ED,?,00402647,?,?,?), ref: 004123D1

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6257d7c2ee276c5d0fd134f5db4d8c55f501502e1b82d9c04a80d06860ad0d6c
Instruction ID: 1ebd68ceb3e2750452ceec7ddc3f820fb2cc1df67272b1c742803f8fbeb44581
Opcode Fuzzy Hash: 6257d7c2ee276c5d0fd134f5db4d8c55f501502e1b82d9c04a80d06860ad0d6c
Instruction Fuzzy Hash: 05E0653260021CA6D6212A769E04BDB77489B413B0F550123EC65D66D0CBEDDCF181ED

Uniqueness

Uniqueness Score: -1.00%

Function 0079FDD5 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0079FE26

Memory Dump Source

Source File: 00000000.00000002.1780373665.000000000079F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0079F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: e22f3416c64c4489666c4c6e14f88c864f3c40e59e18cd49beae29557cecae82
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 57113C79A00208EFDB01DF98C985E99BBF5AF08750F0580A4F9489B362D375EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00418FB1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

Part of subcall function 00410CF0: _free.LIBCMT ref: 00410D52
Part of subcall function 00410CF0: _free.LIBCMT ref: 00410D88

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004190BD
IsValidCodePage.KERNEL32(00000000), ref: 00419106
IsValidLocale.KERNEL32(?,00000001), ref: 00419115
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041915D
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0041917C

Strings

8B, xrefs: 0041906A

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: 8B
API String ID: 949163717-3070534924
Opcode ID: 9cc5dbd3226ca1c91f2a3e65307f028112530affb64da9709ca07ce47ffb2b51
Instruction ID: 6793c15cc455280a8c7af4f7e413a1aa30ca43f7d6b85ed07a59ee074ca3a54c
Opcode Fuzzy Hash: 9cc5dbd3226ca1c91f2a3e65307f028112530affb64da9709ca07ce47ffb2b51
Instruction Fuzzy Hash: E5517F71A00209ABDF10DFA5DC51AFB7BB8BF08700F14446AE905E7291DB789D808B6A

Uniqueness

Uniqueness Score: -1.00%

Function 006E4877 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006E4A10
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006E4BD1

Strings

yB, xrefs: 006E4B9B
`a}{, xrefs: 006E49BA
lyB, xrefs: 006E4BC7

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: `a}{$lyB$yB
API String ID: 3517786926-2911787467
Opcode ID: 0d7ac271edb1ceeb8f27dc579a49d9776563f4872301c01f0e117812be61121a
Instruction ID: eb9b7e5fa8a538e858e8e3c160133dd756551bd17d851f8826d9b617011edc5c
Opcode Fuzzy Hash: 0d7ac271edb1ceeb8f27dc579a49d9776563f4872301c01f0e117812be61121a
Instruction Fuzzy Hash: 7DE1B171A013848FDB18CF69C885BEABBB2FF48304F1481ACE84597791DB71AD85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00418DDC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,004190FA,00000002,00000000,?,?,?,004190FA,?,00000000), ref: 00418E75
GetLocaleInfoW.KERNEL32(00000000,20001004,004190FA,00000002,00000000,?,?,?,004190FA,?,00000000), ref: 00418E9E
GetACP.KERNEL32(?,?,004190FA,?,00000000), ref: 00418EB3

Strings

OCP, xrefs: 00418E30
ACP, xrefs: 00418DFA

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 413d092b1f8cb1c7040c52960380eb48f2e70d0728de85574387dd3f8c6cfc41
Instruction ID: f7e005d80453222efa45ca6ded62d635a2308356ef0b1a5731c07371da5e5e5a
Opcode Fuzzy Hash: 413d092b1f8cb1c7040c52960380eb48f2e70d0728de85574387dd3f8c6cfc41
Instruction Fuzzy Hash: E0217472B40304AADB349F54C900ADB73A7AB94B54B56842EE909D7310EF36DDC1C398

Uniqueness

Uniqueness Score: -1.00%

Function 006F9043 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,006F9361,00000002,00000000,?,?,?,006F9361,?,00000000), ref: 006F90DC
GetLocaleInfoW.KERNEL32(00000000,20001004,006F9361,00000002,00000000,?,?,?,006F9361,?,00000000), ref: 006F9105
GetACP.KERNEL32(?,?,006F9361,?,00000000), ref: 006F911A

Strings

ACP, xrefs: 006F9061
OCP, xrefs: 006F9097

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 413d092b1f8cb1c7040c52960380eb48f2e70d0728de85574387dd3f8c6cfc41
Instruction ID: 6da208584ec352cde7fe4167003ea03baa420a410f821dd262091a7396311a40
Opcode Fuzzy Hash: 413d092b1f8cb1c7040c52960380eb48f2e70d0728de85574387dd3f8c6cfc41
Instruction Fuzzy Hash: 79218E22B04109A6EB34DB24C905BF777A7EB94B64B568438EB06D7310EB32DE41C774

Uniqueness

Uniqueness Score: -1.00%

Function 006F9218 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

Part of subcall function 006F0F57: _free.LIBCMT ref: 006F0FB9
Part of subcall function 006F0F57: _free.LIBCMT ref: 006F0FEF

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 006F9324
IsValidCodePage.KERNEL32(00000000), ref: 006F936D
IsValidLocale.KERNEL32(?,00000001), ref: 006F937C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 006F93C4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 006F93E3

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 789a2199a566410c8d5f6196a0b5b743c3cf0787425769355cbabcc193c29f0a
Instruction ID: cd83ad35f2f07b18b9cb12723f88b653634f2dc304afe33f9f0a38b7a8e762b9
Opcode Fuzzy Hash: 789a2199a566410c8d5f6196a0b5b743c3cf0787425769355cbabcc193c29f0a
Instruction Fuzzy Hash: 8A517D72A0020DAFDB10DFA5CC41BFE77BAAF59700F144469EA01EB291EB709A418B74

Uniqueness

Uniqueness Score: -1.00%

Function 00408625 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00408631
IsDebuggerPresent.KERNEL32 ref: 004086FD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040871D
UnhandledExceptionFilter.KERNEL32(?), ref: 00408727

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: 4e7ae7f71886df58cdd4d538e578e96cece4f819f0f0f04ddfdad7554d61581c
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: 9D312BB5D05218DBDF10EF65D9897CDBBB8AF08304F1080AAE44DAB290EB755A85CF49

Uniqueness

Uniqueness Score: -1.00%

Function 006E888C Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006E8898
IsDebuggerPresent.KERNEL32 ref: 006E8964
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006E8984
UnhandledExceptionFilter.KERNEL32(?), ref: 006E898E

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: c6ea56cf8247de8ba73aa2606794e37684be9988afd9f1e6a35403cabde218ea
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: E6313AB5D063589FDB50DF65D9897CDBBB8AF08304F1040EAE40CA7250EB705A858F19

Uniqueness

Uniqueness Score: -1.00%

Function 00418A63 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

Part of subcall function 00410CF0: _free.LIBCMT ref: 00410D52
Part of subcall function 00410CF0: _free.LIBCMT ref: 00410D88

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418AB7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418B01
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418BC7

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: dc1ffc2793f6b1d7afc62a0ad7c4c78d5783b78a8c9b786a37b3847e322924e7
Instruction ID: b33c1d12df2f3ca4a67b5401e83685eb31d7a382d99c2f5db53118a87b602894
Opcode Fuzzy Hash: dc1ffc2793f6b1d7afc62a0ad7c4c78d5783b78a8c9b786a37b3847e322924e7
Instruction Fuzzy Hash: CD6191B19412079BDB289F25CD82BEA73A8EF04300F14406EED05C6285FB7CE9C5CB68

Uniqueness

Uniqueness Score: -1.00%

Function 006F8CCA Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

Part of subcall function 006F0F57: _free.LIBCMT ref: 006F0FB9
Part of subcall function 006F0F57: _free.LIBCMT ref: 006F0FEF

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006F8D1E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006F8D68
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006F8E2E

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 4d324a8d221e2db5cd00d45a2086900a0be2c9c4073d16e4d4d15737deefaec0
Instruction ID: f0db48d1c1789b0fe04f2d5b74cbda5c125e673027e4477e656cc703585d8bc0
Opcode Fuzzy Hash: 4d324a8d221e2db5cd00d45a2086900a0be2c9c4073d16e4d4d15737deefaec0
Instruction Fuzzy Hash: DD616E7191021B9FDB689F28CD82BBA77AAEF14700F1440B9EA05DB685EB34D981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040C12B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C223
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C22D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C23A

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a363c8f4b9625c0e28c3cad3f2c9073414a5d8918bc76188047232fe408d892c
Instruction ID: c0b265e319df541204858922ba61a9dd542638533c36256644e283e043c6301b
Opcode Fuzzy Hash: a363c8f4b9625c0e28c3cad3f2c9073414a5d8918bc76188047232fe408d892c
Instruction Fuzzy Hash: 6F31D575D11218DBCB21EF64D8887CDBBB8AF08714F5081EAE40CA7291EB349F858F49

Uniqueness

Uniqueness Score: -1.00%

Function 006EC392 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 006EC48A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 006EC494
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 006EC4A1

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction ID: da564a1d65ad4fcfa719b120081ec4ddcc6c295d0acce04d547b2676e80c08bc
Opcode Fuzzy Hash: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction Fuzzy Hash: 6531C4759013289BCB61DF29D8897DDBBB5BF08310F5081EAE40CA7290E7749F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 006EC898 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,006EC897,00000000,?,?,00000000,?,006F1207), ref: 006EC8BA
TerminateProcess.KERNEL32(00000000,?,006EC897,00000000,?,?,00000000,?,006F1207), ref: 006EC8C1
ExitProcess.KERNEL32 ref: 006EC8D3

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: 8c40d4ac305a47eca3412e19a2371a00456dc06d5f8b4b10c285ca11f2d55822
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: 55E04F32401248EFCF516B15CD09E993F2AFF04355F004428F8058A531CB39ED82CB45

Uniqueness

Uniqueness Score: -1.00%

Function 006E092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 006E0966
., xrefs: 006E095F
GetProcAddress., xrefs: 006E09DC, 006E09DF, 006E09E4

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 00360f923b02206ba4e0abf178a40f94604574d281b8d41a332c48d6b120a506
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 343139B6901749DFEB10CF99C884AADBBF6FF48324F14504AD441A7312D7B1EA85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9D1 Relevance: 3.0, APIs: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0040C9E4
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CA15

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: de6d41178ef1bdb0f11c2d6c328f0d1e8522db571583c659f4b5d7d653238db3
Instruction ID: 161c301eb38072fd15b848a24ce5a2b1e53d7725ba837d5542136e74bd8e1b73
Opcode Fuzzy Hash: de6d41178ef1bdb0f11c2d6c328f0d1e8522db571583c659f4b5d7d653238db3
Instruction Fuzzy Hash: 42F0B171B50208FBDB14DF58C885B6D7AA8FB4032DF34875DA502F72C1D674D9448B59

Uniqueness

Uniqueness Score: -1.00%

Function 00413414 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,0041340F,?,?,?,?,?,?,00000000), ref: 00413641

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: 27754656d461d85de88df810e97d8c2fd86bed0dd6344b0e81602958a0ae5dcf
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: 17B16C71610604DFD725CF28C48ABA57BA1FF05365F258659E89ACF3A1C339EA82CB44

Uniqueness

Uniqueness Score: -1.00%

Function 006F367B Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,006F3676,?,?,?,?,?,?,00000000), ref: 006F38A8

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: b9e3903933b3525fd57e2c20316bb0b0e7c2fcfaa0379fa36fe74794f4237441
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: 7AB17C75610619DFD714CF28C486BA47BE2FF05364F258658E9AACF3A1C375EA82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00408823 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00408839

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction ID: 5e3c9d0254c3112ef7bf8c172c4cd0694a04a617785e47f7ce1772b7818988c7
Opcode Fuzzy Hash: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction Fuzzy Hash: 74518CB2E003058BDB28CF59D985BAABBF0FB48314F64843ED851EB391D7789941CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418CB6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

Part of subcall function 00410CF0: _free.LIBCMT ref: 00410D52
Part of subcall function 00410CF0: _free.LIBCMT ref: 00410D88

