Edit tour

Windows Analysis Report
qd_x86.exe

Overview

General Information

Sample name:	qd_x86.exe
Analysis ID:	1427912
MD5:	31b1a881401e0ba0cad4c56f1e32c48e
SHA1:	19e491a4c69de056c77d05ba671870818d4f7f80
SHA256:	7215d9421e0a6d1a7cfde3f6d742670550fed009585ab35b53cbb845f63c5f74
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Check for Windows Defender sandbox

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

qd_x86.exe (PID: 2716 cmdline: "C:\Users\user\Desktop\qd_x86.exe" MD5: 31B1A881401E0BA0CAD4C56F1E32C48E)

conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: qd_x86.exe	ReversingLabs: Detection: 35%
Source: qd_x86.exe	Virustotal: Detection: 42%			Perma Link

Machine Learning detection for sample

Source: qd_x86.exe

Joe Sandbox ML: detected

Source: qd_x86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: qd_x86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: Z:\j\projects\qbot4\Release\Win32\qd_x86.pdb source: qd_x86.exe

Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00568074 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00568074
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00567C8A FindFirstFileExW,		0_2_00567C8A

Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005821A0	0_2_005821A0
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00554243	0_2_00554243
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005723EF	0_2_005723EF
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0056C42E	0_2_0056C42E
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005844C0	0_2_005844C0
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005545A2	0_2_005545A2
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00580800	0_2_00580800
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00554910	0_2_00554910
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0053ABC1	0_2_0053ABC1
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00554C6F	0_2_00554C6F
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0058EC3F	0_2_0058EC3F
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0057AD5D	0_2_0057AD5D
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00554FCD	0_2_00554FCD
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00539068	0_2_00539068
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0057D200	0_2_0057D200
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005352FF	0_2_005352FF
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00571370	0_2_00571370
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0055533A	0_2_0055533A
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00555698	0_2_00555698
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0055386E	0_2_0055386E
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005718A0	0_2_005718A0
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0058F9AF	0_2_0058F9AF
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00555A8C	0_2_00555A8C
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00553BB0	0_2_00553BB0
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0057DC08	0_2_0057DC08
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00571CF0	0_2_00571CF0
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00535EEE	0_2_00535EEE
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00555E8F	0_2_00555E8F
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_0056FE89	0_2_0056FE89
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00553F01	0_2_00553F01

Source: C:\Users\user\Desktop\qd_x86.exe	Code function: String function: 00536E70 appears 63 times
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: String function: 00531140 appears 54 times
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: String function: 00561F12 appears 35 times
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: String function: 00562DA3 appears 56 times

Source: qd_x86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.evad.winEXE@2/1@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03

Source: C:\Users\user\Desktop\qd_x86.exe

Command line argument: ~LX

0_2_00584BD0

Source: qd_x86.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\qd_x86.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qd_x86.exe	ReversingLabs: Detection: 35%
Source: qd_x86.exe	Virustotal: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\qd_x86.exe "C:\Users\user\Desktop\qd_x86.exe"
Source: C:\Users\user\Desktop\qd_x86.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\qd_x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: qd_x86.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: qd_x86.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: qd_x86.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: qd_x86.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: qd_x86.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: qd_x86.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: qd_x86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: qd_x86.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: Z:\j\projects\qbot4\Release\Win32\qd_x86.pdb source: qd_x86.exe

Source: qd_x86.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: qd_x86.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: qd_x86.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: qd_x86.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: qd_x86.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_00533E91 LoadLibraryA,GetProcAddress,

0_2_00533E91

Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00584D3B push ecx; ret		0_2_00584D4E
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00536EC0 push ecx; ret		0_2_00536ED3

Malware Analysis System Evasion

Check for Windows Defender sandbox

Source: C:\Users\user\Desktop\qd_x86.exe

File Queried: C:\INTERNAL\__empty

Jump to behavior

Source: C:\Users\user\Desktop\qd_x86.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-50523

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00568074 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00568074
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00567C8A FindFirstFileExW,		0_2_00567C8A

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_00534540 GetSystemInfo,

0_2_00534540

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_005622A5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005622A5

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_00533E91 LoadLibraryA,GetProcAddress,

0_2_00533E91

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_0056D5EA GetProcessHeap,

0_2_0056D5EA

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005622A5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005622A5
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00536C0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00536C0A
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_00536DA0 SetUnhandledExceptionFilter,	0_2_00536DA0
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: 0_2_005372F7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005372F7

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_00537109 cpuid

0_2_00537109

Source: C:\Users\user\Desktop\qd_x86.exe	Code function: EnumSystemLocalesW,	0_2_00562779
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: EnumSystemLocalesW,	0_2_005628E6
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: EnumSystemLocalesW,	0_2_00562918
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0056C9C1
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: EnumSystemLocalesW,	0_2_0056CC6D
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: EnumSystemLocalesW,	0_2_0056CCD6
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: EnumSystemLocalesW,	0_2_0056CD71
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0056CDFC
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: GetLocaleInfoW,	0_2_0056D04F
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0056D178
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: GetLocaleInfoW,	0_2_0056325F
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: GetLocaleInfoW,	0_2_0056D27E
Source: C:\Users\user\Desktop\qd_x86.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0056D354

Source: C:\Users\user\Desktop\qd_x86.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_005313B0 CreateNamedPipeA,ConnectNamedPipe,GetLastError,ReadFile,GetLastError,DisconnectNamedPipe,

0_2_005313B0

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_00536ADF GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00536ADF

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_00531AD0 GetFileAttributesW,GetModuleHandleA,GetUserNameW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcmpW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,Sleep,lstrlenA,

0_2_00531AD0

Source: C:\Users\user\Desktop\qd_x86.exe

Code function: 0_2_00534767 GetCurrentProcessId,GetLastError,KiUserCallbackDispatcher,GetVersionExA,GetWindowsDirectoryW,

0_2_00534767

Source: C:\Users\user\Desktop\qd_x86.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	2 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	35 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qd_x86.exe	35%	ReversingLabs	Win32.Trojan.Generic
qd_x86.exe	43%	Virustotal		Browse
qd_x86.exe	100%	Joe Sandbox ML

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427912
Start date and time:	2024-04-18 10:36:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qd_x86.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 22 Number of non-executed functions: 94
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information

Process:	C:\Users\user\Desktop\qd_x86.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.796217602590056
Encrypted:	false
SSDEEP:	3:gBM/gOBLy:gROBLy
MD5:	773247E31D337AE0E32C10FB98F5DB1C
SHA1:	866A0AA4F70B8DEE5DE50C55892F501713315396
SHA-256:	19D0FCC438434297DE98B8879DA7A12B8031E02DDBD10F3C3515441362500BCB
SHA-512:	D3589C563130679ECB65B93CDA902B51CA7AA467E34CA64C8825AB12C4EE64807B718F1F2130A54E72FEC8568A42188F527868ACB3FBF1EBB991BEF4A8049383
Malicious:	false
Reputation:	low
Preview:	Update is not installed...

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.755937822537242
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qd_x86.exe
File size:	535'040 bytes
MD5:	31b1a881401e0ba0cad4c56f1e32c48e
SHA1:	19e491a4c69de056c77d05ba671870818d4f7f80
SHA256:	7215d9421e0a6d1a7cfde3f6d742670550fed009585ab35b53cbb845f63c5f74
SHA512:	459d6e38e633f22877add0b862319aa65484a015225e24cfea64d3bbebcde171d75857c063033035897a1d848b7c87833d0e3581d57558c0663b433db8b0154c
SSDEEP:	6144:7TjAuWlcEz3grAQFAaQe0j+TE7xrJmRPnZJUdFwnKjMFtsBzlgnySHpgB:fjAuWlJ0AQqe0j+WuaFMKjMfmSH
TLSH:	3BB4AE01B8D08032C57234710279D7798EBEB4700A556ACF57DA1DBBAF70AD0AB2676F
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........`....A...A...A...@...A...@...A...@...A...@...A...@...A...@...A...@...A...A...A.e.@...A.e.@...A...@...A.e.@...A.e.A...A.e.@...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40646e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C50FCB [Thu Feb 8 17:30:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	14e3d57d9f86b144f92a9d94ef2c3bb8

Entrypoint Preview

Instruction
call 00007F83B513DDCEh
jmp 00007F83B513D52Ch
int3
int3
int3
int3
int3
int3
int3
int3
jmp 00007F83B513D730h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
jmp 00007F83B513D720h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
cmp dword ptr [004820C8h], 02h
jl 00007F83B513D71Ah
sub esp, 04h
fisttp dword ptr [esp]
pop eax
ret
push ebp
mov ebp, esp
add esp, FFFFFFF0h
and esp, FFFFFFF0h
fld st(0), st(0)
fstp tbyte ptr [esp]
mov eax, dword ptr [esp+04h]
movzx ecx, word ptr [esp+08h]
btr ecx, 0Fh
sbb edx, edx
cmp cx, 3FFFh
jc 00007F83B513D731h
test eax, eax
jns 00007F83B513D748h
cmp cx, 401Eh
jnc 00007F83B513D72Eh
neg cx
add cx, 403Eh
frndint
fstp st(0)
shr eax, cl
xor eax, edx
sub eax, edx
leave
ret
frndint
fstp st(0)
xor eax, eax
leave
ret
jnbe 00007F83B513D723h
test edx, edx
jns 00007F83B513D71Fh
cmp eax, 80000000h
jne 00007F83B513D718h
frndint
fstp st(0)
leave
ret
fcomp dword ptr [0046EA08h]
leave
mov eax, 80000000h
ret
int3
int3
int3
int3
cmp dword ptr [004820C8h], 02h
jl 00007F83B513D750h
fldz
fucomip st(0), st(1)
jp 00007F83B513D73Eh
jnbe 00007F83B513D72Dh
fld dword ptr [0046EA00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7b5cc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x84000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x85000	0x2c64	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x79f20	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x79e60	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x68000	0x1fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x66074	0x66200	a9adf9dd81a490863459394fa4e1b411	False	0.4247269928090575	data	6.640437903633444	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x68000	0x14124	0x14200	a4254f98495b7d2d23c15a4c76801a08	False	0.6468483113354038	data	6.525832729688649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7d000	0x6d44	0x5200	17bec568cbea1d1694c7b4b4d242ca47	False	0.48275533536585363	data	5.041924967241612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x84000	0x1e0	0x200	76da06eac51664280ffa175d39a47fb9	False	0.52734375	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x85000	0x2c64	0x2e00	171f33b282c7dc8bc7455433ff23cc37	False	0.7528023097826086	data	6.568730173178581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x84060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
SHELL32.dll	CommandLineToArgvW
KERNEL32.dll	lstrlenA, GetFileAttributesW, GetModuleHandleA, DisconnectNamedPipe, Sleep, GetLastError, lstrcpyW, lstrcmpW, ConnectNamedPipe, GetNumberFormatA, FindFirstFileW, FindNextFileW, SetFileAttributesW, GetFileAttributesA, MoveFileW, lstrcatA, MultiByteToWideChar, lstrcatW, lstrcpyA, WideCharToMultiByte, HeapCreate, HeapFree, HeapAlloc, HeapDestroy, SetNamedPipeHandleState, CreateNamedPipeA, FlushFileBuffers, LoadLibraryA, GetProcAddress, FreeLibrary, GetSystemTimeAsFileTime, lstrlenW, GetCommandLineW, GetCommandLineA, GetVersionExA, GetSystemInfo, GetCurrentDirectoryW, GetWindowsDirectoryW, GetCurrentProcessId, LocalAlloc, GetCurrentThread, lstrcmpiW, Thread32Next, Thread32First, GetCurrentThreadId, lstrcmpA, SuspendThread, GetExitCodeProcess, CreateFileW, ReadConsoleW, CloseHandle, HeapReAlloc, ReadFile, WriteConsoleW, CallNamedPipeA, InitializeSListHead, HeapSize, SetFilePointerEx, QueryPerformanceCounter, DecodePointer, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, InterlockedPushEntrySList, InterlockedFlushSList, RtlUnwind, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, EncodePointer, RaiseException, ExitProcess, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, GetTempPathW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, OutputDebugStringW, FindClose, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetProcessHeap, SetConsoleCtrlHandler, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx
USER32.dll	CharUpperBuffA, CharUpperBuffW
ADVAPI32.dll	RegDeleteKeyA, GetUserNameW, SetFileSecurityA
ole32.dll	CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	10:36:55
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\qd_x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qd_x86.exe"
Imagebase:	0x530000
File size:	535'040 bytes
MD5 hash:	31B1A881401E0BA0CAD4C56F1E32C48E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:36:55
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.9%
Total number of Nodes:	668
Total number of Limit Nodes:	23

Executed Functions

Function 00531AD0 Relevance: 93.5, APIs: 20, Strings: 33, Instructions: 791COMMON

Download Yara Rule

APIs

Part of subcall function 0053328F: HeapCreate.KERNELBASE(00000000,00096000,00000000,00531B52), ref: 00533298

GetFileAttributesW.KERNELBASE(?), ref: 00531B73
GetModuleHandleA.KERNEL32(00000000,00000001), ref: 00531B99

Part of subcall function 00534767: GetCurrentProcessId.KERNEL32 ref: 0053478C
Part of subcall function 00534767: GetLastError.KERNEL32 ref: 0053488C
Part of subcall function 00534767: KiUserCallbackDispatcher.NTDLL(00001000), ref: 0053489C

Part of subcall function 00532E24: GetFileAttributesW.KERNELBASE(?,00531BC5), ref: 00532E2A

Strings

alias: %s, xrefs: 0053263B
Use numeric command, xrefs: 00532371
{-} DecryptConfig() failed, xrefs: 0053259F
szArgsNew='%s', xrefs: 0053231B, 00532385
GetStager1FileUpdateDecrypted() failed., xrefs: 00532114
Command failed: ret=%d, xrefs: 00532426
stager_1_update.dll, xrefs: 00532105
QPCMD_BOT_SHUTDOWN sent ok., xrefs: 0053216F
Update alias: %s, xrefs: 005325E1
Success: ret=%d, xrefs: 00532411
-dm, xrefs: 00531F69
ERROR: Unknown command: '%s', xrefs: 0053239B
Config cleaned ok., xrefs: 0053222E
Action: %u, xrefs: 00532063
GetStager1FileMainDecrypted() ok: dwStager1Type=%u dwFileSize=%u, xrefs: 00532091
-du, xrefs: 00531FAE
wszSeclogFile='%S' nick='%s', xrefs: 00532556
%s, xrefs: 00532519
Config clean failed., xrefs: 0053223D
szPipeName='%s', xrefs: 00532266
%u%s, xrefs: 005322FB
Stopping..., xrefs: 005321C6
DecryptSeclogFile() failed., xrefs: 00532506
GetStager1FileUpdateDecrypted() ok: dwStager1Type=%u dwFileSize=%u, xrefs: 005320EB
GetStager1FileMainDecrypted() failed., xrefs: 005320B8
dwDecryptLen=%u, xrefs: 0053252A
ERROR: unknown argument: %S, xrefs: 00532036
nick: %s, xrefs: 005324D7
!, xrefs: 0053227A
cc_main, xrefs: 005322A3, 005322B6, 005322D4
ERROR: SendPipeMsgClient2() failed, may be Update is not running, xrefs: 00532158, 005321B7
Update is not installed., xrefs: 00531C19
Done., xrefs: 00532218

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: AttributesFile$CallbackCreateCurrentDispatcherErrorHandleHeapLastModuleProcessUser
String ID: Done.$!$%s$%u%s$-dm$-du$Action: %u$Command failed: ret=%d$Config clean failed.$Config cleaned ok.$DecryptSeclogFile() failed.$ERROR: SendPipeMsgClient2() failed, may be Update is not running$ERROR: Unknown command: '%s'$ERROR: unknown argument: %S$GetStager1FileMainDecrypted() failed.$GetStager1FileMainDecrypted() ok: dwStager1Type=%u dwFileSize=%u$GetStager1FileUpdateDecrypted() failed.$GetStager1FileUpdateDecrypted() ok: dwStager1Type=%u dwFileSize=%u$QPCMD_BOT_SHUTDOWN sent ok.$Stopping...$Success: ret=%d$Update alias: %s$Update is not installed.$Use numeric command$alias: %s$cc_main$dwDecryptLen=%u$nick: %s$stager_1_update.dll$szArgsNew='%s'$szPipeName='%s'$wszSeclogFile='%S' nick='%s'${-} DecryptConfig() failed
API String ID: 2174859914-2758152920
Opcode ID: fba7318d7c68577da3b738c9c6cc2c24d3f44d9b20bdb9f56b2615324cf713d3
Instruction ID: 36eca5335f985de983ae965e2abdafafd4e3806d71e346bbdad317322afaf443
Opcode Fuzzy Hash: fba7318d7c68577da3b738c9c6cc2c24d3f44d9b20bdb9f56b2615324cf713d3
Instruction Fuzzy Hash: 3362D570E00609EBDB14DFA0DC56BEE7BB5BF94304F108469E9066B281EB71AF54CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00534767 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0053478C
GetLastError.KERNEL32 ref: 0053488C
KiUserCallbackDispatcher.NTDLL(00001000), ref: 0053489C
GetVersionExA.KERNEL32(00000000), ref: 00534A23

Part of subcall function 005358A1: FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,00001644), ref: 00535944

GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 00534A4E

Strings

USERPROFILE, xrefs: 00534AA6, 00534AD4
SystemDrive, xrefs: 00534B15, 00534B20, 00534B36
TEMP, xrefs: 00534AB5
%s\%s, xrefs: 00534ABB
TEMP, xrefs: 00534AEA, 00534AF5, 00534B06

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: CallbackChangeCloseCurrentDirectoryDispatcherErrorFindLastNotificationProcessUserVersionWindows
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 1534145538-2706916422
Opcode ID: 831e552cbe4c95199ab1a12135dec9e422637e15580aa2326cd468c923f25e07
Instruction ID: 89da2cfc78f338ae9d0915520819cb317139396196f169c0a00754f47f14e96e
Opcode Fuzzy Hash: 831e552cbe4c95199ab1a12135dec9e422637e15580aa2326cd468c923f25e07
Instruction Fuzzy Hash: 1EC14075700A06AFD708DF74C859BEABBE8BF49300F004669F51A97251EB70BA48CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00533E91 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(.dll,?,?,00000000), ref: 00533F61
GetProcAddress.KERNEL32(00000000,?), ref: 00533F6D

Strings

.dll, xrefs: 00533F5D, 00533F60
:@S, xrefs: 00533F0C

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$:@S
API String ID: 2574300362-3513026034
Opcode ID: 175a492dd3173e2c968ab2489b649ad1e8c4a6e38a9da84c0b2ac604f246f8b2
Instruction ID: ec5e72d34b132597e6ed32e47adf85cd04cec2ae7ba0d2eb7cf98ce2be9a3004
Opcode Fuzzy Hash: 175a492dd3173e2c968ab2489b649ad1e8c4a6e38a9da84c0b2ac604f246f8b2
Instruction Fuzzy Hash: 4231AC71E001559BCB24CFADC884AAEBFF5BF44304F2844A9E845E7251DB34DA91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00562CD8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00562DE7,0054D546,?,00000000,?,00000000,?,005631AE,00000022,FlsSetValue,005A0AC4,005A0ACC,?), ref: 00562D99

Strings

ext-ms-, xrefs: 00562D43
J$V, xrefs: 00562D86, 00562D64
api-ms-, xrefs: 00562D2F

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: FreeLibrary
String ID: J$V$api-ms-$ext-ms-
API String ID: 3664257935-1695487325
Opcode ID: c67369c6dcdc5bcba4ec7415638b23f46b6dd4b1ec3378001b7d14188c84fe56
Instruction ID: 8968c3ed15caa317d7e039f8f48a6ce17a2238fa07443e34e0ec079fd5ea94ce
Opcode Fuzzy Hash: c67369c6dcdc5bcba4ec7415638b23f46b6dd4b1ec3378001b7d14188c84fe56
Instruction Fuzzy Hash: 96210A31A01A11ABC7719B64DC49A6A3F78BF52770F150610FD05E7290DB34ED06D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00536285 Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00536285

Part of subcall function 00536B2C: ___get_entropy.LIBCMT ref: 00536B46

___scrt_release_startup_lock.LIBCMT ref: 00536321
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00536335
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 0053635B
___scrt_uninitialize_crt.LIBCMT ref: 005363A4

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___get_entropy___scrt_release_startup_lock___scrt_uninitialize_crt___security_init_cookie
String ID:
API String ID: 2539496024-0
Opcode ID: ed47d9643f973c715c914974b0671e0ca9f52a0b71409e4b04e37f7e695df511
Instruction ID: 7c2327671b809d8cedbe60e4f292ad3a62a38372171931f1cea714e4b4e37d92
Opcode Fuzzy Hash: ed47d9643f973c715c914974b0671e0ca9f52a0b71409e4b04e37f7e695df511
Instruction Fuzzy Hash: 67314836544603BACF217B749C1B7AE7FA0BFD2725F24882EF441AB1D2DE3188459725

Uniqueness

Uniqueness Score: -1.00%

Function 0053288C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNumberFormatA.KERNEL32(0001E455,00016315,quoaehzdffud,00000000,?,00000022), ref: 00532915

Strings

MjnUJbuyIOJ, xrefs: 0053297A
quoaehzdffud, xrefs: 00532906

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: FormatNumber
String ID: MjnUJbuyIOJ$quoaehzdffud
API String ID: 481257995-3250296153
Opcode ID: 424f5d3687704048387117a70530e5bd6c059d99829a4c1bab230ad78564c987
Instruction ID: 0144df7c801c39ed2944a15f6c2bb0b788d9baa3bda104b04fd1c0d8b9e5a3ca
Opcode Fuzzy Hash: 424f5d3687704048387117a70530e5bd6c059d99829a4c1bab230ad78564c987
Instruction Fuzzy Hash: 3E315B32B00B59ABDB048FA98895AFE7F65BF55740F740079D981AB282D630DD86C790

Uniqueness

Uniqueness Score: -1.00%

Function 005357C7 Relevance: 4.6, APIs: 3, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00001644,00000000,00000000,?,0053584B,00000000,00000000,?,00535877), ref: 005357E2
GetLastError.KERNEL32(?,0053584B,00000000,00000000,?,00535877,00000000,?,005347F6), ref: 005357EC
GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,?,?,0053584B,00000000,00000000,?,00535877,00000000,?,005347F6), ref: 0053581A

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 240a8b84da76560735f8d085d98b11b1f8a5f4b0902d593f6d07131cbc3b2d4f
Instruction ID: d3ff842da7362b02ec3de87d98e7b2cde7d31a5b099860caf9c61f433f5f4a57
Opcode Fuzzy Hash: 240a8b84da76560735f8d085d98b11b1f8a5f4b0902d593f6d07131cbc3b2d4f
Instruction Fuzzy Hash: 5501AD35A10214BFCB209BA9CC88DABBFACFF95790F605465F906D3100EA30AE04D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00541D7B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00541EE6,?,00541D75,00000000,?,?,00541EE6,25D5FA14,?,00541EE6), ref: 00541D8C
TerminateProcess.KERNEL32(00000000,?,00541D75,00000000,?,?,00541EE6,25D5FA14,?,00541EE6), ref: 00541D93
ExitProcess.KERNEL32 ref: 00541DA5

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f7b7711c2e2b7978c6dacd92c4232a4783f0fc4701a4292b1010624c10d49a23
Instruction ID: 8a8ddd510f026443f6f4cc3f41445d9e6ca00cee1742f831052c22f5b9c2f170
Opcode Fuzzy Hash: f7b7711c2e2b7978c6dacd92c4232a4783f0fc4701a4292b1010624c10d49a23
Instruction Fuzzy Hash: 51D09E75400504ABCF012F60DD0E9E93F2ABF563457018411B9094A131CF7199A7FA84

Uniqueness

Uniqueness Score: -1.00%

Function 005327AE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNumberFormatA.KERNEL32(00000001,0000138A,aiodewio,00000000,?,00000022), ref: 0053282A

Strings

aiodewio, xrefs: 0053281E

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: FormatNumber
String ID: aiodewio
API String ID: 481257995-3324628923
Opcode ID: f12ad33fc6d73e8037356b4bbc0684a7be90031b7b534e86bb780c6ad3eaf3c1
Instruction ID: c18d2795a7601150d661c3d8735abe1cb7ca9d394825267bea84f7abe6b29c44
Opcode Fuzzy Hash: f12ad33fc6d73e8037356b4bbc0684a7be90031b7b534e86bb780c6ad3eaf3c1
Instruction Fuzzy Hash: 63210A35B00B15ABD7148FA984955EEBFA5FFD5740F740069E546A7282DA30EE42C390

Uniqueness

Uniqueness Score: -1.00%

Function 00564227 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000014,00000000,J$V,0056DDA4,005AB2A8,00000014,00000003,00000028,00561E10,00000016,0054E26B), ref: 00564259

Strings

J$V, xrefs: 00564229

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: AllocateHeap
String ID: J$V
API String ID: 1279760036-4054631523
Opcode ID: df8d4dc323faff2210a081df3d87f051f6dc8836e3e3e2069a8df5fcb13c5543
Instruction ID: 77ad751e441b3674a2315c00ae62e440848a639486cde506c763f83ef3622db8
Opcode Fuzzy Hash: df8d4dc323faff2210a081df3d87f051f6dc8836e3e3e2069a8df5fcb13c5543
Instruction Fuzzy Hash: F5E0923A6056216BDB312766BC29B6B7F59FFC27A0F390221FC1597091DF60DC809AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0056FAC2 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0056F1C7: GetConsoleOutputCP.KERNEL32(25D5FA14,00000000,00000000,00000000), ref: 0056F22A

WriteFile.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,00000000,?,?,00000000,?,00000000), ref: 0056FC47
GetLastError.KERNEL32(?,00000000,?,?,00000000,?,00000000,?), ref: 0056FC51

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 6fd4707671f953fd2fa13104c52bfac6c6534e100023a41aaf9fe6d959c7b656
Instruction ID: cc57ebad3d3a7ec9514eedba1c19690dc703c1ae8550fc71078b3d84d38b3b65
Opcode Fuzzy Hash: 6fd4707671f953fd2fa13104c52bfac6c6534e100023a41aaf9fe6d959c7b656
Instruction Fuzzy Hash: 85619E71D0811AAFDF11DFA8E889AAEBFB9BF49304F140565E800A7216D732DD15DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00532AE0 Relevance: 3.1, APIs: 2, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(00000000,?,00000105,00532BD8,00000000,00000000,00000000,00000000), ref: 00532B39
CharUpperBuffW.USER32(00000000,00000000), ref: 00532B8B

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: BuffCharInformationUpperVolume
String ID:
API String ID: 3850600697-0
Opcode ID: a92bb9f393dc2e02d042daaf7e12ce4be489f825c858d54d5abcc5da19b1225b
Instruction ID: 7103eca679bf17ffdba0ed51255a2f238fd9430e7f24154a33421b602480696d
Opcode Fuzzy Hash: a92bb9f393dc2e02d042daaf7e12ce4be489f825c858d54d5abcc5da19b1225b
Instruction Fuzzy Hash: 8D213271E00108BBDB14EBA9DC49EEEBBFDEB98710F10416AF506E3291DA705B44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0056F673 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,00000000,?,0056FC2D,?,?,00000000,?,00000000,00000000), ref: 0056F70F
GetLastError.KERNEL32(?,0056FC2D,?,?,00000000,?,00000000,00000000,?,?,?,00000000,?,?,00000000,?), ref: 0056F735

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: e3ec7095382c98f4d32ca86f01a469fd0f6a3c261732234b1d1fd957f5f064b8
Instruction ID: f4209e4651dcaa25fe45e5052ae5ed8a7e3d82253d94606dfafa1cedaf1cbd21
Opcode Fuzzy Hash: e3ec7095382c98f4d32ca86f01a469fd0f6a3c261732234b1d1fd957f5f064b8
Instruction Fuzzy Hash: 56216075A002199BCB15CF29DC809E9BBBAFB59301F1441AAE946D7211D730EE46CB64