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418D0A

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 9ced6348adc16481bd0ca2e9767211df27cb6cd6dc6d7678f893cb1b19a8d445
Instruction ID: 42ef8374429d74b94e5b9e9f6e25a0c9d7cf9317464f42b76574ed002a9689f9
Opcode Fuzzy Hash: 9ced6348adc16481bd0ca2e9767211df27cb6cd6dc6d7678f893cb1b19a8d445
Instruction Fuzzy Hash: A1217471611646ABDB289B25EC41AFB73A8EF54318F10017FFD01D6281EB78ED848B59

Uniqueness

Uniqueness Score: -1.00%

Function 006F8F1D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

Part of subcall function 006F0F57: _free.LIBCMT ref: 006F0FB9
Part of subcall function 006F0F57: _free.LIBCMT ref: 006F0FEF

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006F8F71

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction ID: b7122aa3335396713421a9438fedd33a983dab4af5e5ca8f06e2a1c0cef97cf4
Opcode Fuzzy Hash: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction Fuzzy Hash: 2A21A17261620AAFDB289A29DC41ABA73ABEF04354F1040BDFF06DB241EF34DD408754

Uniqueness

Uniqueness Score: -1.00%

Function 0041893D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

EnumSystemLocalesW.KERNEL32(00418A63,00000001,00000000,?,-00000050,?,00419091,00000000,?,?,?,00000055,?), ref: 004189AF

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 516e9c6e6d8b2676bf81f7df99669abeaf70012167b3e046b7f6f6d436ea2f29
Instruction ID: 14f223c06b24b0ed621d12601d254d3ea3e1912b5bc3b11f842ed34bef750fbc
Opcode Fuzzy Hash: 516e9c6e6d8b2676bf81f7df99669abeaf70012167b3e046b7f6f6d436ea2f29
Instruction Fuzzy Hash: 521125776003019FDB189F39C8916FBBB91FF80358B14442EE98687B40E7B5A982CB84

Uniqueness

Uniqueness Score: -1.00%

Function 006F8BA4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

EnumSystemLocalesW.KERNEL32(00418A63,00000001,00000000,?,-00000050,?,006F92F8,00000000,?,?,?,00000055,?), ref: 006F8C16

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 516e9c6e6d8b2676bf81f7df99669abeaf70012167b3e046b7f6f6d436ea2f29
Instruction ID: d967e620b82d4f1315128e87ba1a2ea6ec590bcd48fc79abec9fb3b7952a8a79
Opcode Fuzzy Hash: 516e9c6e6d8b2676bf81f7df99669abeaf70012167b3e046b7f6f6d436ea2f29
Instruction Fuzzy Hash: B2110C776007099FDB189F39C8D16BABB92FF80768B14446DEA4687B40D7717943C750

Uniqueness

Uniqueness Score: -1.00%

Function 00418EE2 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00418C7F,00000000,00000000,?), ref: 00418F0E

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: 86081c6865d5af22ff2f52ff857cc8732d14bf34c6ca2e14e641c5f1034d20dc
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: F1F0A936600112BBDB289B25C805BFB7769DB40754F15446FEC16A3240EE78FD82C5D4

Uniqueness

Uniqueness Score: -1.00%

Function 006F9149 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,006F8EE6,00000000,00000000,?), ref: 006F9175

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: 25737d5fd270a0955556ed0dc95fa794a5d8f5738647709a929701f3ba280e85
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: B1F0A936A0021ABBEB24DB648D49BFA776AEB40758F154478EE05A3340DA74FD41C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 004189D8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

EnumSystemLocalesW.KERNEL32(00418CB6,00000001,00000003,?,-00000050,?,00419055,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00418A22

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7d47202ca74ac4794375e9960b47f1232945d5c07c26eb6d07b4197ac13ecc7a
Instruction ID: 2fb29d5ff3d88c6898ac91d926b9e8ec1b4031367a3e2b632e3fa3c5c5f4472d
Opcode Fuzzy Hash: 7d47202ca74ac4794375e9960b47f1232945d5c07c26eb6d07b4197ac13ecc7a
Instruction Fuzzy Hash: D8F0F6762003045FDB149F39D881ABB7B91EF807A8F15442EF9454B681DBB59C82CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006F8C3F Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

EnumSystemLocalesW.KERNEL32(00418CB6,00000001,00000003,?,-00000050,?,006F92BC,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 006F8C89

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7d47202ca74ac4794375e9960b47f1232945d5c07c26eb6d07b4197ac13ecc7a
Instruction ID: 892cf7847615d043c61519eefd34efe167c7617f3bde55da5c048e1e2b142618
Opcode Fuzzy Hash: 7d47202ca74ac4794375e9960b47f1232945d5c07c26eb6d07b4197ac13ecc7a
Instruction Fuzzy Hash: 2FF0F6762013085FDB249F39D885ABA7B92EF80368B1584ADFB058B680DBB19C41C764

Uniqueness

Uniqueness Score: -1.00%

Function 00411252 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0040CB82: EnterCriticalSection.KERNEL32(?,?,0040DCE0,00000000,004291B0,0000000C,0040DCA7,?,?,004111E1,?,?,00410E92,00000001,00000364,00000008), ref: 0040CB91

EnumSystemLocalesW.KERNEL32(Function_00011245,00000001,00429310,0000000C,00411670,?), ref: 0041128A

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8f870c0ef63984019719c07918deb47689416749cc0532ca4585aee21870e400
Instruction ID: f381658841504b0dfdd59018c173e127621b4d387950a2f19bd82fd28c682577
Opcode Fuzzy Hash: 8f870c0ef63984019719c07918deb47689416749cc0532ca4585aee21870e400
Instruction Fuzzy Hash: 7BF03C72B00244DFD710EF98E882B9C77F0EB44725F10816FE914E72E1CB7959458B49

Uniqueness

Uniqueness Score: -1.00%

Function 006F14B9 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 006ECDE9: RtlEnterCriticalSection.NTDLL(?), ref: 006ECDF8

EnumSystemLocalesW.KERNEL32(00411245,00000001,00429310,0000000C,006F18D7,?), ref: 006F14F1

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8f870c0ef63984019719c07918deb47689416749cc0532ca4585aee21870e400
Instruction ID: 81fc878351c2d75f99ad32a64b804cbe16ca53bfd8cb723415a6773828cb48ca
Opcode Fuzzy Hash: 8f870c0ef63984019719c07918deb47689416749cc0532ca4585aee21870e400
Instruction Fuzzy Hash: 02F03772A41348EFDB50EF98E842B9877E1EB49760F20802AF514DB2A0CB7559418B98

Uniqueness

Uniqueness Score: -1.00%

Function 004188F2 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

EnumSystemLocalesW.KERNEL32(0041884B,00000001,00000003,?,?,004190B3,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00418929

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 855b53cc1e6ee646680bc67f3fa7f526504240ba7194ac0431e4327582820ed6
Instruction ID: 7acbd0daa2659c4d103b9045d5b9d05740ea33576dbd9a00e1a458e9420e3198
Opcode Fuzzy Hash: 855b53cc1e6ee646680bc67f3fa7f526504240ba7194ac0431e4327582820ed6
Instruction Fuzzy Hash: 4CF0553630020497CB04AF3AD8457BBBF94EFC2714B06405EEE068B250CA799883C794

Uniqueness

Uniqueness Score: -1.00%

Function 006F8B59 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

EnumSystemLocalesW.KERNEL32(0041884B,00000001,00000003,?,?,006F931A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 006F8B90

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 855b53cc1e6ee646680bc67f3fa7f526504240ba7194ac0431e4327582820ed6
Instruction ID: 566b426dd2a5f113659e437dcc57f9765055aa9fa076aea03fb70d38b1e03016
Opcode Fuzzy Hash: 855b53cc1e6ee646680bc67f3fa7f526504240ba7194ac0431e4327582820ed6
Instruction Fuzzy Hash: 78F0553A3002099BCB14AF39D845BBA7F91EFC2720B06409CEF098B240CB719843C794

Uniqueness

Uniqueness Score: -1.00%

Function 00411774 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0040FD52,?,20001004,00000000,00000002,?,?,0040F35F), ref: 004117A8

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction ID: 0972a22c1e0a90fb65d65e1e40291ef1d4eefbced417db6be1b8b2ad57d54f5a
Opcode Fuzzy Hash: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction Fuzzy Hash: F0E04F7190022CBBCF122F61EC04EEE3E1AEF44761F048026FE1965270CB398961AA99

Uniqueness

Uniqueness Score: -1.00%

Function 006F19DB Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,006EFFB9,?,20001004,00000000,00000002,?,?,006EF5C6), ref: 006F1A0F

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction ID: cc076f14d9fbb4680268fac665386504a3bbd508c0ab2c06093cceafa7409103
Opcode Fuzzy Hash: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction Fuzzy Hash: F1E04F7150111CFBCF126F60DC08EEE3E17EF467A1F008025FE0569221DB318921AE98

Uniqueness

Uniqueness Score: -1.00%

Function 004087B9 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000087C5,0040839B), ref: 004087BE

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 216315aa29a7737b594878b8383662183d93a43863b413b0b731a22e8e1fde42
Instruction ID: 5d1e3c5b33a480f822b7ed4868b89400aee6ba87a5744c2ce2f3241e4135986f
Opcode Fuzzy Hash: 216315aa29a7737b594878b8383662183d93a43863b413b0b731a22e8e1fde42
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 006E8A20 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(004087C5,006E8602), ref: 006E8A25

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 216315aa29a7737b594878b8383662183d93a43863b413b0b731a22e8e1fde42
Instruction ID: 5d1e3c5b33a480f822b7ed4868b89400aee6ba87a5744c2ce2f3241e4135986f
Opcode Fuzzy Hash: 216315aa29a7737b594878b8383662183d93a43863b413b0b731a22e8e1fde42
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 006E9A77 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

wB, xrefs: 006E9A7B

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID: wB
API String ID: 0-480074513
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 1983047bf481fdc2baa77ff64850270de0dc26723dfaac6a2b609bb4355cda37
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: FB11E7772073C243D715CA2FE4B42FBA797EFC632472D427AD4418B798E222E955DA20

Uniqueness

Uniqueness Score: -1.00%

Function 00416A3F Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00416A3F

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction ID: 9a80fc1e86b51b65d844f4e1b3b296cb5ecca0acffe3ceb98a2f460cf26000b7
Opcode Fuzzy Hash: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction Fuzzy Hash: 83A011B0A002088B83008F30AE083083EA8BA082E0B808238A000C2020EB208002AA08

Uniqueness

Uniqueness Score: -1.00%

Function 00421D88 Relevance: 1.2, Instructions: 1219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f01dc1d2c477128aa345d6d8fe4a59e6d0731da86b75dd4988c976bb2a42a68
Instruction ID: 2822b4ff8d673516f73c88fa8e27b675164bd6225c343a0e319e7fdae1eab10f
Opcode Fuzzy Hash: 3f01dc1d2c477128aa345d6d8fe4a59e6d0731da86b75dd4988c976bb2a42a68
Instruction Fuzzy Hash: 87B2969694E7D21FD7178B742E39644BF706A2311478E86DFC4C5CF8A3E24C990AC36A

Uniqueness

Uniqueness Score: -1.00%

Function 00413C09 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43d99622c02b977f2797ec57606745cfa42a3be3f8db156bde5178deeb83f7a
Instruction ID: 49f66791e219693c107355992864d43b2ccf0a0429c0e8b94c6a082c3fca80eb
Opcode Fuzzy Hash: e43d99622c02b977f2797ec57606745cfa42a3be3f8db156bde5178deeb83f7a
Instruction Fuzzy Hash: 6E320431E29F014DD7239634D822336A688AFF73D9F55D737E829B5AA6EB28D4C34104

Uniqueness

Uniqueness Score: -1.00%

Function 00409810 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 3cf553c355e022dd7137e37aac3e2f43086136b686e3ae39dcc0fff1f9178ddc
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: EC110B7721404143E648A63EC8B86B79795EEC7320B2CC37BD041AF7DAD23ADD459508

Uniqueness

Uniqueness Score: -1.00%

Function 0079F9F3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780373665.000000000079F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0079F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79f000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 47456bc25e7fe3f2552042beaf93fbaf6eb9387c484a7e9ef45a2b11adbfb612
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: E1115E72740100AFDB54DF55EC81EA677EAEB8A360B298165ED08CB316D679EC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 006E0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 4abe33874204280607049c3fe1d50a54ae18a97c1e974f731f868581595d7917
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: AB0184766027448FEB21CF65CC04BEA33A6EF85315F4544B5D506D7245E7B4A9818F90

Uniqueness

Uniqueness Score: -1.00%

Function 00411142 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: ff22ed5b0b5e5d31f23ff0dfb6eba791a0e192b9a5bcf7ae779397202ff5a52a
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: 5FE08C72A21238FBCB14DB89C90498AF3FCEB48B44B11009BB601D3220C2B4DE40C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 006F13A9 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: ce0f337a50a587469dfd651be7b5ab866bc9e96b630be6358285190e53953f16
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: A9E08C3391122CEBCB15DB89C94499AF3FEEB46B90B1104AABA01D7200C2B0DE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0040D020 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040D08F
_free.LIBCMT ref: 0040D0A5
_free.LIBCMT ref: 0040D0B8
_free.LIBCMT ref: 0040D0CD
_free.LIBCMT ref: 0040D0E2
GetCPInfo.KERNEL32(?,?), ref: 0040D12C

Part of subcall function 00412E51: _free.LIBCMT ref: 00412EBC

_free.LIBCMT ref: 0040D397
_free.LIBCMT ref: 0040D3AA
_free.LIBCMT ref: 0040D3B8
_free.LIBCMT ref: 0040D3C3
_free.LIBCMT ref: 0040D405
_free.LIBCMT ref: 0040D40D
_free.LIBCMT ref: 0040D413
_free.LIBCMT ref: 0040D41B
_free.LIBCMT ref: 0040D429

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: f75f90a82226465c80f0355d6ec639faf86bb676124124cb5fa49b5a1720896c
Instruction ID: 80a59153d3aa23b21046de2bdaceedb19a4e65a04fc4a2e7bb1feac13576ebbe
Opcode Fuzzy Hash: f75f90a82226465c80f0355d6ec639faf86bb676124124cb5fa49b5a1720896c
Instruction Fuzzy Hash: 4DD19F71D002059FDB21DFA9C881BEEBBF5BF08304F14416EE995B7392D778A8498B58

Uniqueness

Uniqueness Score: -1.00%

Function 006ED287 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006ED2F6
_free.LIBCMT ref: 006ED30C
_free.LIBCMT ref: 006ED31F
_free.LIBCMT ref: 006ED334
_free.LIBCMT ref: 006ED349
GetCPInfo.KERNEL32(?,?), ref: 006ED393

Part of subcall function 006F30B8: _free.LIBCMT ref: 006F3123

_free.LIBCMT ref: 006ED5FE
_free.LIBCMT ref: 006ED611
_free.LIBCMT ref: 006ED61F
_free.LIBCMT ref: 006ED62A
_free.LIBCMT ref: 006ED66C
_free.LIBCMT ref: 006ED674
_free.LIBCMT ref: 006ED67A
_free.LIBCMT ref: 006ED682
_free.LIBCMT ref: 006ED690

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 2b493b32eae11f8b45071aaa0697c16d5243345fac35f6bc986be6d0c19dda4d
Instruction ID: 4a4eae77ff41be08a513c0b8804d4007b1c52fb82854ff73f8b27ac9009c2b33
Opcode Fuzzy Hash: 2b493b32eae11f8b45071aaa0697c16d5243345fac35f6bc986be6d0c19dda4d
Instruction Fuzzy Hash: 81D1AE719013499FDB11DFA9C881BEEBBF6BF49300F14412EE999AB392D770A8458B10

Uniqueness

Uniqueness Score: -1.00%

Function 00407ED4 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,00407EB2), ref: 00407EE0
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00407EB2), ref: 00407EEB
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00407EB2), ref: 00407EFC
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00407F0E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00407F1C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00407EB2), ref: 00407F3F
DeleteCriticalSection.KERNEL32(0042B3A4,00000007,?,?,00407EB2), ref: 00407F5B
CloseHandle.KERNEL32(00000000,?,?,00407EB2), ref: 00407F6B

Strings

SleepConditionVariableCS, xrefs: 00407F08
WakeAllConditionVariable, xrefs: 00407F14
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00407EE6
kernel32.dll, xrefs: 00407EF7

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: 016823b3472306c2446adbee895464491f79821451c8a60c5d0dae7b471ae6d5
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: 450192B0F44622AFC7209B71AC08B972F98EB48745B554037FD05E22D0DB7CD80287AE

Uniqueness

Uniqueness Score: -1.00%

Function 00417C37 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417C7B

Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F00
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F12
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F24
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F36
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F48
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F5A
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F6C
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F7E
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416F90
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FA2
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FB4
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FC6
Part of subcall function 00416EE3: _free.LIBCMT ref: 00416FD8

_free.LIBCMT ref: 00417C70

Part of subcall function 0041120B: HeapFree.KERNEL32(00000000,00000000,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?), ref: 00411221
Part of subcall function 0041120B: GetLastError.KERNEL32(?,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?,?), ref: 00411233

_free.LIBCMT ref: 00417C92
_free.LIBCMT ref: 00417CA7
_free.LIBCMT ref: 00417CB2
_free.LIBCMT ref: 00417CD4
_free.LIBCMT ref: 00417CE7
_free.LIBCMT ref: 00417CF5
_free.LIBCMT ref: 00417D00
_free.LIBCMT ref: 00417D38
_free.LIBCMT ref: 00417D3F
_free.LIBCMT ref: 00417D5C
_free.LIBCMT ref: 00417D74

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 56b003fe479e81c9aa6578f9f78f15a65b7666d0150a76f06297e44cf1eaa8d9
Instruction ID: 0a90bce982ffb2d323d255e99e8afc4056d2a7d03682c4e155a5deaf63f8602e
Opcode Fuzzy Hash: 56b003fe479e81c9aa6578f9f78f15a65b7666d0150a76f06297e44cf1eaa8d9
Instruction Fuzzy Hash: 20316A316082059BEB31AB7AE845BE773F9BF00355F10495BE059E7261DA39EDC08A28

Uniqueness

Uniqueness Score: -1.00%

Function 006F7E9E Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006F7EE2

Part of subcall function 006F714A: _free.LIBCMT ref: 006F7167
Part of subcall function 006F714A: _free.LIBCMT ref: 006F7179
Part of subcall function 006F714A: _free.LIBCMT ref: 006F718B
Part of subcall function 006F714A: _free.LIBCMT ref: 006F719D
Part of subcall function 006F714A: _free.LIBCMT ref: 006F71AF
Part of subcall function 006F714A: _free.LIBCMT ref: 006F71C1
Part of subcall function 006F714A: _free.LIBCMT ref: 006F71D3
Part of subcall function 006F714A: _free.LIBCMT ref: 006F71E5
Part of subcall function 006F714A: _free.LIBCMT ref: 006F71F7
Part of subcall function 006F714A: _free.LIBCMT ref: 006F7209
Part of subcall function 006F714A: _free.LIBCMT ref: 006F721B
Part of subcall function 006F714A: _free.LIBCMT ref: 006F722D
Part of subcall function 006F714A: _free.LIBCMT ref: 006F723F

_free.LIBCMT ref: 006F7ED7

Part of subcall function 006F1472: HeapFree.KERNEL32(00000000,00000000,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?), ref: 006F1488
Part of subcall function 006F1472: GetLastError.KERNEL32(?,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?,?), ref: 006F149A

_free.LIBCMT ref: 006F7EF9
_free.LIBCMT ref: 006F7F0E
_free.LIBCMT ref: 006F7F19
_free.LIBCMT ref: 006F7F3B
_free.LIBCMT ref: 006F7F4E
_free.LIBCMT ref: 006F7F5C
_free.LIBCMT ref: 006F7F67
_free.LIBCMT ref: 006F7F9F
_free.LIBCMT ref: 006F7FA6
_free.LIBCMT ref: 006F7FC3
_free.LIBCMT ref: 006F7FDB

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 56b003fe479e81c9aa6578f9f78f15a65b7666d0150a76f06297e44cf1eaa8d9
Instruction ID: c20bef77b216598e0059883353e9510f16b39ec46f61efc3239e3d55b5c2ba46
Opcode Fuzzy Hash: 56b003fe479e81c9aa6578f9f78f15a65b7666d0150a76f06297e44cf1eaa8d9
Instruction Fuzzy Hash: CA313D32609209DFEB61AA38D845FB673EAAF41350F14982EF685DB291DF35ED40CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00416FE1 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00417029
_free.LIBCMT ref: 0041704D
_free.LIBCMT ref: 0041705A
_free.LIBCMT ref: 0041707F
_free.LIBCMT ref: 0041708C
_free.LIBCMT ref: 00417095
_free.LIBCMT ref: 0041736F
_free.LIBCMT ref: 00417377

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ce28b3e7f478731dab63ef629cb1a7d3bb7a35925e340e4d93846f35326da72b
Instruction ID: 5c74a9084d358c8f08d00c14a97193523b7a451bcef66af9126319942a22665d
Opcode Fuzzy Hash: ce28b3e7f478731dab63ef629cb1a7d3bb7a35925e340e4d93846f35326da72b
Instruction Fuzzy Hash: 59C15675D40205AFDB20DBA9CC42FDE77F8AB08704F14415AFE05FB282D674D9918B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AED2 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040AFCF
type_info::operator==.LIBVCRUNTIME ref: 0040AFF1
___TypeMatch.LIBVCRUNTIME ref: 0040B100
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B1D2
_UnwindNestedFrames.LIBCMT ref: 0040B256
CallUnexpected.LIBVCRUNTIME ref: 0040B271

Strings

csm, xrefs: 0040AF0F
csm, xrefs: 0040B028
csm, xrefs: 0040AF7C

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: ec55196755e20f33d346f549a9e956c959f3395481c71dffd76d482b2b39f703
Instruction ID: 3e4fdda15c6ceb0ba5e9a65ceba0ef9d7e5600dda90bb0646f196b4531d7df86
Opcode Fuzzy Hash: ec55196755e20f33d346f549a9e956c959f3395481c71dffd76d482b2b39f703
Instruction Fuzzy Hash: FCB16A71800209EFCF19DFA5C8819AFB7B5FF14314B14416AE8157B292D338DA61CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 006EB139 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006EB236
type_info::operator==.LIBVCRUNTIME ref: 006EB258
___TypeMatch.LIBVCRUNTIME ref: 006EB367
IsInExceptionSpec.LIBVCRUNTIME ref: 006EB439
_UnwindNestedFrames.LIBCMT ref: 006EB4BD
CallUnexpected.LIBVCRUNTIME ref: 006EB4D8

Strings

csm, xrefs: 006EB28F
csm, xrefs: 006EB176
csm, xrefs: 006EB1E3

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: e2606f3a926ea35e2a0c531c10d4a87a7da596f456a7f5f93584dffa2e77e165
Instruction ID: 32f00e883b37a9eab8db99ff506f26ef88f7fb16768b84c6ad2abc0bf4542d71
Opcode Fuzzy Hash: e2606f3a926ea35e2a0c531c10d4a87a7da596f456a7f5f93584dffa2e77e165
Instruction Fuzzy Hash: 92B17771802389EFCF19DFA6C8819EFB7B6BF04310B14515AE8116B256D730EA51CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD8 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410BEE

Part of subcall function 0041120B: HeapFree.KERNEL32(00000000,00000000,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?), ref: 00411221
Part of subcall function 0041120B: GetLastError.KERNEL32(?,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?,?), ref: 00411233

_free.LIBCMT ref: 00410BFA
_free.LIBCMT ref: 00410C05
_free.LIBCMT ref: 00410C10
_free.LIBCMT ref: 00410C1B
_free.LIBCMT ref: 00410C26
_free.LIBCMT ref: 00410C31
_free.LIBCMT ref: 00410C3C
_free.LIBCMT ref: 00410C47
_free.LIBCMT ref: 00410C55

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 146b353eb86ba116205ee497b4c0a7fc77e5a01518bcf2ea9a7fd678adf91b29
Instruction ID: 20246564c769554746232b6a60fae7aaf3d1ee9ced076bc3f7acf7c483c0d57c
Opcode Fuzzy Hash: 146b353eb86ba116205ee497b4c0a7fc77e5a01518bcf2ea9a7fd678adf91b29
Instruction Fuzzy Hash: A821857A90010CAFCB51EF95C881DDE7BB9BF08345B0141AAF615EB121EB35EA85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 006F0E3F Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006F0E55