Uniqueness

Uniqueness Score: -1.00%

Function 005640EB Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00564137
GetFileType.KERNELBASE(00000000), ref: 00564149

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: d4aea9bc2ee451d39a2ef01bf51a71ca5137c329ad5a1f08bf18626943c6eae6
Instruction ID: 99354d758defb59537ff4d79c3635722e201d78a76f7c678dfa8e8dab942cb8d
Opcode Fuzzy Hash: d4aea9bc2ee451d39a2ef01bf51a71ca5137c329ad5a1f08bf18626943c6eae6
Instruction Fuzzy Hash: D11190316047515AC7304E3E8C88622BE99BBB7374B380B1AD5BA875F1C730D9C6EA40

Uniqueness

Uniqueness Score: -1.00%

Function 00533FC8 Relevance: 3.0, APIs: 2, Instructions: 49
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?), ref: 0053401B
LoadLibraryA.KERNELBASE(?), ref: 00534028

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: 3e927dabbdf31095f6d67d4f2bbaf54bbeff2cecf8e91b1019bbc6c5e8d838ae
Instruction ID: d7c0c3cf4d4b2e9d5de1fcd803cbfd7e2fa89c6c8f007624f11d24eee90a6a53
Opcode Fuzzy Hash: 3e927dabbdf31095f6d67d4f2bbaf54bbeff2cecf8e91b1019bbc6c5e8d838ae
Instruction Fuzzy Hash: FE01F531A041445FCB04DFBA98C889EBFB4EE4D610B5984A9E544DB251D630A905CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00535659 Relevance: 2.6, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00535683
GetLastError.KERNEL32 ref: 00535705

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f458819c6eba6ef7aaa1aa05c259998bbeede33fb33f9282e5b94b6672990f17
Instruction ID: c0abc71f04b6dede38d329e020ae9d6ea54cf3b2456c42a1c543e689d3775020
Opcode Fuzzy Hash: f458819c6eba6ef7aaa1aa05c259998bbeede33fb33f9282e5b94b6672990f17
Instruction Fuzzy Hash: 5C314F35A00605EFDB10DFA8CD84BAEBBB5FF48750F104559F915AB291EB30AE05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 005333E1 Relevance: 1.7, APIs: 1, Instructions: 235registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,?), ref: 005335F5

Part of subcall function 00533055: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,00000000,005334F5), ref: 0053307F

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ByteCharMultiOpenWide
String ID:
API String ID: 471680335-0
Opcode ID: f741da055093a95eadfdfd1da8fbd20d6d4bfe5f619e43f1c8c67259820a2f9e
Instruction ID: d156bf54b2dcaab27f5d37e0ceeb1be8b073c79fd8202406cfe90ec2a34f662a
Opcode Fuzzy Hash: f741da055093a95eadfdfd1da8fbd20d6d4bfe5f619e43f1c8c67259820a2f9e
Instruction Fuzzy Hash: 19914971E0020AAFDB11DF99CD499AEBFB8FF58310F144169F805AB261DB319B45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 005358A1 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0053576A: GetCurrentThread.KERNEL32 ref: 0053577D
Part of subcall function 0053576A: GetLastError.KERNEL32(?,?,005358BB,00000000,00001644), ref: 0053578E

Part of subcall function 005357C7: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00001644,00000000,00000000,?,0053584B,00000000,00000000,?,00535877), ref: 005357E2
Part of subcall function 005357C7: GetLastError.KERNEL32(?,0053584B,00000000,00000000,?,00535877,00000000,?,005347F6), ref: 005357EC

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,00001644), ref: 00535944

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast$ChangeCloseCurrentFindInformationNotificationThreadToken
String ID:
API String ID: 3430231349-0
Opcode ID: 3d0cd88f7aa811a84541a80ed25041f2b41e9e3b972351bf3fa3434353821baa
Instruction ID: fcd603d52ffdcb669a19b3a9e3495d68c6d1a66365c52870fc537cac5cae9c0e
Opcode Fuzzy Hash: 3d0cd88f7aa811a84541a80ed25041f2b41e9e3b972351bf3fa3434353821baa
Instruction Fuzzy Hash: CC218176A00605EFCB10DFA9DC85BAEBBF9FF44710F105469E602E7251EB30AA05DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00562DA3 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ac601d902018f61892d0c5175773614cd1b19a557e33cfe934097bbaa63c19
Instruction ID: 6460ee27148d1ba68d4f96dad2afb7d2f0f21bf7c726ebc8c1cdc429bb2b99ff
Opcode Fuzzy Hash: c4ac601d902018f61892d0c5175773614cd1b19a557e33cfe934097bbaa63c19
Instruction Fuzzy Hash: 1F016D33A00A155FCB169F68EC449673BB9FBC5330F240520F606CB154EA31EC4A9B90

Uniqueness

Uniqueness Score: -1.00%

Function 00532E24 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00531BC5), ref: 00532E2A

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 482700d63ed8e7632f798b9a6f244ff49e6c08935ec807873d96addba5bc00bf
Instruction ID: 1a80770da02688cea0fa49eeefa942854acb833289c09bf8067dc05fd79ab9b5
Opcode Fuzzy Hash: 482700d63ed8e7632f798b9a6f244ff49e6c08935ec807873d96addba5bc00bf
Instruction Fuzzy Hash: F9B092B62200004BC7584B389C889AE32906B08231BA94BACB027D60E0DE20D998AB00

Uniqueness

Uniqueness Score: -1.00%

Function 0053328F Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00096000,00000000,00531B52), ref: 00533298

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a8d3ba76a274a5d048ea54b704977fc757794718033106276482ec6a36cd67cf
Instruction ID: 9e83211ad85142cd28cb96feff17ac2f8db08e9b2f4701820e1c2e70e7a9ab18
Opcode Fuzzy Hash: a8d3ba76a274a5d048ea54b704977fc757794718033106276482ec6a36cd67cf
Instruction Fuzzy Hash: DCB012702C03045ED7500F109C0AB0035107355B42F100201F201B81D4CBB02018B508

Uniqueness

Uniqueness Score: -1.00%

Function 0053559F Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005356A6,?,?,00000000), ref: 00535626

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 856f8c5c3cc212570ffcceb308f0e323acb1fc2d56a2d4f06d7bdfcf02a1c47c
Instruction ID: 2e94069603b2982c846cb0faeb3e9594a24e925f6fb175c784a6c0c94f85d10b
Opcode Fuzzy Hash: 856f8c5c3cc212570ffcceb308f0e323acb1fc2d56a2d4f06d7bdfcf02a1c47c
Instruction Fuzzy Hash: EC11E671A00108BFDB509FA9DD89D9F7FBCFB48740F4544A5B501E6161EA30EE04EB60

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0053ABC1 Relevance: 51.4, APIs: 25, Strings: 4, Instructions: 665COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053ACB1

Part of subcall function 0053BB23: DName::operator+.LIBCMT ref: 0053BBB9

DName::operator+.LIBCMT ref: 0053AEFB
DName::operator+.LIBCMT ref: 0053AF30
DName::operator+.LIBCMT ref: 0053AF7F
DName::DName.LIBVCRUNTIME ref: 0053B31A
DName::operator+.LIBCMT ref: 0053B326
DName::operator+.LIBCMT ref: 0053B334
DName::operator+.LIBCMT ref: 0053B33F

Strings

\$[, xrefs: 0053B1B7
&& , xrefs: 0053B18A
\$[, xrefs: 0053B142
\$[, xrefs: 0053AEC2

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: && $\$[$\$[$\$[
API String ID: 168861036-688296583
Opcode ID: a31555db375fa50e84d799123a6b31268ebf1adeb9358654474c90a45f2365b8
Instruction ID: 1aaab0737801f957034adcd50065b79421bd15e2ffc86a4d2132c37d78553911
Opcode Fuzzy Hash: a31555db375fa50e84d799123a6b31268ebf1adeb9358654474c90a45f2365b8
Instruction Fuzzy Hash: 02427BB5D002099FDF19DFA4C499BEEBFB4BF58300F10455AF552A7291EB30AA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00539068 Relevance: 48.4, APIs: 25, Strings: 2, Instructions: 1103COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005390C6
operator+.LIBVCRUNTIME ref: 005390E0
DName::operator+.LIBCMT ref: 00539214
DName::operator+.LIBCMT ref: 00539231
DName::operator+.LIBCMT ref: 00539280

Part of subcall function 0053A3F0: DName::DName.LIBVCRUNTIME ref: 0053A433

Part of subcall function 00538DCE: shared_ptr.LIBCMT ref: 00538DEA

Part of subcall function 0053AAEC: shared_ptr.LIBCMT ref: 0053AB9D

DName::operator+.LIBCMT ref: 005392F7
DName::operator+.LIBCMT ref: 00539306
DName::operator+.LIBCMT ref: 005397EB
DName::operator+.LIBCMT ref: 00539807
DName::operator+.LIBCMT ref: 00539A84

Part of subcall function 00538CBD: DName::operator+.LIBCMT ref: 00538CDE

DName::operator+.LIBCMT ref: 00539B88
DName::operator+.LIBCMT ref: 00539C5D
DName::operator+.LIBCMT ref: 00539D0B
DName::operator+.LIBCMT ref: 00539D48

Strings

\$[, xrefs: 005394F8
/, xrefs: 0053994B

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+$NameName::shared_ptr$operator+
String ID: /$\$[
API String ID: 1847427470-3256142255
Opcode ID: 95c0e40852a14b6c40a6b9ba248caeeaa23015fec01bcf45d07035a3b2d870ca
Instruction ID: 06d6f190e26a61c5a6e12958c148635c7af28ead8aaffbdcf74853ce4a1c0de0
Opcode Fuzzy Hash: 95c0e40852a14b6c40a6b9ba248caeeaa23015fec01bcf45d07035a3b2d870ca
Instruction Fuzzy Hash: 878252B2D1020A9BDF19DFA4C895AEEBFF8BF58310F14452AE411E7290DBB49E44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0056D354 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0056D45C
IsValidCodePage.KERNEL32(00000000), ref: 0056D49A
IsValidLocale.KERNEL32(?,00000001), ref: 0056D4AD
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0056D4F5
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0056D510

Strings

4$Z, xrefs: 0056D3B9

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: 4$Z
API String ID: 415426439-2792738066
Opcode ID: ba033caa8b0e4586d11ca689cd9af81f15ed00e694b959ca8f53c9c6296a627d
Instruction ID: 8ce06b5c15b2a2159bf8933c5ba07913913dade26846d9fcca11624a775b58c1
Opcode Fuzzy Hash: ba033caa8b0e4586d11ca689cd9af81f15ed00e694b959ca8f53c9c6296a627d
Instruction Fuzzy Hash: 21518C71F0020AAAEF10DFA5DC45ABA7BB8BF55701F150829A901E7190EBB0AE44CB71

Uniqueness

Uniqueness Score: -1.00%

Function 005723EF Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00572606

Strings

1#SNAN, xrefs: 005724FB
1#IND, xrefs: 005724F4
1#QNAN, xrefs: 00572502
1#INF, xrefs: 00572525

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 42f60fdc74fb36752e3f9bc777ffefe243b1222875c50eb750924b1250db9b23
Instruction ID: b1ec9cc31d8a40c29da31df9af615aa53ba514d6dc7b280fe73ab97e077151bd
Opcode Fuzzy Hash: 42f60fdc74fb36752e3f9bc777ffefe243b1222875c50eb750924b1250db9b23
Instruction Fuzzy Hash: 7DD25A71E082298FDB64CE28EC447EABBB5FB44310F1485EAD44DE7240E774AE85AF41

Uniqueness

Uniqueness Score: -1.00%

Function 005313B0 Relevance: 9.1, APIs: 6, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32(00000000,00000003,00000006,000000FF,0000FA00,0000FA00,00000000,00000000), ref: 005313EB
ConnectNamedPipe.KERNEL32(000000FF,00000000), ref: 00531427
GetLastError.KERNEL32 ref: 0053143A

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: NamedPipe$ConnectCreateErrorLast
String ID:
API String ID: 3851520242-0
Opcode ID: 2579526040234395c67981c987a807f9b0fc302bf252786a2bb831fa9e5441c9
Instruction ID: 00b3f0d27acd31f94bbacd1ac7bd97b1ec92b97593d8738f3cecaef4bd9a2920
Opcode Fuzzy Hash: 2579526040234395c67981c987a807f9b0fc302bf252786a2bb831fa9e5441c9
Instruction Fuzzy Hash: E3416370E04B09EBDF20CBB0D949BBEBFB5BB40300F208965D506A61C0DBB49E45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0056C9C1 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

GetACP.KERNEL32(?,?,?,?,?,?,00560242,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0056CA80
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00560242,?,?,?,00000055,?,-00000050,?,?), ref: 0056CAB7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0056CC1A

Strings

4$Z, xrefs: 0056C9FF
utf8, xrefs: 0056CB89

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: 4$Z$utf8
API String ID: 607553120-3535788457
Opcode ID: 23ed4da63475deba2d494b705d82b7f4e65bb1128e808a6fdc4541713834ec54
Instruction ID: fa082ef41b925ebc70edf9fb313e398099c9ca41d6bddfdf79bfb316a5881940
Opcode Fuzzy Hash: 23ed4da63475deba2d494b705d82b7f4e65bb1128e808a6fdc4541713834ec54
Instruction Fuzzy Hash: DC710731A00607AADB24EB75CC4ABBA7FA8FF85700F14446AF985D7181FA74ED40D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0056D178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0056D48A,00000002,00000000,?,?,?,0056D48A,?,00000000), ref: 0056D211
GetLocaleInfoW.KERNEL32(?,20001004,0056D48A,00000002,00000000,?,?,?,0056D48A,?,00000000), ref: 0056D23A
GetACP.KERNEL32(?,?,0056D48A,?,00000000), ref: 0056D24F