Part of subcall function 006F1472: HeapFree.KERNEL32(00000000,00000000,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?), ref: 006F1488
Part of subcall function 006F1472: GetLastError.KERNEL32(?,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?,?), ref: 006F149A

_free.LIBCMT ref: 006F0E61
_free.LIBCMT ref: 006F0E6C
_free.LIBCMT ref: 006F0E77
_free.LIBCMT ref: 006F0E82
_free.LIBCMT ref: 006F0E8D
_free.LIBCMT ref: 006F0E98
_free.LIBCMT ref: 006F0EA3
_free.LIBCMT ref: 006F0EAE
_free.LIBCMT ref: 006F0EBC

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 146b353eb86ba116205ee497b4c0a7fc77e5a01518bcf2ea9a7fd678adf91b29
Instruction ID: c3e463bc5da10fa2bc1635225d563980f8da27a99ca9dba2c59160d3a9f46a84
Opcode Fuzzy Hash: 146b353eb86ba116205ee497b4c0a7fc77e5a01518bcf2ea9a7fd678adf91b29
Instruction Fuzzy Hash: FA2167B690010CEFCB41EF94C881DEE7BBABF49390B01456AB6559B522DB31DA54CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC54 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00414406), ref: 0041AC6D

Strings

asin, xrefs: 0041AD9A
log10, xrefs: 0041ACAF, 0041ACBE
log, xrefs: 0041ACCA, 0041ACD9
sqrt, xrefs: 0041ADAC
acos, xrefs: 0041ADA3
exp, xrefs: 0041ACEC, 0041AD51
pow, xrefs: 0041AD0B, 0041ADB5, 0041AE02

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: a2694a97514a5fff6f53f913e8de5acd0e8046467914e94f9ed04bf512e47cc7
Instruction ID: 8ace6ab75a8ddcd72d5ea82602c61c27609e60c4e3602adc17d960dd41ff001e
Opcode Fuzzy Hash: a2694a97514a5fff6f53f913e8de5acd0e8046467914e94f9ed04bf512e47cc7
Instruction Fuzzy Hash: A8515D70A0161ACBCF109F69E9481EEBBB5FF05301F908057D490A6664DB7C89B5CB8F

Uniqueness

Uniqueness Score: -1.00%

Function 00417400 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041746E
_free.LIBCMT ref: 0041747A
_free.LIBCMT ref: 004175A3
_free.LIBCMT ref: 004175AE

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2a919b33381763e4c14f93e25115fdc484a95202654337b1e9eaed91b3f5edba
Instruction ID: 457aad3654f1d34946efd4b962122ff51525aaa780933cb46812dada4813fe45
Opcode Fuzzy Hash: 2a919b33381763e4c14f93e25115fdc484a95202654337b1e9eaed91b3f5edba
Instruction Fuzzy Hash: DD610171904305AFDB20DF75C841BEAB7FAAB04710F20456FE955EB281EB78ED818B58

Uniqueness

Uniqueness Score: -1.00%

Function 006F7667 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006F76D5
_free.LIBCMT ref: 006F76E1
_free.LIBCMT ref: 006F780A
_free.LIBCMT ref: 006F7815

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2a919b33381763e4c14f93e25115fdc484a95202654337b1e9eaed91b3f5edba
Instruction ID: 36620890a6bd014f239f4315fbfab8b26707c96002e20c5d457080a0945d9ffb
Opcode Fuzzy Hash: 2a919b33381763e4c14f93e25115fdc484a95202654337b1e9eaed91b3f5edba
Instruction Fuzzy Hash: 0E61C471904209AFDB60EF78C841BBAB7FAAB45750F20446EEA55EB241EB70AD01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405300 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00403010: ___std_exception_copy.LIBVCRUNTIME ref: 0040309F

std::locale::_Init.LIBCPMT ref: 0040540E

Part of subcall function 004073C6: __EH_prolog3.LIBCMT ref: 004073CD
Part of subcall function 004073C6: std::_Lockit::_Lockit.LIBCPMT ref: 004073D8
Part of subcall function 004073C6: std::locale::_Setgloballocale.LIBCPMT ref: 004073F3
Part of subcall function 004073C6: _Yarn.LIBCPMT ref: 00407409
Part of subcall function 004073C6: std::_Lockit::~_Lockit.LIBCPMT ref: 00407449

Part of subcall function 00405C50: std::_Lockit::_Lockit.LIBCPMT ref: 00405C86
Part of subcall function 00405C50: std::_Lockit::_Lockit.LIBCPMT ref: 00405CA9
Part of subcall function 00405C50: std::_Lockit::~_Lockit.LIBCPMT ref: 00405CC9
Part of subcall function 00405C50: std::_Lockit::~_Lockit.LIBCPMT ref: 00405D43

std::locale::_Init.LIBCPMT ref: 004054D1
Concurrency::cancel_current_task.LIBCPMT ref: 004055E8
Concurrency::cancel_current_task.LIBCPMT ref: 004055ED

Part of subcall function 00401670: ___std_exception_copy.LIBVCRUNTIME ref: 004016AE

Strings

6p@, xrefs: 0040537D, 00405606
@[@, xrefs: 0040535F
>p@, xrefs: 0040549E

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$H_prolog3SetgloballocaleYarn
String ID: 6p@$>p@$@[@
API String ID: 591049177-627777953
Opcode ID: c8dd61c265c524224c9d13200dc34178d18bfc881293cdf5f210f9797baec673
Instruction ID: d0fe2f9b06c0c3096d6c04bc92a8f12e5b730b8f57a78d3a047cd22d9b10a7b5
Opcode Fuzzy Hash: c8dd61c265c524224c9d13200dc34178d18bfc881293cdf5f210f9797baec673
Instruction Fuzzy Hash: 6BA148B0A00605DFDB00CF55C594B9ABBF0FF09314F1481AAE809AF792D7B9A984CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041666A Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00416694
_free.LIBCMT ref: 0041676D
_free.LIBCMT ref: 0041679A

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: bdda2ff4606fd8c06eb18b6b1e177a83e4dc5d7ad43b16e776ec4da030460934
Instruction ID: 9eadab490b8eee828b890373d33715c8162dbef672ade0ef4c6ff90d319f3810
Opcode Fuzzy Hash: bdda2ff4606fd8c06eb18b6b1e177a83e4dc5d7ad43b16e776ec4da030460934
Instruction Fuzzy Hash: 8B511971941305AFDB24BF798881AEE7BA8EF41354B12417FE51497281DB3DC9C18B5C

Uniqueness

Uniqueness Score: -1.00%

Function 006F68D1 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 006F68FB
_free.LIBCMT ref: 006F69D4
_free.LIBCMT ref: 006F6A01

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: bdda2ff4606fd8c06eb18b6b1e177a83e4dc5d7ad43b16e776ec4da030460934
Instruction ID: 1e550f81d6823da863daed2d62a7fb2c1e17fc6c314e3fa633dff32d8a9f95c4
Opcode Fuzzy Hash: bdda2ff4606fd8c06eb18b6b1e177a83e4dc5d7ad43b16e776ec4da030460934
Instruction Fuzzy Hash: 1051D97190430DAEDB20AF79C881ABE77E6EF42350B14817EF750AB241EB758941CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407A49 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00407A92
__alloca_probe_16.LIBCMT ref: 00407ABE
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00407AFD
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407B1A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00407B59
__alloca_probe_16.LIBCMT ref: 00407B76
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407BB8
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00407BDB

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 13d8ff21496aef3bc6d4ab7cdd465b88f35650c203049f462a7160e5c045d202
Instruction ID: 461a8a3a6ef7547da60e278c184db6092a0edb482c639742d9b2a82ad38b72c5
Opcode Fuzzy Hash: 13d8ff21496aef3bc6d4ab7cdd465b88f35650c203049f462a7160e5c045d202
Instruction Fuzzy Hash: 8951DF72A04206ABEB205F64CC45FAB3BB9EF44748F10403AB914B62D1D738FD11DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 006E813B Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,006E8119), ref: 006E8147
GetModuleHandleW.KERNEL32(0041DFE0,?,?,006E8119), ref: 006E8152
GetModuleHandleW.KERNEL32(0041E024,?,?,006E8119), ref: 006E8163
GetProcAddress.KERNEL32(00000000,0041E040), ref: 006E8175
GetProcAddress.KERNEL32(00000000,0041E05C), ref: 006E8183
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,006E8119), ref: 006E81A6
RtlDeleteCriticalSection.NTDLL(0042B3A4), ref: 006E81C2
CloseHandle.KERNEL32(0042B3A0,?,?,006E8119), ref: 006E81D2

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: 94518fa486caed77430938fd96a131fbc9861b5df47c921a70756b0e0140c494
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: 7E0192B4B41762AFC6205B62AC08BD63FA9EB48745B554026FD0DD3294DB74C8028769

Uniqueness

Uniqueness Score: -1.00%

Function 006E3727 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0042A018), ref: 006E37B1
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 006E397A
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 006E39A7
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 006E3B85

Strings

.exe, xrefs: 006E3E36, 006E3E4A
L]Z\, xrefs: 006E43BA

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CreateDirectoryPath$FolderTemp
String ID: .exe$L]Z\
API String ID: 13841269-283220038
Opcode ID: d02455a5b5b03beeed55bbd354dca975aef4c80d0ab7e92fca556ceab6ff94ae
Instruction ID: 6ee3bd7feb7e30c2ea378e5ac10151abcc449d78086e31dd61e1edf2289d0bea
Opcode Fuzzy Hash: d02455a5b5b03beeed55bbd354dca975aef4c80d0ab7e92fca556ceab6ff94ae
Instruction Fuzzy Hash: DFE1A071A013A89BDB24DF29CC8DB9DB7B6EF45304F1042D8E409A7292DB759B84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 006E5567 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 006E3277: ___std_exception_copy.LIBVCRUNTIME ref: 006E3306

std::locale::_Init.LIBCPMT ref: 006E5675

Part of subcall function 006E762D: std::_Lockit::_Lockit.LIBCPMT ref: 006E763F
Part of subcall function 006E762D: std::locale::_Setgloballocale.LIBCPMT ref: 006E765A
Part of subcall function 006E762D: _Yarn.LIBCPMT ref: 006E7670
Part of subcall function 006E762D: std::_Lockit::~_Lockit.LIBCPMT ref: 006E76B0

Part of subcall function 006E5EB7: std::_Lockit::_Lockit.LIBCPMT ref: 006E5EED
Part of subcall function 006E5EB7: std::_Lockit::_Lockit.LIBCPMT ref: 006E5F10
Part of subcall function 006E5EB7: std::_Lockit::~_Lockit.LIBCPMT ref: 006E5F30
Part of subcall function 006E5EB7: std::_Lockit::~_Lockit.LIBCPMT ref: 006E5FAA

std::locale::_Init.LIBCPMT ref: 006E5738
Concurrency::cancel_current_task.LIBCPMT ref: 006E584F
Concurrency::cancel_current_task.LIBCPMT ref: 006E5854

Part of subcall function 006E18D7: ___std_exception_copy.LIBVCRUNTIME ref: 006E1915

Strings

tyB, xrefs: 006E55C6
yB, xrefs: 006E586D

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$SetgloballocaleYarn
String ID: tyB$yB
API String ID: 3444572950-4090277438
Opcode ID: 81900c5b591b8bceaef62ac169b389c5466892878688c45eb238215541fa4a28
Instruction ID: 5c413ad18bf3750046937e468b0dbe6736025058dfa9296795b9de47537cd85f
Opcode Fuzzy Hash: 81900c5b591b8bceaef62ac169b389c5466892878688c45eb238215541fa4a28
Instruction Fuzzy Hash: A5A133B0A01745DFEB00CF55C494B9ABBF1BF09314F1481A9E8099F792D7B6AA58CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0041216C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004121F0
__alloca_probe_16.LIBCMT ref: 004122B6
__freea.LIBCMT ref: 00412322

Part of subcall function 0041239F: RtlAllocateHeap.NTDLL(00000000,?,?,?,00408FCB,?,?,?,004010ED,?,00402647,?,?,?), ref: 004123D1

__freea.LIBCMT ref: 0041232B
__freea.LIBCMT ref: 0041234E

Strings

IcA, xrefs: 0041217E

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: IcA
API String ID: 1423051803-3472959039
Opcode ID: 2637360c63104fe046cff1e9b8e2f0ba16b61a34470c6de912b5e531f2fbdefc
Instruction ID: 1950977d2814568fe9bb4cf7d9dcbd07ed19e3208a17c735357738b0687ea313
Opcode Fuzzy Hash: 2637360c63104fe046cff1e9b8e2f0ba16b61a34470c6de912b5e531f2fbdefc
Instruction Fuzzy Hash: B451177250020AAFEB219FA18E41EFF37A9DB80354F14016AFD14E7240D7BCDCA186A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402BE0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00402C63
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00402CAF
__Getctype.LIBCPMT ref: 00402CC8
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00402CE4
std::_Lockit::~_Lockit.LIBCPMT ref: 00402D79

Strings

bad locale name, xrefs: 00402D97

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 069be565d55a661c61edbed158b971d7dbfde38d243bc9d105361173bf9913db
Instruction ID: 12b3ce7203c78814fff3679fd30cc817cd3722e50f9add578c6a5ab530a1e284
Opcode Fuzzy Hash: 069be565d55a661c61edbed158b971d7dbfde38d243bc9d105361173bf9913db
Instruction Fuzzy Hash: 3A51B4B1E042589BDB10DFE5D94578EBBB8AF14304F14417AE804BB3C1E779EA05CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040A9D7
___except_validate_context_record.LIBVCRUNTIME ref: 0040A9DF
_ValidateLocalCookies.LIBCMT ref: 0040AA68
__IsNonwritableInCurrentImage.LIBCMT ref: 0040AA93
_ValidateLocalCookies.LIBCMT ref: 0040AAE8

Strings

csm, xrefs: 0040AA7D

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 66ece1c4fde0f3cdd7e9250f358ed7b7ea2222574db2be345d79688657960270
Instruction ID: f2986a6bc3f46c09c031d34ef0f34bc40770cae5284814f7ea962b93cb6f20f8
Opcode Fuzzy Hash: 66ece1c4fde0f3cdd7e9250f358ed7b7ea2222574db2be345d79688657960270
Instruction Fuzzy Hash: 2041C534B003189BCF10DF69C884A9EBBA1EF44314F14816AE8157B3D2C7399A65CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\7GXKafhbnD.exe, xrefs: 00415BDD
+]A, xrefs: 00415C29

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID: +]A$C:\Users\user\Desktop\7GXKafhbnD.exe
API String ID: 0-1461271748
Opcode ID: 198bd90320f3404315200b0bbccf4769fb2672eb6611ed453687b665b90403a5
Instruction ID: e1a2f3aca899bb96f5e5c4aabdf99fc070aacb9f4a703cdbfcf0cb065cf8ad47
Opcode Fuzzy Hash: 198bd90320f3404315200b0bbccf4769fb2672eb6611ed453687b665b90403a5
Instruction Fuzzy Hash: 93218671504705FFDB206F66CC819EB776CAF8436C710462AF91596290E738DD8187D9

Uniqueness

Uniqueness Score: -1.00%

Function 0041141B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00411486
api-ms-, xrefs: 00411472

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: 12a88eb9a279f7a837e774734dd8d9cfaa2a6478c85343de7e6ccafb54ea9b27
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: 47210871E01220BBDB318B25DC45BDB37989B05F60F210622EE0AAB3B1D738DD8185ED

Uniqueness

Uniqueness Score: -1.00%

Function 004178C2 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041760E: _free.LIBCMT ref: 00417633

_free.LIBCMT ref: 00417910

Part of subcall function 0041120B: HeapFree.KERNEL32(00000000,00000000,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?), ref: 00411221
Part of subcall function 0041120B: GetLastError.KERNEL32(?,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?,?), ref: 00411233

_free.LIBCMT ref: 0041791B
_free.LIBCMT ref: 00417926
_free.LIBCMT ref: 0041797A
_free.LIBCMT ref: 00417985
_free.LIBCMT ref: 00417990
_free.LIBCMT ref: 0041799B

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 031aaa4d563ffc6b60f74ccac05c7ec8e81c0fd0808428b2af7c0d96f72ae9fb
Instruction ID: 54f293cd6e528a7629d252418c8ba80f44aca3995164d8b42d0e239315166fd7
Opcode Fuzzy Hash: 031aaa4d563ffc6b60f74ccac05c7ec8e81c0fd0808428b2af7c0d96f72ae9fb
Instruction Fuzzy Hash: 13116D71544B14AAD632BFB2CC07FCB77BC6F08714F40085EB2A9E6062DE78E5848798

Uniqueness

Uniqueness Score: -1.00%

Function 006F7B29 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F7875: _free.LIBCMT ref: 006F789A

_free.LIBCMT ref: 006F7B77

Part of subcall function 006F1472: HeapFree.KERNEL32(00000000,00000000,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?), ref: 006F1488
Part of subcall function 006F1472: GetLastError.KERNEL32(?,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?,?), ref: 006F149A

_free.LIBCMT ref: 006F7B82
_free.LIBCMT ref: 006F7B8D
_free.LIBCMT ref: 006F7BE1
_free.LIBCMT ref: 006F7BEC
_free.LIBCMT ref: 006F7BF7
_free.LIBCMT ref: 006F7C02

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 031aaa4d563ffc6b60f74ccac05c7ec8e81c0fd0808428b2af7c0d96f72ae9fb
Instruction ID: f9d4ba3d5b31edf9f0b9a39fba5ed1606f6f6e3b4cfca86a5e8b145d3829443a
Opcode Fuzzy Hash: 031aaa4d563ffc6b60f74ccac05c7ec8e81c0fd0808428b2af7c0d96f72ae9fb
Instruction Fuzzy Hash: 8D112E7164470CFAF660B7B0CC0AFEB779E5F41740F40482DB3AA6A052D675E505C694

Uniqueness

Uniqueness Score: -1.00%

Function 00403010 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0040309F

Part of subcall function 00409210: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,004010ED,?,00407175,?,00428ED0,?,?,?,?,004010ED,0042BBA0,0042BBA1), ref: 00409270

Strings

ios_base::eofbit set, xrefs: 00403054
ios_base::badbit set, xrefs: 00403045
ios_base::failbit set, xrefs: 0040304F
`)@, xrefs: 00402FE8, 004030BB
`)@, xrefs: 004030A4

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: `)@$`)@$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-8759529
Opcode ID: db95387e2eb12aa6d71a018d34ca26d6afb4b4962e908a0a7b93bc25922c4c04
Instruction ID: 188a464d84a579594867ed56942a0403cfe04e4d5f18cc0473f0a07916416538
Opcode Fuzzy Hash: db95387e2eb12aa6d71a018d34ca26d6afb4b4962e908a0a7b93bc25922c4c04
Instruction Fuzzy Hash: 4011E4B16043046BC700EF59D802B96B7ECAB54311F50C53FF954A7681EB78EA50CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419B93 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 00419BDB
__fassign.LIBCMT ref: 00419DC0
__fassign.LIBCMT ref: 00419DDD
WriteFile.KERNEL32(?,00411B93,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419E25
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419E65
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419F0D

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 77f9c9ff93759d327823de3aab9426dc39d818423a47676d7b4d42aff055b205
Instruction ID: 2c55dadfefaf3ca61d1e1da2956a485709ef70c8f2b2f75a88353ba414866630
Opcode Fuzzy Hash: 77f9c9ff93759d327823de3aab9426dc39d818423a47676d7b4d42aff055b205
Instruction Fuzzy Hash: 89C18C71D002589FCB14CFA9C8909EDBBB5AF48314F28416AE855FB341D7359D86CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 006F9DFA Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 006F9E42
__fassign.LIBCMT ref: 006FA027
__fassign.LIBCMT ref: 006FA044
WriteFile.KERNEL32(?,006F1DFA,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006FA08C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006FA0CC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 006FA174

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 2ef72b75e2f3af520cdc9e41a1c441cde52fa5ab9ea4c856b94a523294167a89
Instruction ID: 69b9ed6a1444caa85883771f9f78335b1fc6df589c4754257dfae0401ebcbb68
Opcode Fuzzy Hash: 2ef72b75e2f3af520cdc9e41a1c441cde52fa5ab9ea4c856b94a523294167a89
Instruction Fuzzy Hash: 12C17AB1D0025C9FCB15CFE8C8809EDBBBAAF08314F29416AE959FB341D6319946CF65

Uniqueness

Uniqueness Score: -1.00%

Function 006E1FD7 Relevance: 9.3, APIs: 6, Instructions: 311networkCOMMON

Download Yara Rule

APIs

__cftof.LIBCMT ref: 006E2147
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 006E2162
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 006E2185
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 006E21A6
HttpOpenRequestA.WININET(00000000,004277DC,00000000,00000000,00000000,00000000,80400000,00000001), ref: 006E21D7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006E21F2

Part of subcall function 006E1FD7: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 006E1B7C
Part of subcall function 006E1FD7: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 006E1B9B
Part of subcall function 006E1FD7: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 006E1C2F

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Internet$Http$FileOpenRequest$ConnectInfoOptionPointerQueryReadSend__cftof
String ID:
API String ID: 3409182146-0
Opcode ID: 46ce5db825ac90a6076a199849cf70ac86d8de39c1ea31cc9706281557adf2cb
Instruction ID: a90b5f2e1ade5eaa2931f8bc542b0ae33489e194e06733a6defcc4d30be8d85d
Opcode Fuzzy Hash: 46ce5db825ac90a6076a199849cf70ac86d8de39c1ea31cc9706281557adf2cb
Instruction Fuzzy Hash: A1A11771E012459FDB24DFA9CC95BEEBBBAEF44310F208128E911B72C1D7745A45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006E7CB0 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 006E7CF9
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 006E7D64
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E7D81
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 006E7DC0
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E7E1F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 006E7E42

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction ID: 777d06c2f954319ba07c36446a652ca0041a3909c0bfc85e6b085de6c00eb4a5
Opcode Fuzzy Hash: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction Fuzzy Hash: 5B51D37290638AAFDB205F62DC45FEB3BABEF44750F214468F9049A250E730CD11CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006E5EB7 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E5EED
std::_Lockit::_Lockit.LIBCPMT ref: 006E5F10
std::_Lockit::~_Lockit.LIBCPMT ref: 006E5F30
std::_Facet_Register.LIBCPMT ref: 006E5F92
std::_Lockit::~_Lockit.LIBCPMT ref: 006E5FAA
Concurrency::cancel_current_task.LIBCPMT ref: 006E5FCD

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 14955ef08077442e71b7b20152de4b9cb362dfb768348402aae3af33e0dd06ca
Instruction ID: de372d34982076af370d57d1ec00d97b3a29f4564ce5e0b25744bc36dfa8dfc9
Opcode Fuzzy Hash: 14955ef08077442e71b7b20152de4b9cb362dfb768348402aae3af33e0dd06ca
Instruction Fuzzy Hash: 1231AE71E06795CFCB20DF55C880AAEB7B6EB04724F154169E806A7391EB34AD06CFC9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB64 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040AB5B,004091CF,00408809), ref: 0040AB72
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040AB80
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040AB99
SetLastError.KERNEL32(00000000,0040AB5B,004091CF,00408809), ref: 0040ABEB

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 157c8177ba428ac5d85b8c0c80895e907735d8f6735be9bf022dca50727cb460
Instruction ID: cf838128cf524efd5aaa77568346c81d9b6004861da97b418f61cd0e03c4ee1c
Opcode Fuzzy Hash: 157c8177ba428ac5d85b8c0c80895e907735d8f6735be9bf022dca50727cb460
Instruction Fuzzy Hash: 7901B5322183126FD6352EB5AC86D973A69EB11779720023FF610751E2EF7D5C23518E

Uniqueness

Uniqueness Score: -1.00%

Function 006EADCB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006EADC2,006E9436,006E8A70), ref: 006EADD9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006EADE7
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006EAE00
SetLastError.KERNEL32(00000000,006EADC2,006E9436,006E8A70), ref: 006EAE52

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction ID: df7a6a25b6cf20c1efc2823bf2d2b9d9d59106ff607d4518f25b13850c559689
Opcode Fuzzy Hash: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction Fuzzy Hash: 2301713220B3915FE6742EBBBC8999B2B87EB01779B20023DF510551E2EE195C13A55A

Uniqueness

Uniqueness Score: -1.00%

Function 006F5E3F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\7GXKafhbnD.exe, xrefs: 006F5E44