Strings

OCP, xrefs: 0056D1CC
ACP, xrefs: 0056D196

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fd50f89adae32a33750900d40037cc39680a959e1e73fab52f8aac941cba8aba
Instruction ID: f5b1cfec1b7d645bbd5311fc774892c3631f33df9eb1bc6d3859b78ad16dfb01
Opcode Fuzzy Hash: fd50f89adae32a33750900d40037cc39680a959e1e73fab52f8aac941cba8aba
Instruction Fuzzy Hash: CC21AC36F00100AADB348F54D915BA7BBBBBF96B60B568C25E90AD7200EB72DD41D370

Uniqueness

Uniqueness Score: -1.00%

Function 00571370 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5051c78aba52ebd887134601ea467777a9ae3aeef73f1af40b9177dc5327fc
Instruction ID: f02560232ead9f600eed56580c422b6d01af68902aa719fefe26c401982deb0d
Opcode Fuzzy Hash: ac5051c78aba52ebd887134601ea467777a9ae3aeef73f1af40b9177dc5327fc
Instruction Fuzzy Hash: B7023C71E016199FDF14CFA9D8806AEBBF1FF88314F248269D919E7341D731AA01DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00568074 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0056810F
FindNextFileW.KERNEL32(00000000,?), ref: 0056818A
FindClose.KERNEL32(00000000), ref: 005681AC
FindClose.KERNEL32(00000000), ref: 005681CF

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 77cdb65f1f39136f2ea2856db2516255f4d68618221fe66d794788a3089c54f5
Instruction ID: f3b676fdd0a016334a189f6043936279eec48b3272acb0eaf5b3670724817130
Opcode Fuzzy Hash: 77cdb65f1f39136f2ea2856db2516255f4d68618221fe66d794788a3089c54f5
Instruction Fuzzy Hash: 5141D771A00619AFDB20EF64DC8DABABB79FF89315F044695E405D3140EF309E85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00536C0A Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00536C16
IsDebuggerPresent.KERNEL32 ref: 00536CE2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00536D02
UnhandledExceptionFilter.KERNEL32(?), ref: 00536D0C

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d200781cb991a06c10702b4a61371b36402373d3f49d2822beec37924604c302
Instruction ID: 7a689d16002875b56f05d40ac0b5b84a6cafb8c3015caee2eb4b01ab64cb2123
Opcode Fuzzy Hash: d200781cb991a06c10702b4a61371b36402373d3f49d2822beec37924604c302
Instruction Fuzzy Hash: AC3129B5D0521D9BDB20EFA4DD897DDBBB8BF18304F1044AAE40DAB250EB705A89DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0056CDFC Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056CE50
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056CE9A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056CF60

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 108c956c21c7c4709f5a8c316002ab9e282c8f810616cf2ccabc79f3908a20a2
Instruction ID: 222dcd331f4667031be5ade27d577d7232e795aa943ae2b79620da73c294896d
Opcode Fuzzy Hash: 108c956c21c7c4709f5a8c316002ab9e282c8f810616cf2ccabc79f3908a20a2
Instruction Fuzzy Hash: 72618C71A10107AFDB289F24C886BBABBB9FF44310F10446AE905C7581FB34ED45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 005622A5 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0053121C), ref: 0056239D
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0053121C), ref: 005623A7
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0053121C), ref: 005623B4

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f0f6ecdf1ca51bd8d8bd125885ba3dd454e69c675f864a75ecd62cb61b140a25
Instruction ID: b665efb3714046e48b28eae2370eb90df86e83f9a612d50e9ab78b74cb217535
Opcode Fuzzy Hash: f0f6ecdf1ca51bd8d8bd125885ba3dd454e69c675f864a75ecd62cb61b140a25
Instruction Fuzzy Hash: 9931D2B490122DABCB21DF25DC887DDBBB8BF58310F5045EAE41CA7250EB709B858F44

Uniqueness

Uniqueness Score: -1.00%

Function 00555A8C Relevance: 2.9, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

Strings

]1T, xrefs: 00555DA0, 00555DBC, 00555CC8, 00555CD4, 00555DA4
0, xrefs: 00555C2C

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0$]1T
API String ID: 0-2255247438
Opcode ID: f5125db33c838448577ca919c2ccb8b32fd32afd5ac3fb2b5220896041dad2a3
Instruction ID: ac03bf51be9e0d6164e116fc649634568125bc730181c811c753de2d7f2e7245
Opcode Fuzzy Hash: f5125db33c838448577ca919c2ccb8b32fd32afd5ac3fb2b5220896041dad2a3
Instruction Fuzzy Hash: 7AD1A134600B068FCB24CF68C5B9A7ABFB1FF48322B54465BDC569B691E730AD49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0056FE89 Relevance: 2.8, APIs: 1, Instructions: 1290COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0056FF06

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: d0e7054d670d83b6d882064d6f9fb6342b5f3e40f7e5c0805b7d0f71c86d43a7
Instruction ID: c90874e02407ad2475fce103d175fa18b0f8fc03db3e5172a5e1535a16c62d25
Opcode Fuzzy Hash: d0e7054d670d83b6d882064d6f9fb6342b5f3e40f7e5c0805b7d0f71c86d43a7
Instruction Fuzzy Hash: 9AB23871E046298FDB65CE28ED407EABBF5FB84305F1495EAD80DA7280D774AE819F40

Uniqueness

Uniqueness Score: -1.00%

Function 0057DC08 Relevance: 2.1, Strings: 1, Instructions: 887COMMON

Download Yara Rule

Strings

|kZ, xrefs: 0057E2F1

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: |kZ
API String ID: 0-2937930400
Opcode ID: 706f35022d076a7da4ff9ad9d630fc52cd24b226db976abe5a50086bc3b7aa86
Instruction ID: cc9925e7209adc2549512deffe9cb73f0ff32a0c6a1afba21c89b6f58121ce62
Opcode Fuzzy Hash: 706f35022d076a7da4ff9ad9d630fc52cd24b226db976abe5a50086bc3b7aa86
Instruction Fuzzy Hash: D7823A75E002189FCB08CF59D495AACBBF2FF88314F2482ADE859AB341D7359946DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0057D200 Relevance: 2.0, Strings: 1, Instructions: 733COMMON

Download Yara Rule

Strings

|jZ, xrefs: 0057D96D

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: |jZ
API String ID: 0-3053876193
Opcode ID: c85a85da97673c6cb1b395b91ef0165f1d6b68c7529e0b26a2ffdcdb728ccd20
Instruction ID: ececcb92597a108b2ccf66614d54ebf59ed06072b7b0b4e406b4a1f102feb514
Opcode Fuzzy Hash: c85a85da97673c6cb1b395b91ef0165f1d6b68c7529e0b26a2ffdcdb728ccd20
Instruction Fuzzy Hash: 97525E70A012159FDB18CF59D5847ADBFB1FF88318F28C1A9D808AB252D375DA46DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0057AD5D Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000001,?,00000008,?,?,0057AD58,00000001,?,00000008,?,?,0057A7F9,00000000), ref: 0057AF8A

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a533a360388f52c387675f5a7fe3d7e8c8a7e97ab0a8b922ecf6a3ee9080c4a8
Instruction ID: 5ad0d6cbd2aa1a92ee4171b85234574b973c48bf55a36984eea81e7e611e613a
Opcode Fuzzy Hash: a533a360388f52c387675f5a7fe3d7e8c8a7e97ab0a8b922ecf6a3ee9080c4a8
Instruction Fuzzy Hash: DDB15971210608DFE715CF28D48AB697FA0FF85364F29C658E899CF2A1C335E981DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00567C8A Relevance: 1.7, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337e73cb24c21586c35fcaebb7b187dd6d90c2387fa1e98a089fd441c29c3b88
Instruction ID: a3df0fdc9d6bf36e37f3bcb8704837015a3770208bd9e1374dd732c994ce9166
Opcode Fuzzy Hash: 337e73cb24c21586c35fcaebb7b187dd6d90c2387fa1e98a089fd441c29c3b88
Instruction Fuzzy Hash: C451B37580421DAFDB249FB8CC89ABABBB9FF89304F1446DDE40993241EA319E458B50

Uniqueness

Uniqueness Score: -1.00%

Function 00537109 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053711F

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f9749c058b4017118d4016d4583731a415c591dec98caef982ce2a8951b3b464
Instruction ID: a0b00b7c9a01ff96af86b7ab385ac590fd0d6ddc44a89779a3f9adb58aa78beb
Opcode Fuzzy Hash: f9749c058b4017118d4016d4583731a415c591dec98caef982ce2a8951b3b464
Instruction Fuzzy Hash: 7F51AEB1E0570ACBDB68DF94D8857AABBF0FB58300F24852AE405EB250E374A944DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00555698 Relevance: 1.6, Strings: 1, Instructions: 385COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00555829

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: fd558280967597c918fb3eafb09113bc482d17ec8d7410a42e450d586d1ac775
Instruction ID: aa4c209ce738da211072eec065a0d234ed04dc6cf3d40920cb4713be90bd4f20
Opcode Fuzzy Hash: fd558280967597c918fb3eafb09113bc482d17ec8d7410a42e450d586d1ac775
Instruction Fuzzy Hash: 4AD1B134A10A06CFCB24CF68C5B467ABFB1FF48352B64461FE8569B691E730AD49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 005545A2 Relevance: 1.6, Strings: 1, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00554721

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1cb098420453fa21b1f6b479c55736876b9dcf7bdd5bde049268f9e1f2e5ad04
Instruction ID: 40754dc280f3db78644c2f3cfb5ae08f181e2fcd5c271fdc6fc6924f99e743f1
Opcode Fuzzy Hash: 1cb098420453fa21b1f6b479c55736876b9dcf7bdd5bde049268f9e1f2e5ad04
Instruction Fuzzy Hash: CDC1E0309006869FCB24CE68C4B8ABABFA1FF4631AF14061BDD5297691D331AD8DCF51

Uniqueness

Uniqueness Score: -1.00%

Function 00554243 Relevance: 1.6, Strings: 1, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 005543B3

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 57a6bea2ac49b6c7b93584bdfa301ba2a2fc3bc566b6e3a595fc530be5359651
Instruction ID: 3a04388f07907022c48c758ccf5034ae4bfbc4cc24a16824f0fac60ecd8f5f17
Opcode Fuzzy Hash: 57a6bea2ac49b6c7b93584bdfa301ba2a2fc3bc566b6e3a595fc530be5359651
Instruction Fuzzy Hash: 41C1CD749046068FCB24CE68C4A867ABFB1BF4530AF544A1BEC92976A1D730ADCDCF50

Uniqueness

Uniqueness Score: -1.00%

Function 00554910 Relevance: 1.6, Strings: 1, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00554A80

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4af3d2b26597203a8900e36c47e61d18a4406b007a3e89a7ab6e6826af9fa599
Instruction ID: 54cce1126fbe5ec7968bd442ec3696ecd6d476c3bf47711c7b07e679fd6d340c
Opcode Fuzzy Hash: 4af3d2b26597203a8900e36c47e61d18a4406b007a3e89a7ab6e6826af9fa599
Instruction Fuzzy Hash: 65C1DD705006068FCB25CF68C5A96BABFB6BB8531AF144A1BDC5697691C330ED8DCF50

Uniqueness

Uniqueness Score: -1.00%

Function 0056D04F Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056D0A3

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c313bcbad2747500e9d3b4a54c4c9aacdef023ce4bd14ea3cd2892cd1b3cbc12
Instruction ID: a61b4e7543b233a8512cb3fae75caa5ddc975362edc7b8d497d8c1f5e62ac4b2
Opcode Fuzzy Hash: c313bcbad2747500e9d3b4a54c4c9aacdef023ce4bd14ea3cd2892cd1b3cbc12
Instruction Fuzzy Hash: 1821CC72B10206ABDB28AE25DC5AABA3BB8FB45310F14046AFD02C7141FA74ED45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00554FCD Relevance: 1.6, Strings: 1, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00555170

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a8eb2772b140232036e9c7156b707432bd693fa6a713a9f22845d9da30d8e4e2
Instruction ID: 216db1c2c933fbbb6b42e8fefec6db6e1b4123bab635ca7eebcfed59632bf50b
Opcode Fuzzy Hash: a8eb2772b140232036e9c7156b707432bd693fa6a713a9f22845d9da30d8e4e2
Instruction Fuzzy Hash: 9EB1A335A00E068ACB24CFA8C9796BEBFB1BF44312F54491BDC5697690F730AD49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00554C6F Relevance: 1.6, Strings: 1, Instructions: 328COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00554E03

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ee1bc187e5221ce7d40cbe02ee62c913729a42cea6d86d8b3290db2b96790175
Instruction ID: 599a994077c792d6f1043f8102136700c53e1556fc5c803107c1bc198345e45b
Opcode Fuzzy Hash: ee1bc187e5221ce7d40cbe02ee62c913729a42cea6d86d8b3290db2b96790175
Instruction Fuzzy Hash: A3B1C070A0060A8BCB24CF68C5696BEBFB5BF8470AF14461FEC56A7650D730AD89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0055533A Relevance: 1.6, Strings: 1, Instructions: 328COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 005554CE

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 681fe88d72f3d0bfee796d2f271067e7319df849ddc50a2a5128fc6813820b99
Instruction ID: 7771355ad36fc0ad864b0e0e236c4b5f548b4e6d6b72440e094536308fa0fcaf
Opcode Fuzzy Hash: 681fe88d72f3d0bfee796d2f271067e7319df849ddc50a2a5128fc6813820b99
Instruction Fuzzy Hash: 56B1C270A00A0ACBCF24CF68C5785BEBFB1BF84312F54491BD956A7A50F731A989CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00553BB0 Relevance: 1.6, Strings: 1, Instructions: 322COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00553D43

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2aee7a663a27286bdb50a74fb09d2f7a0f74b748769b090d7b4ae53e5e139f15
Instruction ID: 1cfb2983b4a089ded544990e16e89f1cc621e65ac3b5fddb1f3651e5d0f733f7
Opcode Fuzzy Hash: 2aee7a663a27286bdb50a74fb09d2f7a0f74b748769b090d7b4ae53e5e139f15
Instruction Fuzzy Hash: 78B1C47090060B8BCB248E68C97A6BEBFB5BF44382F14061FDC5AA7651D731AF098B50

Uniqueness

Uniqueness Score: -1.00%

Function 0055386E Relevance: 1.6, Strings: 1, Instructions: 318COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 005539F2