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\7GXKafhbnD.exe
API String ID: 0-2572051030
Opcode ID: 30d33cba65ca250a908cd8d5e9783447369ba6d72449f503970839a3365a4320
Instruction ID: 219b6654c0a777fb77976ccaa92383f733f2b87136c37cfa3f98342a9bf47981
Opcode Fuzzy Hash: 30d33cba65ca250a908cd8d5e9783447369ba6d72449f503970839a3365a4320
Instruction Fuzzy Hash: 9E2104B1605A09BFDB20AF65CC81CBB779FAF043A47108519F72AD3241E730ED428BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD37 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BDF8,?,?,0042B440,00000000,?,0040BF23,00000004,InitializeCriticalSectionEx,0041EB20,InitializeCriticalSectionEx,00000000), ref: 0040BDC7

Strings

api-ms-, xrefs: 0040BD87

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: af6b5a90c0a22965d33dedb40b3e328221aa1f20942d6f36ae19616accaa661a
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: B811A376A40621ABDB629B689C41B9AB794EF45760F140232E900FB3C0D778ED0186ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040C673 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040C668,?,?,0040C630,00000000,?,?), ref: 0040C688
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040C69B
FreeLibrary.KERNEL32(00000000,?,?,0040C668,?,?,0040C630,00000000,?,?), ref: 0040C6BE

Strings

CorExitProcess, xrefs: 0040C693
mscoree.dll, xrefs: 0040C681

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction ID: 3743c946abf04b571985e719ff32ba7d87b0237dd4bfc16b381c2e6a1fb24411
Opcode Fuzzy Hash: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction Fuzzy Hash: A7F03771900218FBDB119B61DD0ABEEBE75EB05755F104172F805B22E0DB798E41DB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040F990 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410CF0: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
Part of subcall function 00410CF0: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

_free.LIBCMT ref: 0040FC7B
_free.LIBCMT ref: 0040FC94
_free.LIBCMT ref: 0040FCD2
_free.LIBCMT ref: 0040FCDB
_free.LIBCMT ref: 0040FCE7

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: db336a58fe3f15f07a1e441cd47a4110a3ca6b7c26edbaf1ec6798b70e100edd
Instruction ID: cdef655f55d278a06c374c02c22abac9519a17fd3fbf26dfb06ba4796a36f040
Opcode Fuzzy Hash: db336a58fe3f15f07a1e441cd47a4110a3ca6b7c26edbaf1ec6798b70e100edd
Instruction Fuzzy Hash: D7B14B75A012199FDB34DF18C885AAAB3B5FF48304F5045BEE809A7790D738AE94CF48

Uniqueness

Uniqueness Score: -1.00%

Function 006EFBF7 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F0F57: GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
Part of subcall function 006F0F57: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

_free.LIBCMT ref: 006EFEE2
_free.LIBCMT ref: 006EFEFB
_free.LIBCMT ref: 006EFF39
_free.LIBCMT ref: 006EFF42
_free.LIBCMT ref: 006EFF4E

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: b8089ccb17955fe7bdb6a199361029b00dc9606cc3fb54ab41d9c97875e94d82
Instruction ID: 4cd6f1efb1bc3c18857d3e97aaa5452bf3efafd900bd2f5e2bcd66f09942b1c9
Opcode Fuzzy Hash: b8089ccb17955fe7bdb6a199361029b00dc9606cc3fb54ab41d9c97875e94d82
Instruction Fuzzy Hash: 88B16C759023599FDB24DF19C884AADB3B6FF48304F6045AEE849A73A1D730AE90CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041A86C Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0041A90F
__alloca_probe_16.LIBCMT ref: 0041A9C5
__alloca_probe_16.LIBCMT ref: 0041AA5B
__freea.LIBCMT ref: 0041AAC6
__freea.LIBCMT ref: 0041AAD2

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: f6ed4d8f5303aa985ba2efe43bcb6e767d890258288c8a3729051e7cc7532909
Instruction ID: d7ee1b3c7897d4ea8860d2300486eb02d3bf24a8c92b40462b47c3f6f6fbaa00
Opcode Fuzzy Hash: f6ed4d8f5303aa985ba2efe43bcb6e767d890258288c8a3729051e7cc7532909
Instruction Fuzzy Hash: E481F5B2D022099BDF209E658941AEF7BB59F49350F19045BE804A7341E639CCE5CBAB

Uniqueness

Uniqueness Score: -1.00%

Function 0040F505 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041239F: RtlAllocateHeap.NTDLL(00000000,?,?,?,00408FCB,?,?,?,004010ED,?,00402647,?,?,?), ref: 004123D1

_free.LIBCMT ref: 0040F614
_free.LIBCMT ref: 0040F62B
_free.LIBCMT ref: 0040F648
_free.LIBCMT ref: 0040F663
_free.LIBCMT ref: 0040F67A

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: e36ba2f1517e8e26bedf8e7253ec02df4cdf19b0bac6ebaee4fde479f90ecddb
Instruction ID: 4f66c076a900b3a323d0d91456d6b9f5e32e7038d09ef773877db939b56a2e22
Opcode Fuzzy Hash: e36ba2f1517e8e26bedf8e7253ec02df4cdf19b0bac6ebaee4fde479f90ecddb
Instruction Fuzzy Hash: 4F51B571A00604AFDB31DF29CC41B6A77F4EF44714B144A7EE805E76A1E739E9468B48

Uniqueness

Uniqueness Score: -1.00%

Function 006EF76C Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F2606: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 006F2638

_free.LIBCMT ref: 006EF87B
_free.LIBCMT ref: 006EF892
_free.LIBCMT ref: 006EF8AF
_free.LIBCMT ref: 006EF8CA
_free.LIBCMT ref: 006EF8E1

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 7ba6a106690a51f17d54d2cbac189c9e94cde222f0452babe8cd1ebdb73564e5
Instruction ID: 98ffc4f6456f6482139e6cc0e230934e52a7631ec0f401333bc4244dcffb3539
Opcode Fuzzy Hash: 7ba6a106690a51f17d54d2cbac189c9e94cde222f0452babe8cd1ebdb73564e5
Instruction Fuzzy Hash: 5951E072A01744AFDB20DF2ACC41AAB73F6EF44720B14467EE849DB290E731EA018B44

Uniqueness

Uniqueness Score: -1.00%

Function 006E2E47 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E2ECA
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 006E2F16
__Getctype.LIBCPMT ref: 006E2F2F
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 006E2F4B
std::_Lockit::~_Lockit.LIBCPMT ref: 006E2FE0

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 1840309910-0
Opcode ID: c21465358b14c326dc3dab8748043fd294edffa2d663c07747d87da63a87a989
Instruction ID: 031d3b05e22814d0069aeb74c242e0b4a9eaf5cc15328b5c7f4a4b57d620d986
Opcode Fuzzy Hash: c21465358b14c326dc3dab8748043fd294edffa2d663c07747d87da63a87a989
Instruction Fuzzy Hash: 5F51B1B1D053889BDF50DFE5D8457DEBBBAAF14710F144129E808AB381E734A909CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00417397 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004173AF

Part of subcall function 0041120B: HeapFree.KERNEL32(00000000,00000000,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?), ref: 00411221
Part of subcall function 0041120B: GetLastError.KERNEL32(?,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?,?), ref: 00411233

_free.LIBCMT ref: 004173C1
_free.LIBCMT ref: 004173D3
_free.LIBCMT ref: 004173E5
_free.LIBCMT ref: 004173F7

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 06e671d080f535b526906657be4b97d3edf8845f9ab28154fe39a2849aa6d09c
Instruction ID: caaf0a40e1c1992152b22f16d496b48ca3bd928164dd6675924e19ca68c5838c
Opcode Fuzzy Hash: 06e671d080f535b526906657be4b97d3edf8845f9ab28154fe39a2849aa6d09c
Instruction Fuzzy Hash: 6DF04432608114678531DB55E48AC9773F9BB04764794080BFC64E7610CB38FCD18A6D

Uniqueness

Uniqueness Score: -1.00%

Function 006F75FE Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006F7616

Part of subcall function 006F1472: HeapFree.KERNEL32(00000000,00000000,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?), ref: 006F1488
Part of subcall function 006F1472: GetLastError.KERNEL32(?,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?,?), ref: 006F149A

_free.LIBCMT ref: 006F7628
_free.LIBCMT ref: 006F763A
_free.LIBCMT ref: 006F764C
_free.LIBCMT ref: 006F765E

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 06e671d080f535b526906657be4b97d3edf8845f9ab28154fe39a2849aa6d09c
Instruction ID: eb26c3a3af5a37cd2762cbc30d14d8ffad2be428a8eebe7deb72633e2ca99764
Opcode Fuzzy Hash: 06e671d080f535b526906657be4b97d3edf8845f9ab28154fe39a2849aa6d09c
Instruction Fuzzy Hash: 43F06872604618EB8560DB5CE886C7777DBAB46760BA4881EF684DB611CB34FC50865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE7D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\7GXKafhbnD.exe, xrefs: 0040DEC0, 0040DEC7, 0040DEFD
%x, xrefs: 0040DECE

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\7GXKafhbnD.exe$%x
API String ID: 0-166580061
Opcode ID: d61d2337c0a066732466a40b08d4b5b158ff5e2055b671399b5c9ecc04fca5d0
Instruction ID: 5c452c4ea0aa90061e0e6cf3f0d98146b50951ad503a8d2bcb6fb3848f57d979
Opcode Fuzzy Hash: d61d2337c0a066732466a40b08d4b5b158ff5e2055b671399b5c9ecc04fca5d0
Instruction Fuzzy Hash: B3418271E00215ABCB219FDADC8199FBBB8EF85314B10407BF905A7391D7789A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006EE0E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\7GXKafhbnD.exe, xrefs: 006EE127, 006EE12E, 006EE164
%x, xrefs: 006EE135

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\7GXKafhbnD.exe$%x
API String ID: 0-166580061
Opcode ID: d61d2337c0a066732466a40b08d4b5b158ff5e2055b671399b5c9ecc04fca5d0
Instruction ID: e60559aca943f0ed310a55f2b7fec7f6cf6f9b39cfe0edd23f3830b9b9fb1f69
Opcode Fuzzy Hash: d61d2337c0a066732466a40b08d4b5b158ff5e2055b671399b5c9ecc04fca5d0
Instruction Fuzzy Hash: 1B41A271A01398AFCB21DF9A9C819EEBBAAEB85310B10006AF504D7351D7729E45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00413001 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00413074
GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,0000FDE9), ref: 004130D1
__freea.LIBCMT ref: 004130DA

Part of subcall function 0041239F: RtlAllocateHeap.NTDLL(00000000,?,?,?,00408FCB,?,?,?,004010ED,?,00402647,?,?,?), ref: 004123D1

Strings

IcA, xrefs: 00413014

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: AllocateHeapStringType__alloca_probe_16__freea
String ID: IcA
API String ID: 2035984020-3472959039
Opcode ID: bea72fa37ae53a4e1ff7a48dbf192bb966cf23ba8003c74617d405021728c872
Instruction ID: a76d44ff79c2d0ca4c11d2a54272b8dd0505ca035a99a787ff66750df05ebe62
Opcode Fuzzy Hash: bea72fa37ae53a4e1ff7a48dbf192bb966cf23ba8003c74617d405021728c872
Instruction Fuzzy Hash: C131E17190020AABDF209F65CC45EEF7FA9EF88315F05412AFC08A7245D7388E91CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006E3547 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(0042A018), ref: 006E3573

Part of subcall function 006E34A7: OpenProcess.KERNEL32(00000410,00000000), ref: 006E34D2
Part of subcall function 006E34A7: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006E34ED
Part of subcall function 006E34A7: CloseHandle.KERNEL32(00000000), ref: 006E34F4

GetCurrentProcessId.KERNEL32 ref: 006E358F

Part of subcall function 006E33A7: OpenProcess.KERNEL32(00000410,00000000), ref: 006E3407
Part of subcall function 006E33A7: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 006E3424
Part of subcall function 006E33A7: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 006E3441
Part of subcall function 006E33A7: CloseHandle.KERNEL32(00000000), ref: 006E3448

ShellExecuteA.SHELL32(00000000,00000000,004278B0,00000000,00000000,00000000), ref: 006E3630