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0c0535b4c4bc0683336cec96aac2b58a342cecfda1f70115cc12d11ba7a996d0
Instruction ID: 1e983a8727a1212a7551b1e444b985feadde9951e188a91cfa01b30140639131
Opcode Fuzzy Hash: 0c0535b4c4bc0683336cec96aac2b58a342cecfda1f70115cc12d11ba7a996d0
Instruction Fuzzy Hash: E0B1B67090060B8BCB28CE68C5B56BEBFB1BF44392F14061BDC9A97691D771AB0DCB51

Uniqueness

Uniqueness Score: -1.00%

Function 00553F01 Relevance: 1.6, Strings: 1, Instructions: 318COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00554085

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5082658fbc4c9931d113cc494fc407102a3fc2c8929174cc02c5bd7fd6b94ac3
Instruction ID: 9b6c4ef2d819d48c6248b54fc34fae44aa257d7c609af38df9328f67ddeb67a0
Opcode Fuzzy Hash: 5082658fbc4c9931d113cc494fc407102a3fc2c8929174cc02c5bd7fd6b94ac3
Instruction Fuzzy Hash: 99B1D27090460B8BCB248E68C4796BEBFB0BF4034AF14061FED5A97691D735AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0056CCD6 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

EnumSystemLocalesW.KERNEL32(0056CDFC,00000001,00000000,?,-00000050,?,0056D430,00000000,?,?,?,00000055,?), ref: 0056CD48

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c052094a4dca2910446224b034e1399f73b4e3447a8246e24355aa4ada8593f
Instruction ID: 8c1621866b3db3144f2eddda37e27a07183d7c90cfb7b57e69a37d602eb6ad3c
Opcode Fuzzy Hash: 8c052094a4dca2910446224b034e1399f73b4e3447a8246e24355aa4ada8593f
Instruction Fuzzy Hash: 3311E53A2047055FDB18AF39C8915BABFA2FFC0758B19443DE99687B40D771B942D740

Uniqueness

Uniqueness Score: -1.00%

Function 0056D27E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0056D018,00000000,00000000,?), ref: 0056D2AA

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 51495af6f8c6ad2a9a689e73904441c56dc5d30fa5c79d0ae30fb4baf443c6be
Instruction ID: 580a06d910a88f2b48d3ac89f007739e297cc78b9c44ac0d91745e2b8ad3a72b
Opcode Fuzzy Hash: 51495af6f8c6ad2a9a689e73904441c56dc5d30fa5c79d0ae30fb4baf443c6be
Instruction Fuzzy Hash: A501DB36B001126BDB185624CC15BBA7F74FB80754F154829AC46A3180EA34FD41D6A4

Uniqueness

Uniqueness Score: -1.00%

Function 0056CD71 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

EnumSystemLocalesW.KERNEL32(0056D04F,00000001,00000000,?,-00000050,?,0056D3F8,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0056CDBB

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d98828526cda936c8f0cdd882de6796c478fe893fc6557181b376fe4c89c273d
Instruction ID: af8cf53f7b5032c6cbeb26140c7a751e66cc8ca286c191a2fe5e98a9ab0096f4
Opcode Fuzzy Hash: d98828526cda936c8f0cdd882de6796c478fe893fc6557181b376fe4c89c273d
Instruction Fuzzy Hash: 8DF0C2763003446FDB145F359C85A7A7FA5FBC0368F05443DFA858B690DA71AC42D710

Uniqueness

Uniqueness Score: -1.00%

Function 00562779 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00561ECA: EnterCriticalSection.KERNEL32(-00065902,?,005665E8,?,005AB128,00000008,005669DB,?,0054D546,?,?,0054D546,0053121C,?,0056244A), ref: 00561ED9

EnumSystemLocalesW.KERNEL32(00562766,00000001,005AB028,0000000C,005630D0,00000000), ref: 005627B1

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 75098a5a05f6931aa3a7e4c48f40e5bd51e7fa4dfa6a26ec9ca514ec4d3d16e8
Instruction ID: e736d1d15379887d185d68672083424b3117c7521ad934a9fbfb68b627a82e46
Opcode Fuzzy Hash: 75098a5a05f6931aa3a7e4c48f40e5bd51e7fa4dfa6a26ec9ca514ec4d3d16e8
Instruction Fuzzy Hash: 1FF03C76A40205DFD700EF98E84AB9D7BF0FB55721F00411AE514D72A1D775A909DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0056CC6D Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00566DA1: GetLastError.KERNEL32(00000000,?,0056DCDC,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000,?,00000010), ref: 00566DA5
Part of subcall function 00566DA1: SetLastError.KERNEL32(00000000,?,?,?,00000000,00000001,00000006,000000FF,?,?,?,00000000,005432E0,?,?,0053121C), ref: 00566E47

EnumSystemLocalesW.KERNEL32(0056CBC6,00000001,00000000,?,?,0056D452,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0056CCA4

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3d52ccc358b415b037cf77560f0c5092d2395537e6027d84e9535d7798453404
Instruction ID: a01bb2da496aab1ffe91560234a7b36c55dbe8a528363c7d64921aa0e9bd098f
Opcode Fuzzy Hash: 3d52ccc358b415b037cf77560f0c5092d2395537e6027d84e9535d7798453404
Instruction Fuzzy Hash: D8F0E53A30020557DB04DF35D845A7A7FA4FFC1714B0A4059EB19CB250CA719C42D790

Uniqueness

Uniqueness Score: -1.00%

Function 0056325F Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00561047,?,20001004,00000000,00000002,?,?,005603AA), ref: 00563293

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8a9ef60f61dd9747cce1b108cfc97a2aad624a2778834305bbd753c3a1d543b6
Instruction ID: 95632fad8a5a6cb674ae98ebd0dca1153516f92fa255de4076f3a7fd6e289795
Opcode Fuzzy Hash: 8a9ef60f61dd9747cce1b108cfc97a2aad624a2778834305bbd753c3a1d543b6
Instruction Fuzzy Hash: 70E04F35500229BBCF122F61DC09AAE7F15FF95761F054415FD0566261CF718A21FAD4

Uniqueness

Uniqueness Score: -1.00%

Function 00534540 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,00534A3B), ref: 00534553

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 321bf731fdbd02b568a24d24e52d97ac3c6f8ea5b90084a2ab0dbbd9d493a430
Instruction ID: faa792d459d0074c3b92ced56a7ba3b2cdc88d5f3d716d68d98663fc11df3483
Opcode Fuzzy Hash: 321bf731fdbd02b568a24d24e52d97ac3c6f8ea5b90084a2ab0dbbd9d493a430
Instruction Fuzzy Hash: 72C01272A0020956CF0497A5651A6BA77E85B44609F100056ED06F6081E961ED554660

Uniqueness

Uniqueness Score: -1.00%

Function 00562918 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00032766,00000001), ref: 00562932

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0248aa08af85e1bb7f2e738e709f3e44df17a6daf61c9f0aa0e0a7bcc4ffa3f0
Instruction ID: 5e80b9f0e7bbcffd939ae05f8526257ceeb0796f197c5e53ded4075e28fc9f00
Opcode Fuzzy Hash: 0248aa08af85e1bb7f2e738e709f3e44df17a6daf61c9f0aa0e0a7bcc4ffa3f0
Instruction Fuzzy Hash: F5D0A7344403086BD700AF20FD0F8103F65F790720F000119F60C17260FA727546EA00

Uniqueness

Uniqueness Score: -1.00%

Function 005628E6 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00032766,00000001), ref: 005628FC

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 9b4b08504362d9031ef003b074bf8fed096326cd8bcb6fe3c8878be31d5dc2c3
Instruction ID: 931d7df324cfd323216b0edd2173bedf5ea33af0432e19ef38cc0824ae5e1680
Opcode Fuzzy Hash: 9b4b08504362d9031ef003b074bf8fed096326cd8bcb6fe3c8878be31d5dc2c3
Instruction Fuzzy Hash: 90D0C9745413049FD744EF34ED4E9103B61FB55710F10016DF61A9B6B0EA716549EA00

Uniqueness

Uniqueness Score: -1.00%

Function 00536DA0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006DAF,00536278), ref: 00536DA5

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 51bf2cf8e4937850c1eeb22da1100f0db43eb56f0fabbf04fd54a341d356a8a0
Instruction ID: 070b7d4c3ed9778f1dbf7231c2dc52bfbaa357cbbd484b4c628d9e25cc7ab5bb
Opcode Fuzzy Hash: 51bf2cf8e4937850c1eeb22da1100f0db43eb56f0fabbf04fd54a341d356a8a0
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 005352FF Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

YUS, xrefs: 00535394

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: YUS
API String ID: 0-2843895154
Opcode ID: db4909dd59dab18db96f12550ba82f8c83915eca87af595f40be379563cb4782
Instruction ID: 1d7dc75b9508970df843bb91fd631d72edcad45efab1819ce41d69e2c33954f7
Opcode Fuzzy Hash: db4909dd59dab18db96f12550ba82f8c83915eca87af595f40be379563cb4782
Instruction Fuzzy Hash: E7517972E006099FDB48CFAEC8846DDFBF1AF88315F1485AED455E7341E674AA458B40

Uniqueness

Uniqueness Score: -1.00%

Function 0056D5EA Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0056D5EA

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ea5987001bfcb646e90bd4b7322ecbc7e1b45d32bd63ad911721190444f5ba21
Instruction ID: 139ffc2d18f01e881b70c8049f90efe5a6ac019b6194037ab92b46c9ac5ab744
Opcode Fuzzy Hash: ea5987001bfcb646e90bd4b7322ecbc7e1b45d32bd63ad911721190444f5ba21
Instruction Fuzzy Hash: 2BA02230300200CF83808F38AECA30C3BE8AA222C0B0A022BE000C0030EF30A0C8FB00

Uniqueness

Uniqueness Score: -1.00%

Function 0058EC3F Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e98f9d8aa3e06f511f55ce14a6c12815f67bb2788aa1fdb835ecdbb60ed9c37
Instruction ID: 00dd54fadb05b52b62179773aac6438b356386fcbe6f0d8f6deadb39d4614859
Opcode Fuzzy Hash: 9e98f9d8aa3e06f511f55ce14a6c12815f67bb2788aa1fdb835ecdbb60ed9c37
Instruction Fuzzy Hash: E0223D71A002259FDB26DF18CC81BAABBF9BB49704F1444EAE949FB245D7709E81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00571CF0 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ab7b04520b53dddb1765171a97f79dcaee07a397e2e079d60b1b488abaf9d4
Instruction ID: 102614c2ea0fa7cb30d0f59b4ea842ac841535acb44874fa0e50145a24327f56
Opcode Fuzzy Hash: 40ab7b04520b53dddb1765171a97f79dcaee07a397e2e079d60b1b488abaf9d4
Instruction Fuzzy Hash: F6F17C71A002299FDB25DF18DC81BAABBB9FF86304F1480DAD94DA7241D7709E81DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00555E8F Relevance: .4, Instructions: 385COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3faa51fc310a87aeb034b3cabcbb085f275b7ed5a546467ac916bfb8d0bde2a
Instruction ID: c474b85a4230e1954fab05bc3cdb57f4583b00c412ac8780739130efc7aca646
Opcode Fuzzy Hash: d3faa51fc310a87aeb034b3cabcbb085f275b7ed5a546467ac916bfb8d0bde2a
Instruction Fuzzy Hash: 10D1BD74A00A468FCB24CF68C4B4A7EBFB1FF44316F54465BE8569B6A1E730AD49CB10

Uniqueness

Uniqueness Score: -1.00%

Function 005844C0 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d32d588d6d48219a54d2052ec162130bd5e4f7525442c8a6c22564c4212c9d
Instruction ID: 77244942be7abdc19af53fa808c2c058b8376f20f1c8f3da688214bb9c2b6120
Opcode Fuzzy Hash: 22d32d588d6d48219a54d2052ec162130bd5e4f7525442c8a6c22564c4212c9d
Instruction Fuzzy Hash: 18028C755082158FC709CF18D4948FABBF1FF68310B1A86EADC999B366D3319980CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0056C42E Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7e59e40cd605dd1eea64810c2714a450ca7bb483a45588d889cab68de9e06077
Instruction ID: f72b9af62bc611f826c4f345e162d66678d7e09666e1a74eaae31d5113b35ca1
Opcode Fuzzy Hash: 7e59e40cd605dd1eea64810c2714a450ca7bb483a45588d889cab68de9e06077
Instruction Fuzzy Hash: 7BB105756007068BDB349B28CC96AB7BFA9FF94308F54446DE987C7680EA74E9858B10

Uniqueness

Uniqueness Score: -1.00%

Function 005718A0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f22d74a03bc3b211af31eb1642f1b25f7fe84e879cabae70b7c80eb24edb5fcf
Instruction ID: e326c46fec0ad5048cfa315f209ff457b258b1f2c6df1253b4b3de184c314200
Opcode Fuzzy Hash: f22d74a03bc3b211af31eb1642f1b25f7fe84e879cabae70b7c80eb24edb5fcf
Instruction Fuzzy Hash: 8EA17F71A002198FCB24CF59D891BEDBBB5FF89314F1581EAD90DA7241E7309E859F84

Uniqueness

Uniqueness Score: -1.00%

Function 005821A0 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e6cf0772f096129ec6ca1da8aa2c9da437c868f59faac14615b5cb91be3c34
Instruction ID: c3fb98f2d7a04c82060ad47d1fff1e96bf7b4cf1d67781b38899f5b0746ca0f4
Opcode Fuzzy Hash: 70e6cf0772f096129ec6ca1da8aa2c9da437c868f59faac14615b5cb91be3c34
Instruction Fuzzy Hash: 4F910A70A101298FCB08CF6DDC9547FBBF1FB5E301B45855AEA51EB291C238EA15DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0058F9AF Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac400911af7dd5e04da6e6ba566fb3fe42a7a9a4dc55ea0196dabb6dbc8e1ba5
Instruction ID: d616dd3a4023ac62369bc0b8c9ee8e293d7bafa2f8d61a866955bcd88bac8a16
Opcode Fuzzy Hash: ac400911af7dd5e04da6e6ba566fb3fe42a7a9a4dc55ea0196dabb6dbc8e1ba5
Instruction Fuzzy Hash: 8E517C72D00219EFDF04DF99C881AAEBFB2FF88310F598469E955BB201D7749A51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00580800 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563245e526623d9bd4de7b679c4b16e970cfe5cf4686e858c1ff716472efeb5a
Instruction ID: 5fc9cf59246bc9f95b2f08f11f8590e609ca2d8b1aae57f7e493b49a3bf27bcb
Opcode Fuzzy Hash: 563245e526623d9bd4de7b679c4b16e970cfe5cf4686e858c1ff716472efeb5a
Instruction Fuzzy Hash: 7231E4727006099BDBA4DD58D8903BAB7A6FF81314F1C4229CC46ABB85D631FD5ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 00535EEE Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239c5cdd483dc4f883a7baca3fc0a2995026a08c470624c16adf9c9aa1a54db4
Instruction ID: 3f4cdffcc044dc3d3836ccd209c12ac18097185ed6a3929448c05a4579ed6b24
Opcode Fuzzy Hash: 239c5cdd483dc4f883a7baca3fc0a2995026a08c470624c16adf9c9aa1a54db4
Instruction Fuzzy Hash: FB2171367144129BD71CDF2CD896A69F3A5FB88300F45427ED51BCB682EB36E442CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0053BDF9 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053BEC2
DName::operator+.LIBCMT ref: 0053BEFF
DName::DName.LIBVCRUNTIME ref: 0053BF13
DName::operator+.LIBCMT ref: 0053BF22
DName::operator+.LIBCMT ref: 0053BFB0
DName::DName.LIBVCRUNTIME ref: 0053BFD8
DName::operator+.LIBCMT ref: 0053BFE6
DName::operator+.LIBCMT ref: 0053C020
DName::operator+.LIBCMT ref: 0053C061
UnDecorator::getReturnType.LIBCMT ref: 0053C091
operator+.LIBVCRUNTIME ref: 0053C193

Strings

\$[, xrefs: 0053C073

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID: \$[
API String ID: 2932655852-2545313564
Opcode ID: 45b187616c1ac80f3caaae6b72af083cd84f8b24ceb67915997b90314bd3a31b
Instruction ID: 6cb91e7bb41ce7387bb7a7a71abb6f947072523da0297d81c6fca99d806ff7e9
Opcode Fuzzy Hash: 45b187616c1ac80f3caaae6b72af083cd84f8b24ceb67915997b90314bd3a31b
Instruction Fuzzy Hash: 54C16071900209AFDB19EFA8D89A9FE7FB8BB58300F14055DF502A7291EF30A945DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0053A49F Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 0053A512
shared_ptr.LIBCMT ref: 0053A55A
shared_ptr.LIBCMT ref: 0053A579
operator+.LIBVCRUNTIME ref: 0053A6A7
DName::operator=.LIBVCRUNTIME ref: 0053A6B9
shared_ptr.LIBCMT ref: 0053A8FE
DName::operator+.LIBCMT ref: 0053A940
operator+.LIBVCRUNTIME ref: 0053A986

Strings

|Y, xrefs: 0053A777

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID: |Y
API String ID: 1464150960-4190251829
Opcode ID: ec7eb03e2c8b504115195b304abf6b8ee9b1c1c29300f9b40e3a7ddf65e8673b
Instruction ID: 1621026ea1d64756e6f749bc8c35fe6bc8bdcf24f0bb91d47ac4678766b97921
Opcode Fuzzy Hash: ec7eb03e2c8b504115195b304abf6b8ee9b1c1c29300f9b40e3a7ddf65e8673b
Instruction Fuzzy Hash: 52E16EB2C0420A9FCF08DF94C499AFEBFB4FB54304F20852AE552A7251D7745A49CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0053D35D Relevance: 19.8, APIs: 13, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053D3C8
DName::operator+.LIBCMT ref: 0053D50B

Part of subcall function 00538DCE: shared_ptr.LIBCMT ref: 00538DEA

DName::operator+.LIBCMT ref: 0053D4B6
DName::operator+.LIBCMT ref: 0053D557
DName::operator+.LIBCMT ref: 0053D566
DName::operator+.LIBCMT ref: 0053D692
DName::operator=.LIBVCRUNTIME ref: 0053D6D2
DName::DName.LIBVCRUNTIME ref: 0053D6DC
DName::operator+.LIBCMT ref: 0053D6F9
DName::operator+.LIBCMT ref: 0053D705

Part of subcall function 0053EBCE: Replicator::operator[].LIBCMT ref: 0053EC0B

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID:
API String ID: 1043660730-0
Opcode ID: 4e6678894cf602d7ebcdf35fa4f90f56de376b51fb1e333a1cc2b82e1ef7d245
Instruction ID: 3467f1b7e297284585907428b4b8e1d675992f88fe23cc15b860dde3538989d6
Opcode Fuzzy Hash: 4e6678894cf602d7ebcdf35fa4f90f56de376b51fb1e333a1cc2b82e1ef7d245
Instruction Fuzzy Hash: AFC1B1B19002099FCF18DFA4E859BEEBFF8BB54304F14445DF15AA7291EB75A948CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0053EBCE Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0053EC0B

Strings

template-parameter-, xrefs: 0053EC6A
@, xrefs: 0053ED77
generic-type-, xrefs: 0053EC91
\$[, xrefs: 0053EDB5

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$\$[$generic-type-$template-parameter-
API String ID: 3676697650-1312965378
Opcode ID: be01ee05619ed37b9d136e9b793df760dc4c22a4e7112f33e2f26c202df51c5f
Instruction ID: f62f2a4c6a258883b111bda6dc2404d84bcc2ebaeb3d48b5f1269ecc755bdf8b
Opcode Fuzzy Hash: be01ee05619ed37b9d136e9b793df760dc4c22a4e7112f33e2f26c202df51c5f
Instruction Fuzzy Hash: 38619071D002099BDB14DFA4D846BFEBFF8BF58310F144829E511A72E1EB74A909DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0053DE43 Relevance: 15.3, APIs: 10, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053DF19
UnDecorator::getSignedDimension.LIBCMT ref: 0053DF24
UnDecorator::getSignedDimension.LIBCMT ref: 0053E010
UnDecorator::getSignedDimension.LIBCMT ref: 0053E02D
UnDecorator::getSignedDimension.LIBCMT ref: 0053E04A
DName::operator+.LIBCMT ref: 0053E05F
UnDecorator::getSignedDimension.LIBCMT ref: 0053E079
swprintf.LIBCMT ref: 0053E0F3
DName::operator+.LIBCMT ref: 0053E14E

Part of subcall function 00539E7A: DName::DName.LIBVCRUNTIME ref: 00539ED8

DName::DName.LIBVCRUNTIME ref: 0053E1C5

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$swprintf
String ID:
API String ID: 3689813335-0
Opcode ID: aa4a9590d72e44016b6b9cb6bed590eb4fb5704ca1e99568b3681780605c31c5
Instruction ID: 106f36feb09725fdc9207fd542d2cef93cf7dc73db7df694777a93b6d614a084
Opcode Fuzzy Hash: aa4a9590d72e44016b6b9cb6bed590eb4fb5704ca1e99568b3681780605c31c5
Instruction Fuzzy Hash: CB917572D0420A96DF19EBB4E98E9BF7FBCBB54300F100519F102EA1D2DA74AA08D761

Uniqueness

Uniqueness Score: -1.00%

Function 0055D0AC Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0055D484

Strings

f, xrefs: 0055D1A2
f, xrefs: 0055D1BE
:, xrefs: 0055D177
p, xrefs: 0055D20B
f, xrefs: 0055D204
p, xrefs: 0055D1C5
p, xrefs: 0055D1A9

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: 0f6d2a7d6060760592ffb78559759b8497237619bfb8c994658b7990f1867300
Instruction ID: 8404a3c0a63f86379d14141625b0b14f03ccbf0a79a662f1a269507a1f8c4ec7
Opcode Fuzzy Hash: 0f6d2a7d6060760592ffb78559759b8497237619bfb8c994658b7990f1867300
Instruction Fuzzy Hash: 61027E7AA01119DADF308FA4C4646EDBF72FB40B1AFA0410BDC156B281E7709E8DCB65

Uniqueness

Uniqueness Score: -1.00%

Function 0053A253 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053A2E1
DName::operator+.LIBCMT ref: 0053A334

Part of subcall function 00538DCE: shared_ptr.LIBCMT ref: 00538DEA

Part of subcall function 00538CBD: DName::operator+.LIBCMT ref: 00538CDE

DName::operator+.LIBCMT ref: 0053A325
DName::operator+.LIBCMT ref: 0053A385
DName::operator+.LIBCMT ref: 0053A392
DName::operator+.LIBCMT ref: 0053A3D9
DName::operator+.LIBCMT ref: 0053A3E6

Strings

|Y, xrefs: 0053A296

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID: |Y
API String ID: 1037112749-4190251829
Opcode ID: c86932d83de435f88235c26d9c6bb4c49ef7402a4161539a0b4196fc5c15e762
Instruction ID: dc9b45ff89742e693f0af494ef97c7d852cd6893911e19f1ae6d00fa57c8d088
Opcode Fuzzy Hash: c86932d83de435f88235c26d9c6bb4c49ef7402a4161539a0b4196fc5c15e762
Instruction Fuzzy Hash: 005163B1900219AFDF19DB94C899EEFBFB8BF58300F044559F502A7181EF709A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0054052B Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0054064A
___TypeMatch.LIBVCRUNTIME ref: 00540758
_UnwindNestedFrames.LIBCMT ref: 005408AA
CallUnexpected.LIBVCRUNTIME ref: 005408C5

Strings

csm, xrefs: 00540568
csm, xrefs: 005405D5
csm, xrefs: 00540681

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 67ccb657584cf26379bd9037851b1bbf8917aa84bb895614a7d576342c73d4ac
Instruction ID: ea9ce3c6c1d790419e926a55a0ed88d5ef0c03ba77d00d32acebd62c8120ca70
Opcode Fuzzy Hash: 67ccb657584cf26379bd9037851b1bbf8917aa84bb895614a7d576342c73d4ac
Instruction Fuzzy Hash: E0B1587180020AEFCF18DFA4C9849EEBFB5BF44318F255559EA016B292D731EA51CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00537650 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00537687
___except_validate_context_record.LIBVCRUNTIME ref: 0053768F
_ValidateLocalCookies.LIBCMT ref: 00537718
__IsNonwritableInCurrentImage.LIBCMT ref: 00537743
_ValidateLocalCookies.LIBCMT ref: 00537798

Strings

csm, xrefs: 0053772D
GzS, xrefs: 00537735, 0053773E, 0053774F

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: GzS$csm
API String ID: 1170836740-2539124384
Opcode ID: e0922411c6f29fc8f413491be5a0d2d95fc68503025afc85191d3384512bc939
Instruction ID: a970643768b8c2e7fa928ada287d2a9ae528b8e6ccb0580ffd116f4f5db32cc3
Opcode Fuzzy Hash: e0922411c6f29fc8f413491be5a0d2d95fc68503025afc85191d3384512bc939
Instruction Fuzzy Hash: DD41B3B4E0420D9BCF20DF6CC889A9EBFB5FF49324F148455E815AB352D731AA15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005650AF Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00565135

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5ac5a49c7886aaee7d62bcf34ba0d18555b44b0380b87b5be532695983ebff54
Instruction ID: 53e045c096a1955a2e4277bb55fb2e54db142dbb26fc529487522d84e964d475
Opcode Fuzzy Hash: 5ac5a49c7886aaee7d62bcf34ba0d18555b44b0380b87b5be532695983ebff54
Instruction Fuzzy Hash: C6B19732A80B569FDB21CF24CC91BAEBFA5FF56750F244555E940AB382F3B49900C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0055DF7E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,005B24E2,00000104), ref: 0055DFDB

Part of subcall function 005624F6: IsProcessorFeaturePresent.KERNEL32(00000017,005624C8,00000010,?,00000000,?,00000000,?,?,?,0055A397,00000000,00000000,00000000,00000000,00000000), ref: 005624F8
Part of subcall function 005624F6: GetCurrentProcess.KERNEL32(C0000417,?,00000010), ref: 0056251B
Part of subcall function 005624F6: TerminateProcess.KERNEL32(00000000), ref: 00562522

Strings

..., xrefs: 0055E029
Microsoft Visual C++ Runtime Library, xrefs: 0055E070
<program name unknown>, xrefs: 0055DFEA
$[, xrefs: 0055DFCE
Runtime Error!Program: , xrefs: 0055DFA7

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Process$CurrentFeatureFileModuleNamePresentProcessorTerminate
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $$[
API String ID: 872218275-544949332
Opcode ID: 3766105bf8605c829b79a87db4870ba2cd61a0f3f40a0e76c20732512823ebe0
Instruction ID: 425b6c0d818041e8f5273c037c56cc8d30a9bf83125270121afa307c8e857769
Opcode Fuzzy Hash: 3766105bf8605c829b79a87db4870ba2cd61a0f3f40a0e76c20732512823ebe0
Instruction Fuzzy Hash: 80214B3254420A67EF346A509C2FEAB3F5CBFE5756F400422FD08835A1FA61DB18D2A0

Uniqueness

Uniqueness Score: -1.00%

Function 00577724 Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d79613355c9ddc01cfe7732d9848852665d7aabd150ef52267f141a468d48a
Instruction ID: 150d2b193c5e610d79c38e2ab0a339189dc42036dd7ff9068e61b93fd73ebabb
Opcode Fuzzy Hash: d0d79613355c9ddc01cfe7732d9848852665d7aabd150ef52267f141a468d48a
Instruction Fuzzy Hash: 51B1F570A0824EABDB119F68F849BAD7FB1FF49304F148258E508A7392C770AE45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 005793EB Relevance: 9.2, APIs: 6, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,005796BB,00000000,00000000,?,00000000,?,?,?,?,00000000,?), ref: 00579491
__freea.LIBCMT ref: 00579626
__freea.LIBCMT ref: 0057962C
__freea.LIBCMT ref: 00579662
__freea.LIBCMT ref: 00579668
__freea.LIBCMT ref: 00579678