Strings

/c taskkill /im ", xrefs: 006E35A3

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentHandleModuleNameOpen$BaseEnumExecuteFileModulesShell
String ID: /c taskkill /im "
API String ID: 3296006795-2842225094
Opcode ID: 1fc0ff93ad068b49a9079ccaac3e6d9fc4ff41ba9429363fd9a7e6fe0b6bfd17
Instruction ID: cf01732fbbe3a6baed5a7c8853e74a12817ac3f3d47583ff5f0809f7b59ba1f1
Opcode Fuzzy Hash: 1fc0ff93ad068b49a9079ccaac3e6d9fc4ff41ba9429363fd9a7e6fe0b6bfd17
Instruction Fuzzy Hash: 1A215170E063989AC741EBA5CC59BEDBBB6BB14700F90406CE105A71D2EF745B05CB59

Uniqueness

Uniqueness Score: -1.00%

Function 006E3277 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006E3306

Part of subcall function 006E9477: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,006E1354,?,006E73DC,?,00428ED0,?,?,?,?,006E1354,0042BBA0,0042BBA1), ref: 006E94D7

Strings

ios_base::eofbit set, xrefs: 006E32BB
ios_base::badbit set, xrefs: 006E32AC
ios_base::failbit set, xrefs: 006E32B6

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: c3c2c6521a3a80aaa4a46e2c71cbd8eb40cc683961fb3c8d77565366e1fd92ee
Instruction ID: 7b954123dfddc1006e52a37d6e29fb87f796e5e62fbd5a12a087715a45a5500e
Opcode Fuzzy Hash: c3c2c6521a3a80aaa4a46e2c71cbd8eb40cc683961fb3c8d77565366e1fd92ee
Instruction Fuzzy Hash: CF1136B1A043486FC700DF5AD806ADAB7E9AF40310F54C51FFA958B781EB74EA00CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5F3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 0041B65E
_free.LIBCMT ref: 0041B66D
_free.LIBCMT ref: 0041B67C

Strings

dhA, xrefs: 0041B648

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable
String ID: dhA
API String ID: 1464849758-476064327
Opcode ID: d5cebeb7aeb8f4cdd32217f9cf5b8c7c4a39388c9ec9516c46f6fa68eb1e6d0e
Instruction ID: 1f16d45366945dc364b29743deaa503eca4f158c40a53ee823deea83250435ac
Opcode Fuzzy Hash: d5cebeb7aeb8f4cdd32217f9cf5b8c7c4a39388c9ec9516c46f6fa68eb1e6d0e
Instruction Fuzzy Hash: 61113071D00218ABDB11AFAA9881ADEFFB8BF08314F54416FE414B2211D7385A85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC7B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AD42
___AdjustPointer.LIBCMT ref: 0040AD65
___AdjustPointer.LIBCMT ref: 0040AE01

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 5a8ee22a8f29757f5044c13183e6902c506c4249b603b929d0e8055c39143d1f
Instruction ID: 9c36d0f833dd05382b6bf7eb117379135b33c56d61c3fa5a7d3a725c564ca461
Opcode Fuzzy Hash: 5a8ee22a8f29757f5044c13183e6902c506c4249b603b929d0e8055c39143d1f
Instruction Fuzzy Hash: 0551F171604702AFEB288F11D840BAA77A6EF40305F14403FEC426BBD1D739AC61DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 006EAEE2 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006EAFA9
___AdjustPointer.LIBCMT ref: 006EAFCC
___AdjustPointer.LIBCMT ref: 006EB068

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 5a8ee22a8f29757f5044c13183e6902c506c4249b603b929d0e8055c39143d1f
Instruction ID: ffad17336a6598d1030e5d02f7629beefd5fde3218fa60d2bccc03015c660286
Opcode Fuzzy Hash: 5a8ee22a8f29757f5044c13183e6902c506c4249b603b929d0e8055c39143d1f
Instruction Fuzzy Hash: D851DCB2602786AFEB298F56C841BABB7A6FF00310F24402DE82547391E731FC85D795

Uniqueness

Uniqueness Score: -1.00%

Function 00415544 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040D908: _free.LIBCMT ref: 0040D916

Part of subcall function 00415284: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00412318,?,00000000,00000000), ref: 00415330

GetLastError.KERNEL32 ref: 004155AC
__dosmaperr.LIBCMT ref: 004155B3
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 004155F2
__dosmaperr.LIBCMT ref: 004155F9

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: d64d3c2098a6a9b8273a93b6fc8c134211848d22d30f7206154fa5c6b3b2e272
Instruction ID: 6347233f6168fadf144784342135ced26238212edeb0dc16f227fba2447f7ae3
Opcode Fuzzy Hash: d64d3c2098a6a9b8273a93b6fc8c134211848d22d30f7206154fa5c6b3b2e272
Instruction Fuzzy Hash: B521FD71604A15FFD720AF628C809EBB7AEEF8436C710862FF91997250D738DD818798

Uniqueness

Uniqueness Score: -1.00%

Function 006F57AB Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 006EDB6F: _free.LIBCMT ref: 006EDB7D

Part of subcall function 006F54EB: WideCharToMultiByte.KERNEL32(00427803,00000000,006ED0F5,00000000,00000000,00000000,00000000,0000FDE9,00427803,00000000,006ED0F5,?,006F2E0F,?,00000000,00000000), ref: 006F5597

GetLastError.KERNEL32 ref: 006F5813
__dosmaperr.LIBCMT ref: 006F581A
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 006F5859
__dosmaperr.LIBCMT ref: 006F5860

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 55676ff6f6c8df462ab69a80cca1e51e84f50778a1113a09f825784095af388f
Instruction ID: 35a7ea9c681969c435f839c0ef3f323bfa7bcd4dad330a10f817a38320712b17
Opcode Fuzzy Hash: 55676ff6f6c8df462ab69a80cca1e51e84f50778a1113a09f825784095af388f
Instruction Fuzzy Hash: 2721B671600B1DBFDB20AF669C819BB779EEF043A47108528FB2A97251E730ED418794

Uniqueness

Uniqueness Score: -1.00%

Function 006F1682 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: 3d7f22039d4709101c249ce4cf7d2f8495bace07cb42c9cd14cad44fe01f494d
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: 7D212775B4122CFBDB31AB249C41ABA375AAF06BE0F240124EE09BF391D730DD0285E4

Uniqueness

Uniqueness Score: -1.00%

Function 00410CF0 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C421,?,00401EE5,?,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410CF5
_free.LIBCMT ref: 00410D52
_free.LIBCMT ref: 00410D88
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FA0,00000000,?,00000000,00000000,00401EE5), ref: 00410D93

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e54c2cbe798bef4aa944fd970f9fd026e286f94b0286f2d4ca1f7f807ab89bcf
Instruction ID: 336999547507b17c534a295f6f24491069cc1eb4cf19c45d27e08cdfd6fd6500
Opcode Fuzzy Hash: e54c2cbe798bef4aa944fd970f9fd026e286f94b0286f2d4ca1f7f807ab89bcf
Instruction Fuzzy Hash: 9311E7323001016B962167B67C81EF7265AEBC1379B24023BF725922F1DEBC9CD2812D

Uniqueness

Uniqueness Score: -1.00%

Function 006F0F57 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(006E214C,?,006E2150,006EC688,?,006E214C,?,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0F5C
_free.LIBCMT ref: 006F0FB9
_free.LIBCMT ref: 006F0FEF
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006F1207,00000000,?,00000000,00000000,006E214C), ref: 006F0FFA

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e54c2cbe798bef4aa944fd970f9fd026e286f94b0286f2d4ca1f7f807ab89bcf
Instruction ID: 7e5bdf31854965884fa87b1dbbe7a6e0b7f84c85f9e87c6ffd743f5e080d261d
Opcode Fuzzy Hash: e54c2cbe798bef4aa944fd970f9fd026e286f94b0286f2d4ca1f7f807ab89bcf
Instruction Fuzzy Hash: 3F11207130520EAFE67167755C91D7A159F9BC23B1F24023CFF189A2D6DD618C12915C

Uniqueness

Uniqueness Score: -1.00%

Function 006E33A7 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 006E3407
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 006E3424
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 006E3441
CloseHandle.KERNEL32(00000000), ref: 006E3448

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Process$BaseCloseEnumHandleModuleModulesNameOpen
String ID:
API String ID: 4241681289-0
Opcode ID: 8795d4967dca619c96a055c70be1b26b48a783d067638cc2ba7c892b45691f89
Instruction ID: e5278874f0ea78ed9f99dab3b3facb07d8a6b193f9bc30f82c50ec6bcbb36987
Opcode Fuzzy Hash: 8795d4967dca619c96a055c70be1b26b48a783d067638cc2ba7c892b45691f89
Instruction Fuzzy Hash: 7421F575E01219ABD721DF55CC05BE9BBB8EF08300F0041E9E64897280DBB15BC6CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00410E47 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C3B6,004123E2,?,?,00408FCB,?,?,?,004010ED,?,00402647,?,?), ref: 00410E4C
_free.LIBCMT ref: 00410EA9
_free.LIBCMT ref: 00410EDF
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00408FCB,?,?,?,004010ED,?,00402647,?,?,?), ref: 00410EEA

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c592833304194783dd442cc7130ab8ab532a2180133b69e2252bfbcbe76adc6e
Instruction ID: 763cbb7542123a06d5cf898bc1e20cb3386530d4258fa8cd7a81de5a57c8d76b
Opcode Fuzzy Hash: c592833304194783dd442cc7130ab8ab532a2180133b69e2252bfbcbe76adc6e
Instruction Fuzzy Hash: FC1129323003016BD72167776C81DFB355AE7C4379B64063FF728922E1DAA98CD2815D

Uniqueness

Uniqueness Score: -1.00%

Function 006F10AE Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,006EC61D,006F2649,?,?,006E9232,?,?,?,006E1354,?,006E28AE,?,?), ref: 006F10B3
_free.LIBCMT ref: 006F1110
_free.LIBCMT ref: 006F1146
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,006E9232,?,?,?,006E1354,?,006E28AE,?,?,?), ref: 006F1151

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c592833304194783dd442cc7130ab8ab532a2180133b69e2252bfbcbe76adc6e
Instruction ID: c9fcb670fd759fa48a9e91c1d5b6592cb11f44a3f03c829714d4582b311d6550
Opcode Fuzzy Hash: c592833304194783dd442cc7130ab8ab532a2180133b69e2252bfbcbe76adc6e
Instruction Fuzzy Hash: 4A112971300209EB966167795C92D76224F9BC33F5F60023CF7289E2D5DE618C22415C

Uniqueness

Uniqueness Score: -1.00%

Function 006EBF9E Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,006EC05F,?,?,0042B440,00000000,?,006EC18A,00000004,0041EB28,0041EB20,0041EB28,00000000), ref: 006EC02E

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: fd3cc5a1d69cfa69777aaa678fc6a7631c5c6ac09da6984e8aad2bff907c5e6a
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: C611E371E02361EBDB228B6A9C45B997795AF057B4F140120F910AB381D761ED028AE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCFA Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0041B7D6,?,00000001,?,00000001,?,00419F6A,?,?,00000001), ref: 0041BD11
GetLastError.KERNEL32(?,0041B7D6,?,00000001,?,00000001,?,00419F6A,?,?,00000001,?,00000001,?,0041A4B6,00411B93), ref: 0041BD1D

Part of subcall function 0041BCE3: CloseHandle.KERNEL32(FFFFFFFE,0041BD2D,?,0041B7D6,?,00000001,?,00000001,?,00419F6A,?,?,00000001,?,00000001), ref: 0041BCF3

___initconout.LIBCMT ref: 0041BD2D

Part of subcall function 0041BCA5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041BCD4,0041B7C3,00000001,?,00419F6A,?,?,00000001,?), ref: 0041BCB8

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0041B7D6,?,00000001,?,00000001,?,00419F6A,?,?,00000001,?), ref: 0041BD42

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: 1bcd358bb5c6db5ba3375587bb55991f316f550fe01b628ab2ed5e277789abdd
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: 64F01C36600124BBCF221FD2EC099CA3F26FF093A4F008025FA0985630DB368960DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 006FBF61 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,006FBA3D,?,00000001,?,00000001,?,006FA1D1,?,?,00000001), ref: 006FBF78
GetLastError.KERNEL32(?,006FBA3D,?,00000001,?,00000001,?,006FA1D1,?,?,00000001,?,00000001,?,006FA71D,006F1DFA), ref: 006FBF84