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: 1bf56ed5b5234e88f8b2275ed08ca9d5843ed81cc70941680774f5b57664a045
Instruction ID: 6a534be2bd8b513aa293bb8ed7d700fc8732dddbb09608dc78cf52473334640f
Opcode Fuzzy Hash: 1bf56ed5b5234e88f8b2275ed08ca9d5843ed81cc70941680774f5b57664a045
Instruction Fuzzy Hash: CA7107769002165FDF219EA4AC46FEE7FBABF89310F248159E90DA7281E735DC01A770

Uniqueness

Uniqueness Score: -1.00%

Function 0053EA7A Relevance: 9.1, APIs: 6, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053EABE
DName::operator+.LIBCMT ref: 0053EACA

Part of subcall function 00538DCE: shared_ptr.LIBCMT ref: 00538DEA

DName::operator+=.LIBCMT ref: 0053EB88

Part of subcall function 0053D35D: DName::operator+.LIBCMT ref: 0053D3C8
Part of subcall function 0053D35D: DName::operator+.LIBCMT ref: 0053D692

Part of subcall function 00538CBD: DName::operator+.LIBCMT ref: 00538CDE

DName::operator+.LIBCMT ref: 0053EB45

Part of subcall function 00538E26: DName::operator=.LIBVCRUNTIME ref: 00538E47

DName::DName.LIBVCRUNTIME ref: 0053EBAC
DName::operator+.LIBCMT ref: 0053EBB8

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID:
API String ID: 2795783184-0
Opcode ID: 8cb6f05eaed23d6b11c9980a99b26663119ed4e65e8507bc73a1255b6ac24e14
Instruction ID: bdbbc1ae520eee587387979716bea557d1a14448ef68bb88875ea5dc88a54963
Opcode Fuzzy Hash: 8cb6f05eaed23d6b11c9980a99b26663119ed4e65e8507bc73a1255b6ac24e14
Instruction Fuzzy Hash: C94183B0A04248AFDF1ADFA8D866AADBFF9BB59300F040458F156AB2D1DB346D44C754

Uniqueness

Uniqueness Score: -1.00%

Function 0053D71B Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0053EBCE: Replicator::operator[].LIBCMT ref: 0053EC0B

DName::operator=.LIBVCRUNTIME ref: 0053D7C7

Part of subcall function 0053D35D: DName::operator+.LIBCMT ref: 0053D3C8
Part of subcall function 0053D35D: DName::operator+.LIBCMT ref: 0053D692

DName::operator+.LIBCMT ref: 0053D781
DName::operator+.LIBCMT ref: 0053D78D
DName::DName.LIBVCRUNTIME ref: 0053D7D1
DName::operator+.LIBCMT ref: 0053D7EE
DName::operator+.LIBCMT ref: 0053D7FA

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: c05c96ecaf63a0ece9b439643fb90abae2b57f59d11dea7bb0f50f73e86cb730
Instruction ID: dc2230c98d73add5d742a6ff60ab55ecafc8ec9f775c1e8c2f6abcc3ae04e233
Opcode Fuzzy Hash: c05c96ecaf63a0ece9b439643fb90abae2b57f59d11dea7bb0f50f73e86cb730
Instruction Fuzzy Hash: 4B31A1B1A00305AFDB18DF64E455AAABFF4FF98300F14885DE48697391EB34A908CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00538184 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0053817B,00537C50,00536DF3), ref: 00538192
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005381A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005381B9
SetLastError.KERNEL32(00000000,0053817B,00537C50,00536DF3), ref: 0053820B

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 713edbf3e5eea2f4a7af11dea36d39c7f647cf25509bd084d739f495ede252c2
Instruction ID: 599bfb6a019c2207c0308bd1e7c9388deb7c46f7be7b0bcf2b720f44e1df36f5
Opcode Fuzzy Hash: 713edbf3e5eea2f4a7af11dea36d39c7f647cf25509bd084d739f495ede252c2
Instruction Fuzzy Hash: CC01D8725197126ED6182B746C8E9776FB4FB52775F30023AF912450E1EF614C06A254

Uniqueness

Uniqueness Score: -1.00%

Function 00541E10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,25D5FA14,?,?,00000000,00596F45,000000FF,?,00541DA1,00541EE6,?,00541D75,00000000), ref: 00541E45
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00541E57
FreeLibrary.KERNEL32(00000000,?,?,00000000,00596F45,000000FF,?,00541DA1,00541EE6,?,00541D75,00000000), ref: 00541E79

Strings

CorExitProcess, xrefs: 00541E4F
mscoree.dll, xrefs: 00541E3E

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0396fbd29dc12e9bf0a08c9c46218c57b6a8834790bd6fe04bc4f172ad257f6a
Instruction ID: dc63a980d6dc8b48a0fa23f0745820bdbb5903d078c4aad8fe928ec589ba2559
Opcode Fuzzy Hash: 0396fbd29dc12e9bf0a08c9c46218c57b6a8834790bd6fe04bc4f172ad257f6a
Instruction Fuzzy Hash: 03018F35A00619ABDB019F90DC09BBEBFB9FB05B14F040126E821E2290DB749844DA54

Uniqueness

Uniqueness Score: -1.00%

Function 00562E9E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00562E57), ref: 00562EAD
GetLastError.KERNEL32(?,00562E57), ref: 00562EB7
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00562EF5

Strings

ext-ms-, xrefs: 00562EDA
api-ms-, xrefs: 00562EC4

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: d2cc78525480f0e5b6249aa1a8d3aa68ed8f389cb99398103e74f59a70f33882
Instruction ID: 07a3973f22a70210810c9ffe04d41b00a7efd33bdabd1cda9d018239c548ff43
Opcode Fuzzy Hash: d2cc78525480f0e5b6249aa1a8d3aa68ed8f389cb99398103e74f59a70f33882
Instruction Fuzzy Hash: 04F08C30684609BBEB201A60EC0AF3A3F59BB51B40F180430FD0CE95E0EFB6EC15E644

Uniqueness

Uniqueness Score: -1.00%

Function 0053CD2D Relevance: 7.7, APIs: 5, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 0053CD98
operator+.LIBVCRUNTIME ref: 0053CDE8
shared_ptr.LIBCMT ref: 0053CEB4
DName::DName.LIBVCRUNTIME ref: 0053CEE4
operator+.LIBVCRUNTIME ref: 0053CF45

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID:
API String ID: 2894330373-0
Opcode ID: 18bce175552c1aa3386f08fbb4575327d3e83bbefa77f1653e45f2910e3cd4c8
Instruction ID: 674af61d5d44476e4d4a202206eaf10cefebb9b8dda16c54ac80da8397922598
Opcode Fuzzy Hash: 18bce175552c1aa3386f08fbb4575327d3e83bbefa77f1653e45f2910e3cd4c8
Instruction Fuzzy Hash: FB6160B180420AEFCF15DF68D8489BD7FB9FB45304F148A6AF415AB221E731AA05DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00537BA9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

__is_exception_typeof.LIBVCRUNTIME ref: 00537C3D

Strings

MOC, xrefs: 00537BBB
RCC, xrefs: 00537BB3
csm, xrefs: 00537BC3

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: __is_exception_typeof
String ID: MOC$RCC$csm
API String ID: 3140442014-2671469338
Opcode ID: 0b41e68be55652cef56a8fbd7f1c70865681bcbe45c17f5fb5fa4ba3894daece
Instruction ID: c9ac0cb12df60d3b654aff0ef193cfb13a20bf2e5493a7ac84a6d8ef5cdd957c
Opcode Fuzzy Hash: 0b41e68be55652cef56a8fbd7f1c70865681bcbe45c17f5fb5fa4ba3894daece
Instruction Fuzzy Hash: 1D11DDB191870E9FC728AF54D405AA9BFF8FF48351F25409AF800AB261EB74ED40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0053874C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00538769

Part of subcall function 0053F203: _vsnprintf.LEGACY_STDIO_DEFINITIONS ref: 0053F213

swprintf.LIBCMT ref: 0053878C

Part of subcall function 0053F21D: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0053F22F

Strings

%lf, xrefs: 0053875F, 00538764, 00538789
\$[, xrefs: 00538771

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ___swprintf_l__vswprintf_c_l_vsnprintfswprintf
String ID: %lf$\$[
API String ID: 3672277462-772408046
Opcode ID: 2a04f5affb22fa66f34f5ce65269c31d0e264aebc76f857d31a42b8dac9e625d
Instruction ID: dbad28229fcf3e97fb6634f26585183608bd4425ecfd0cc89bd031531fba8ce8
Opcode Fuzzy Hash: 2a04f5affb22fa66f34f5ce65269c31d0e264aebc76f857d31a42b8dac9e625d
Instruction Fuzzy Hash: 4AF0C2A9500009BADB046B84DC4AFBF7FACEB85354F0140A8F68516141DB756E0093B2

Uniqueness

Uniqueness Score: -1.00%

Function 005387AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 005387C5

Part of subcall function 0053F203: _vsnprintf.LEGACY_STDIO_DEFINITIONS ref: 0053F213

swprintf.LIBCMT ref: 005387E8

Part of subcall function 0053F21D: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0053F22F

Strings

%lf, xrefs: 005387BB, 005387C0, 005387E5
\$[, xrefs: 005387CD

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ___swprintf_l__vswprintf_c_l_vsnprintfswprintf
String ID: %lf$\$[
API String ID: 3672277462-772408046
Opcode ID: a76c8277a8b7e6e8a4dee74d396bf4c6f25ccd20388b07d20075d1689f86ff0b
Instruction ID: ad6fffefde829d7faf9bf8b4cc5a7f93a14118ace854f3e765f1632c8638139b
Opcode Fuzzy Hash: a76c8277a8b7e6e8a4dee74d396bf4c6f25ccd20388b07d20075d1689f86ff0b
Instruction Fuzzy Hash: FFF0B4A9500009BADB046B94DC4EFBF7FACEF85794F018068FA4957242DB75AE0093B6

Uniqueness

Uniqueness Score: -1.00%

Function 0053F706 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0053F603,00000000,?,005B2418,?,?,?,0053F85A,00000004,InitializeCriticalSectionEx,0059FAA4,InitializeCriticalSectionEx), ref: 0053F713
GetLastError.KERNEL32(?,0053F603,00000000,?,005B2418,?,?,?,0053F85A,00000004,InitializeCriticalSectionEx,0059FAA4,InitializeCriticalSectionEx,00000000,?,005382B1), ref: 0053F71D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0053F745

Strings

api-ms-, xrefs: 0053F72A

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a2283524f9ae96462cdc0459deae4d4a1cbdc41c2d96fc257b44810b43260528
Instruction ID: 63642d3a1c11f2e0db441736b77f5ea4a8d3688367779ac18d0dc4dbe560a948
Opcode Fuzzy Hash: a2283524f9ae96462cdc0459deae4d4a1cbdc41c2d96fc257b44810b43260528
Instruction Fuzzy Hash: 1EE04F30A80208BBEF501BA0EC0EF693F59FB11B50F154431F90CE80E0DBA2E829A744

Uniqueness

Uniqueness Score: -1.00%

Function 0056F1C7 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(25D5FA14,00000000,00000000,00000000), ref: 0056F22A

Part of subcall function 0056989F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000001,?,00000000,?,?,?,00565C35,?,00000000,?), ref: 00569900

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0056F47C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0056F4C2
GetLastError.KERNEL32 ref: 0056F565

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d0d768af173101a58c4eda3d90b0c8b5ff27b93cbfe11d927207dd20600a511a
Instruction ID: bfd792d08ef53362f04bd2ee713906ab4f905d5a6237d11bb6f17704e475fa35
Opcode Fuzzy Hash: d0d768af173101a58c4eda3d90b0c8b5ff27b93cbfe11d927207dd20600a511a
Instruction Fuzzy Hash: 6FD19BB5D042499FCF14CFA8E8849ADBFB5FF59300F28452AE826EB351E730A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0053B478 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0053B47F
UnDecorator::getSymbolName.LIBCMT ref: 0053B511
DName::operator+.LIBCMT ref: 0053B615
DName::DName.LIBVCRUNTIME ref: 0053B6B8

Part of subcall function 00538DCE: shared_ptr.LIBCMT ref: 00538DEA

Part of subcall function 00539068: DName::DName.LIBVCRUNTIME ref: 005390C6

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: 66e17ebfab07d28ae10835d79a10e5d42f1d931d21603ebeeead2737e26d7956
Instruction ID: d0fb2a544ac827cbf60fd6df620b34ca505439ba9cfd4b32a2554ee41af55909
Opcode Fuzzy Hash: 66e17ebfab07d28ae10835d79a10e5d42f1d931d21603ebeeead2737e26d7956
Instruction Fuzzy Hash: 1E715DB1D002099FEF14CF94D885AEEBFB4BF18310F14051AEA11AB262EB34A944DF61

Uniqueness

Uniqueness Score: -1.00%

Function 005402D4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0054039B
___AdjustPointer.LIBCMT ref: 005403BE
___AdjustPointer.LIBCMT ref: 0054045A

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4ae955ca7738208aaa9404a6ae90f38ed1224a3ff551bdbf6060941205eba3eb
Instruction ID: 166b62efa5fe04c32c08fa56ca46c84e4d640a6c47faad752b09e93965327b1a
Opcode Fuzzy Hash: 4ae955ca7738208aaa9404a6ae90f38ed1224a3ff551bdbf6060941205eba3eb
Instruction Fuzzy Hash: C651CC72605606EFDB298F14D885BFABFA4FF44318F245929EA02972D1E731EC81D790

Uniqueness

Uniqueness Score: -1.00%

Function 0053B848 Relevance: 6.1, APIs: 4, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053B87B

Part of subcall function 00538D92: DName::operator+=.LIBCMT ref: 00538DA8

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID:
API String ID: 382699925-0
Opcode ID: 65bbbb0c8ba6103378bdb97ba5aa8f6a8d48286ef33b32f0e75c090f7edb1b31
Instruction ID: b84ae27eb96f176ffda3eaf9c1d2cbae7b243016206a0620a1cff1cc0a522ac7
Opcode Fuzzy Hash: 65bbbb0c8ba6103378bdb97ba5aa8f6a8d48286ef33b32f0e75c090f7edb1b31
Instruction Fuzzy Hash: AC411072D0420A9BEF04DFA8D489AFEBFF8FF44314F100519E611A7250DB749A88DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0053455F Relevance: 6.1, APIs: 4, Instructions: 97stringCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00534574
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 0053457F
lstrlenW.KERNEL32 ref: 005345C1
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0053461A

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: CommandLine$ArgvCurrentDirectorylstrlen
String ID:
API String ID: 159791187-0
Opcode ID: f52b45509632394802dfbe16a87e4767bb58cff8912e99379481fc2201ccb047
Instruction ID: 35b96e8cc45bd77325557923c26f95c018cd7778bda8e0cd14c05cdbfc55d94a
Opcode Fuzzy Hash: f52b45509632394802dfbe16a87e4767bb58cff8912e99379481fc2201ccb047
Instruction Fuzzy Hash: 2231F475D00115ABCF289FA8D889ABDBFB4FF96314F10859AE412E3190DB74AE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00567855 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0056989F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000001,?,00000000,?,?,?,00565C35,?,00000000,?), ref: 00569900

GetLastError.KERNEL32 ref: 005678B9
__dosmaperr.LIBCMT ref: 005678C0
GetLastError.KERNEL32(?,?,?,?), ref: 005678FA
__dosmaperr.LIBCMT ref: 00567901

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 24b59e2c4fe180b120032fbcf947ca8df311fa35ccf838a251e2306a2cbecb65
Instruction ID: 820bdb79a3bb5bbcac1c5a87b96aa13ac5d9a6dc6d85ca60165c43eb68e7dcc7
Opcode Fuzzy Hash: 24b59e2c4fe180b120032fbcf947ca8df311fa35ccf838a251e2306a2cbecb65
Instruction Fuzzy Hash: 9F21AA7160460AAFDB20AF65C88897B7FA9FF98368B104929F85597150EB30ED50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0056889A Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759ad87117eef1a12794da5a3b4e4103af8e8771f590a1ac2783f7b715032acd
Instruction ID: cc6c9a9ee9518c80c83fdaa5185a8261aa3865ac49ea98550d80a22fae789739
Opcode Fuzzy Hash: 759ad87117eef1a12794da5a3b4e4103af8e8771f590a1ac2783f7b715032acd
Instruction Fuzzy Hash: 9621C031600607AFDB20AF60DC4897B7FA8FF91364B108A25FA15D7150EF30EC1497A2

Uniqueness

Uniqueness Score: -1.00%

Function 005699A6 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 005699AE

Part of subcall function 0056989F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000001,?,00000000,?,?,?,00565C35,?,00000000,?), ref: 00569900

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005699E6
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00569A06

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c951ef553e231b73c069d293a84a8af7fba8904027deabc8a740d1e3bbd15113
Instruction ID: fa5bcc9bd4bf316da21f687e5da0fa524de0f954b12631e6f18b1aac76df97eb
Opcode Fuzzy Hash: c951ef553e231b73c069d293a84a8af7fba8904027deabc8a740d1e3bbd15113
Instruction Fuzzy Hash: 7911ADF25015167F6A2167B56C8DCBF6D9CEEE67E4B150529F801D3100FE70CD01A5B0

Uniqueness

Uniqueness Score: -1.00%

Function 00576D73 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00576D89
GetLastError.KERNEL32(?,?,?,?), ref: 00576D96
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00576DBC
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 00576DE2

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 336454a4526cd5fd26647f9a6c246b0a30231940c9a7f220ab7b443880be156c
Instruction ID: e7148da3d5d838a58b65329be7056f3a753be757a2acaea052610b8975add3ef
Opcode Fuzzy Hash: 336454a4526cd5fd26647f9a6c246b0a30231940c9a7f220ab7b443880be156c
Instruction Fuzzy Hash: B4115A75A1051ABBDF209F95DD089EF3F79FF01360F108155F928A61A0DB71DA44EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0054E210 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(2T,2T,?,0054D546,0053121C,?,0056244A,?,?,?,?,?,00000000,005432E0,?,?), ref: 0054E21E
SetLastError.KERNEL32(J$V,?,0056244A,?,?,?,?,?,00000000,005432E0,?,?,0053121C,00000000,?,00000000), ref: 0054E254

Strings

2T, xrefs: 0054E215, 0054E216
J$V, xrefs: 0054E241, 0054E251, 0054E244, 0054E26E

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ErrorLast
String ID: J$V$2T
API String ID: 1452528299-2949957675
Opcode ID: 2c1c3025a5511e0ad9072534878635b28a2204ead0ee46179789796a904e0ef9
Instruction ID: 864cd247e6a3e1bb330d69ab02232e9400d228f230a6921d3d39a69eda066d85
Opcode Fuzzy Hash: 2c1c3025a5511e0ad9072534878635b28a2204ead0ee46179789796a904e0ef9
Instruction Fuzzy Hash: AA01A272804205AFC7109BA5D80AB9AFFADFF51714F248556E40883200EBB1ED61DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 005797B7 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 005797D1
GetLastError.KERNEL32 ref: 005797DD

Part of subcall function 00579886: CloseHandle.KERNEL32(FFFFFFFE,005798D0,?,005770A9,00000000,00000001,?,00000000,?,0056F5B9,00000000,00000000,00000000,00000000,00000000), ref: 00579896

___initconout.LIBCMT ref: 005797ED

Part of subcall function 00579848: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00579877,00577096,00000000,?,0056F5B9,00000000,00000000,00000000,00000000), ref: 0057985B

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00579801

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 489eb04d904e83e26f6d2245869894802027ea86a01fcf53f79f19121fe585bf
Instruction ID: cd72434d7528ac768845c01b8b65c8e5e0fc4e4a79bed77fc226b07115b38a13
Opcode Fuzzy Hash: 489eb04d904e83e26f6d2245869894802027ea86a01fcf53f79f19121fe585bf
Instruction Fuzzy Hash: 6BF05E36100901ABCB222B96EC08D867FB6FFDA3217158416F64E82530DA329814BB21

Uniqueness

Uniqueness Score: -1.00%

Function 0057989D Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,005770A9,00000000,00000001,?,00000000,?,0056F5B9,00000000,00000000,00000000), ref: 005798B4
GetLastError.KERNEL32(?,005770A9,00000000,00000001,?,00000000,?,0056F5B9,00000000,00000000,00000000,00000000,00000000,?,0056FBA4,?), ref: 005798C0

Part of subcall function 00579886: CloseHandle.KERNEL32(FFFFFFFE,005798D0,?,005770A9,00000000,00000001,?,00000000,?,0056F5B9,00000000,00000000,00000000,00000000,00000000), ref: 00579896

___initconout.LIBCMT ref: 005798D0

Part of subcall function 00579848: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00579877,00577096,00000000,?,0056F5B9,00000000,00000000,00000000,00000000), ref: 0057985B

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,005770A9,00000000,00000001,?,00000000,?,0056F5B9,00000000,00000000,00000000,00000000), ref: 005798E5

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f49b1eda5f98f4381808851561165eea70c8d260d52e9844c45ecc7223f67a37
Instruction ID: 76f09eebe306da78272689a8f4ec64fcc1db3bc5f938c955e38b2141ae74d69e
Opcode Fuzzy Hash: f49b1eda5f98f4381808851561165eea70c8d260d52e9844c45ecc7223f67a37
Instruction Fuzzy Hash: E6F0AC36500555BBCF622F95EC08ADA3F66FB5A3A1B058015FB1D95131CA328828BBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0055CDE4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0055CF5B

Strings

-, xrefs: 0055CEAC
+, xrefs: 0055CEB9

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: e5f5c5de76f9dc621eeb51716576f680264a870e5b6e6edadf704e0ed8052834
Instruction ID: 0e3e0dfaab04af21ba67b739b03271378257c067926c20f8cec5466451730304
Opcode Fuzzy Hash: e5f5c5de76f9dc621eeb51716576f680264a870e5b6e6edadf704e0ed8052834
Instruction Fuzzy Hash: 74A1F331901249AFCF24CE78C8656FE7FB6FF45322F14855BEC61EB291D234990A8B60

Uniqueness

Uniqueness Score: -1.00%

Function 0053DB18 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0053DB73
DName::DName.LIBVCRUNTIME ref: 0053DCBE

Strings

\$[, xrefs: 0053DC31

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: \$[
API String ID: 3707554701-2545313564
Opcode ID: 0da4664a3da70e345595d5bdc1b2b0f13fac795d4478e9f98e9d90d4eb87ac7e
Instruction ID: 2664131ff15673ee7e2190b387c01188f00174b909a823b079f973f40d31dbc6
Opcode Fuzzy Hash: 0da4664a3da70e345595d5bdc1b2b0f13fac795d4478e9f98e9d90d4eb87ac7e
Instruction Fuzzy Hash: 4251C0719042499FCB29CFA8E4986AEFFF8BB55300F04815EE451A77A1DB71AD08CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0055E310 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\qd_x86.exe, xrefs: 0055E34E, 0055E355, 0055E372, 0055E387, 0055E3BF
+[, xrefs: 0055E35D

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\qd_x86.exe$+[
API String ID: 0-372409529
Opcode ID: 562791cd6a4b7340b478791aace3eca4e6dde2f45ee54ed9451557986fbd8edd
Instruction ID: 69e22bcfe1688772e1554d47f616a13f1d112ea65e6a3845703a74141fa31b3c
Opcode Fuzzy Hash: 562791cd6a4b7340b478791aace3eca4e6dde2f45ee54ed9451557986fbd8edd
Instruction Fuzzy Hash: 7231F571A00214EBCB259F99DC869AFBFACFB44351F15446BF80497201E670AF09DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005408D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 005408F5

Strings

RCC, xrefs: 0054090F
MOC, xrefs: 00540907

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1da7c0675ddb1ad92c9973d22a4a913c8e585f7c3d7bb35ae029260ee92b8549
Instruction ID: e93d940c0030c2d1628c48c6db1502f35f412cc346e886a48e68d64f87b39a42
Opcode Fuzzy Hash: 1da7c0675ddb1ad92c9973d22a4a913c8e585f7c3d7bb35ae029260ee92b8549
Instruction Fuzzy Hash: 6F418B32900209EFDF15DF94CC81AEEBFB5BF48308F248159FA05A7292D3359951DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0053BD34 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0053BD4B
DName::DName.LIBVCRUNTIME ref: 0053BDD0

Strings

A, xrefs: 0053BDB0

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: ae5a41b8db182d8f4367b426af9eff774221dbd36b6e924b98e6a6f32dc55709
Instruction ID: df2a2fb5a0c3737e407781d6bf0fe259cd72693a1263390ccc1445ebb5927806
Opcode Fuzzy Hash: ae5a41b8db182d8f4367b426af9eff774221dbd36b6e924b98e6a6f32dc55709
Instruction Fuzzy Hash: F721CD70900209EFEF18DF94D846BAC7FB1FF84304F14888AF6559B261CB31AA45DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00538ED2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+=.LIBCMT ref: 00538F04

Part of subcall function 00538BE3: pDNameNode::pDNameNode.LIBCMT ref: 00538C0B

Strings

\$[, xrefs: 00538F0D

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name$Name::operator+=NodeNode::p
String ID: \$[
API String ID: 2687079329-2545313564
Opcode ID: b3abcbd5f91fc559c913ee897e1f5e85892eb44632209a0a78ba3d98474bd653
Instruction ID: b641eb927f00c1fc79b605044464050ad9c078fc35f4bfff4895ae06022fb38a
Opcode Fuzzy Hash: b3abcbd5f91fc559c913ee897e1f5e85892eb44632209a0a78ba3d98474bd653
Instruction Fuzzy Hash: B1F0E0A530871526CA2C2AA8585567BFF9FBFD5B14F04402EF54197242DD91DC41D3B0

Uniqueness

Uniqueness Score: -1.00%

Function 0053BCCF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0053BD11
DName::operator+.LIBCMT ref: 0053BD1F

Strings

\$[, xrefs: 0053BCD5

Memory Dump Source

Source File: 00000000.00000002.1983699035.0000000000531000.00000020.00000001.01000000.00000003.sdmp, Offset: 00530000, based on PE: true

Associated: 00000000.00000002.1983678660.0000000000530000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983735957.0000000000598000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983753865.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983766816.00000000005AE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983782987.00000000005B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983795863.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_qd_x86.jbxd

Similarity

API ID: Name::operator+
String ID: \$[
API String ID: 2943138195-2545313564
Opcode ID: 87f6e5ba49994ea7efb02d04a6372725f611475d02e4700870021787f40caf9a
Instruction ID: f4ca7187cd3082250c296eef435a698e6469a0d61e8a6cbb3f7307fc3a3de517
Opcode Fuzzy Hash: 87f6e5ba49994ea7efb02d04a6372725f611475d02e4700870021787f40caf9a
Instruction Fuzzy Hash: E9F0497190071AABDB14AF94C819BDE7FA8FF54750F004458FA4557281DB70A945C7D0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qd_x86.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: qd_x86.exePID: 2716, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 6304, Parent PID: 2716

General

Chronological Activities

Disassembly

Analysis Process: qd_x86.exePID: 2716, Parent PID: 1028COMMON

Execution Graph

Windows Analysis Report
qd_x86.exe

Function 00534767 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 295
COMMON

Function 00533E91 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95
libraryloaderCOMMON

Function 00562CD8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
COMMONLIBRARYCODE

Function 00536285 Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Function 0053288C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109
COMMON

Function 005357C7 Relevance: 4.6, APIs: 3, Instructions: 50
COMMON

Function 00541D7B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 005327AE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82
COMMON

Function 00564227 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 0056FAC2 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00532AE0 Relevance: 3.1, APIs: 2, Instructions: 83
COMMON

Function 0056F673 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 005640EB Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00533FC8 Relevance: 3.0, APIs: 2, Instructions: 49
libraryCOMMON

Function 00535659 Relevance: 2.6, APIs: 2, Instructions: 94
COMMON