Part of subcall function 006FBF4A: CloseHandle.KERNEL32(0042AA20,006FBF94,?,006FBA3D,?,00000001,?,00000001,?,006FA1D1,?,?,00000001,?,00000001), ref: 006FBF5A

___initconout.LIBCMT ref: 006FBF94

Part of subcall function 006FBF0C: CreateFileW.KERNEL32(00426D28,40000000,00000003,00000000,00000003,00000000,00000000,006FBF3B,006FBA2A,00000001,?,006FA1D1,?,?,00000001,?), ref: 006FBF1F

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,006FBA3D,?,00000001,?,00000001,?,006FA1D1,?,?,00000001,?), ref: 006FBFA9

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: 966ca0e6633c2991bb2b162737cca7e6e34b02243f5537fbaf7afd4136f273c5
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: 79F01C36911129BBCF222FD1DC099DA3F26FF093A4F108020FA0985231CB328920DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00408044 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00407FE1,00000064), ref: 00408067
LeaveCriticalSection.KERNEL32(0042B3A4,0042BBB8,?,00407FE1,00000064,?,?,?,0040104D,0042BBB8), ref: 00408071
WaitForSingleObjectEx.KERNEL32(0042BBB8,00000000,?,00407FE1,00000064,?,?,?,0040104D,0042BBB8), ref: 00408082
EnterCriticalSection.KERNEL32(0042B3A4,?,00407FE1,00000064,?,?,?,0040104D,0042BBB8), ref: 00408089

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction ID: 49486f4f4883abf8919830bba33126782bc185f4a02c3c825d4a9278514d0b70
Opcode Fuzzy Hash: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction Fuzzy Hash: 1CE06D31A41134EBCB215B60EC08B993F25EB08725B948036FD4962164CB7508129BDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7F7 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E800

Part of subcall function 0041120B: HeapFree.KERNEL32(00000000,00000000,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?), ref: 00411221
Part of subcall function 0041120B: GetLastError.KERNEL32(?,?,00417638,?,00000000,?,?,?,004178DB,?,00000007,?,?,00417DCE,?,?), ref: 00411233

_free.LIBCMT ref: 0040E813
_free.LIBCMT ref: 0040E824
_free.LIBCMT ref: 0040E835

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b6d29eedf7995f32b7f6f23ad4358a8a126b9bf3a88d4ffd0e5b1b27680dad88
Instruction ID: ca1d00f1303c29faa11bb99f372530243f9853145a9f44e25f3938e08f157649
Opcode Fuzzy Hash: b6d29eedf7995f32b7f6f23ad4358a8a126b9bf3a88d4ffd0e5b1b27680dad88
Instruction Fuzzy Hash: 7FE0B6BAA10124DA8B326F26BC128893F71F7447053C506EBF92062A35DB391553ABCD

Uniqueness

Uniqueness Score: -1.00%

Function 006EEA5E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006EEA67

Part of subcall function 006F1472: HeapFree.KERNEL32(00000000,00000000,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?), ref: 006F1488
Part of subcall function 006F1472: GetLastError.KERNEL32(?,?,006F789F,?,00000000,?,?,?,006F7B42,?,00000007,?,?,006F8035,?,?), ref: 006F149A

_free.LIBCMT ref: 006EEA7A
_free.LIBCMT ref: 006EEA8B
_free.LIBCMT ref: 006EEA9C

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b6d29eedf7995f32b7f6f23ad4358a8a126b9bf3a88d4ffd0e5b1b27680dad88
Instruction ID: 15548c7ad230fd410b4d0adb4a3877d1c53de8d82a26d7196cf0675d87687934
Opcode Fuzzy Hash: b6d29eedf7995f32b7f6f23ad4358a8a126b9bf3a88d4ffd0e5b1b27680dad88
Instruction Fuzzy Hash: 69E0BF76A10128DA86716F34BC0185A3FA2F7857403C581AFF94016A35D7351513ABCD

Uniqueness

Uniqueness Score: -1.00%

Function 00402740 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004028D6
___std_exception_destroy.LIBVCRUNTIME ref: 00402970

Strings

`)@, xrefs: 0040291C

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: `)@
API String ID: 2970364248-2232208457
Opcode ID: 6a5dc8365541f24db1f7c3df6a9181475b643c9adbdb4071f432a5c7c3a05dc5
Instruction ID: ac45e890ac318fe1441aeaed3d478489b15d30552f73d1dc28ab67e118afd04a
Opcode Fuzzy Hash: 6a5dc8365541f24db1f7c3df6a9181475b643c9adbdb4071f432a5c7c3a05dc5
Instruction Fuzzy Hash: 4471A371E002089BDB04DF98C985BDDFBB5EF49314F14826EE805B7381D778A944CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0040D67D

Strings

pow, xrefs: 0040D655, 0040D672

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 78497a628aaa6ebb36d3db12d1b15ff34a8a8ca80d1073ba171720b7efa9805d
Instruction ID: f5bdda9fd15c6fde8888886a929c39ddb570ebec401ded4dc9daf6f67689c7ef
Opcode Fuzzy Hash: 78497a628aaa6ebb36d3db12d1b15ff34a8a8ca80d1073ba171720b7efa9805d
Instruction Fuzzy Hash: 67517C71E0910196CB117B58D9013EB2B949B80751F304D7BE4D9533E9EB3D8CDA9E8E

Uniqueness

Uniqueness Score: -1.00%

Function 006ED854 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 006ED8E4

Strings

pow, xrefs: 006ED8BC, 006ED8D9

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 78497a628aaa6ebb36d3db12d1b15ff34a8a8ca80d1073ba171720b7efa9805d
Instruction ID: 4ba60961b4496cfbc904d6e8fde1cd611d00ef81091592587787b0a63a00927a
Opcode Fuzzy Hash: 78497a628aaa6ebb36d3db12d1b15ff34a8a8ca80d1073ba171720b7efa9805d
Instruction Fuzzy Hash: E8519061A0B34996CB11B719CD413FB3796EB80710F204D68E1D9467EAEF348CD69A4A

Uniqueness

Uniqueness Score: -1.00%

Function 00415F24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0000FDE9,?,0000000C,00000000,00000000), ref: 00415F56

Strings

, xrefs: 00415F9B
IcA, xrefs: 00415F3B

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Info
String ID: $IcA
API String ID: 1807457897-418586461
Opcode ID: 139fd9dcbceff4e401631a121c28c3c6717b70b14dd95d6e73d502b43e0977f9
Instruction ID: 87e02c964924ab18b4966756153d2190fdef03c6898cc9f2c41407806805c0e0
Opcode Fuzzy Hash: 139fd9dcbceff4e401631a121c28c3c6717b70b14dd95d6e73d502b43e0977f9
Instruction Fuzzy Hash: 5B412D715042589FDB21CB18CD84BF77FEE9B49308F2404AEE58AC7142D279DAC59B29

Uniqueness

Uniqueness Score: -1.00%

Function 006EAC07 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006EAC46
__IsNonwritableInCurrentImage.LIBCMT ref: 006EACFA

Strings

csm, xrefs: 006EACE4

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 66ece1c4fde0f3cdd7e9250f358ed7b7ea2222574db2be345d79688657960270
Instruction ID: 72e99fdd3586cdfd0764fa24ed6a02b465bb892631b3fe5ad1e48967fcb105c0
Opcode Fuzzy Hash: 66ece1c4fde0f3cdd7e9250f358ed7b7ea2222574db2be345d79688657960270
Instruction Fuzzy Hash: C841E730E013989BCF10DFAAC884AEEBBB2AF44714F248059ED159B351C731EA55CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040B27C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040B2A1

Strings

RCC, xrefs: 0040B2BB
MOC, xrefs: 0040B2B3

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: 8c2c88e112b254dfed51c253c91214cdfd4f205263a4331b418b573508c1f28d
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: A9413A71900209AFCF16DF94CD81AEEBBB5FF48304F2580AAF91477291D3399950DB99

Uniqueness

Uniqueness Score: -1.00%

Function 006EB4E3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 006EB508

Strings

RCC, xrefs: 006EB522
MOC, xrefs: 006EB51A

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: 19e0c2831a21e4c610827ea13cfdd75967b60b4882d92bcd984d0c59499def53
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: A7415971901289EFCF15CF9ACC81AEEBBB6FF48300F189099F90967251D3359A61DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405A10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00405A84

Strings

6p@, xrefs: 00405A61
>p@, xrefs: 00405A42

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 6p@$>p@
API String ID: 323602529-1565053451
Opcode ID: 425ef71dd0d1c7a20398710744d0633143550e0f660d93a64e8ee6803871bd3f
Instruction ID: 9da69bda2c1d99b46aee238cd3f365bb2bbe35d47137810eff83620ef8667151
Opcode Fuzzy Hash: 425ef71dd0d1c7a20398710744d0633143550e0f660d93a64e8ee6803871bd3f
Instruction Fuzzy Hash: 6D116DB5A042499FD720CF09D888F9AFBE4FB49314F4085AFE84597351D775E906CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402990 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004029AF

Strings

`)@, xrefs: 004029CB
`)@, xrefs: 004029B4

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: `)@$`)@
API String ID: 2659868963-999797278
Opcode ID: 5f274cf8602142c8ad8785bf174c77a70f718aeff496c305040c75d4222f7721
Instruction ID: ded15423ab3564f80df6e1d6fedb5f22c263529ceca829df09524940090fe14c
Opcode Fuzzy Hash: 5f274cf8602142c8ad8785bf174c77a70f718aeff496c305040c75d4222f7721
Instruction Fuzzy Hash: 42F015F6A10716AB8700DF69D800886F7E9FE59320350C62BE529D7B00E7B4A5A4CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00416596 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00416596
GetCommandLineW.KERNEL32 ref: 004165A1

Strings

%x, xrefs: 0041659C

Memory Dump Source

Source File: 00000000.00000002.1780109613.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: %x
API String ID: 3253501508-1377615221
Opcode ID: 84b3ecdb3b66bb93acc44f2f3dec4aeae8dcdd504bd3a56b32f2cc62e5158b78
Instruction ID: 46b542f36e5964affc7bc0732b151a29e12fbce24af7037c7733f49c8076eeed
Opcode Fuzzy Hash: 84b3ecdb3b66bb93acc44f2f3dec4aeae8dcdd504bd3a56b32f2cc62e5158b78
Instruction Fuzzy Hash: 08B048F9900200CB9B108F31B8081843FA0F20C3067C082B9D85186A24D7346003AF48

Uniqueness

Uniqueness Score: -1.00%

Function 006F67FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 006F67FD
GetCommandLineW.KERNEL32 ref: 006F6808

Strings

%x, xrefs: 006F6803

Memory Dump Source

Source File: 00000000.00000002.1780284901.00000000006E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_7GXKafhbnD.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: %x
API String ID: 3253501508-1377615221
Opcode ID: 84b3ecdb3b66bb93acc44f2f3dec4aeae8dcdd504bd3a56b32f2cc62e5158b78
Instruction ID: 46b542f36e5964affc7bc0732b151a29e12fbce24af7037c7733f49c8076eeed
Opcode Fuzzy Hash: 84b3ecdb3b66bb93acc44f2f3dec4aeae8dcdd504bd3a56b32f2cc62e5158b78
Instruction Fuzzy Hash: 08B048F9900200CB9B108F31B8081843FA0F20C3067C082B9D85186A24D7346003AF48

Uniqueness

Uniqueness Score: -1.00%

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7GXKafhbnD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_0aead8bd-3d69-471e-88d4-9d281264b63e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_2071ee8d-b7b5-4580-802a-4d51b6c53b0d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_31a3bfa8-276c-45f5-900e-ff34cdff71dc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_5c5ac96f-d7e2-4949-80e3-2909ce5346b1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_7f753e3f-3102-41ca-ade0-19e5c0e39648\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_807cc0ca-2485-4f33-9f4a-dfce8bfb587c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_92628ab3-bdbe-4a55-ae04-f985aafaaeec\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_17664c7d7e239f5f4c8c8e5e8a5c7dd6414cea4_0465960d_c878b971-1e7f-4be1-90e3-8a1ccd8f2f2c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7GXKafhbnD.exe_f059f8719164c84f855d378d9bb8bb5244bf721d_0465960d_2553eece-d477-4481-9dc0-ee4e029d95cd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1064.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11DC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11FD.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1381.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13F0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1400.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1585.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1613.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1652.tmp.xml

Windows Analysis Report
7GXKafhbnD.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre