Edit tour

Windows Analysis Report
Kofc4rRZdp.exe

Overview

General Information

Sample name:	Kofc4rRZdp.exe renamed because original name is a hash value
Original sample name:	243149fc79e420c9dfe7f0affa166238.exe
Analysis ID:	1429029
MD5:	243149fc79e420c9dfe7f0affa166238
SHA1:	8289040f7e4043f6b6320684a63f2019714aaab6
SHA256:	fee7bb0a897a66e0ff928aa8abc71ab11a59d960d88e10c1a05f60495c08522a
Tags:	32exetrojan
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Kofc4rRZdp.exe (PID: 2520 cmdline: "C:\Users\user\Desktop\Kofc4rRZdp.exe" MD5: 243149FC79E420C9DFE7F0AFFA166238)

regsvr32.exe (PID: 3220 cmdline: "C:\Windows\System32\regsvr32.exe" /u /s .\42ZQUg._ MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\42ZqUg._

Avira: detection malicious, Label: HEUR/AGEN.1300756

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\42ZqUg._

Virustotal: Detection: 25%

Perma Link

Multi AV Scanner detection for submitted file

Source: Kofc4rRZdp.exe

Virustotal: Detection: 38%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\42ZqUg._

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Kofc4rRZdp.exe

Joe Sandbox ML: detected

Source: Kofc4rRZdp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Kofc4rRZdp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: Kofc4rRZdp.exe

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00714D8A __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00714D8A
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00728590 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_00728590
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_007386E8 FindFirstFileExA,	0_2_007386E8

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A769C0 NtCreateThreadEx,

1_2_04A769C0

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0071720F	0_2_0071720F
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0071E3FB	0_2_0071E3FB
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0071FBD3	0_2_0071FBD3
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0071837D	0_2_0071837D
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0072E430	0_2_0072E430
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00732578	0_2_00732578
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00712606	0_2_00712606
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_007327A7	0_2_007327A7
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00720870	0_2_00720870
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00718934	0_2_00718934
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0073AA50	0_2_0073AA50
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00718D89	0_2_00718D89
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0073EE32	0_2_0073EE32
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0073AEFE	0_2_0073AEFE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04951000	1_2_04951000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_049549D0	1_2_049549D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04952FB0	1_2_04952FB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_049551F0	1_2_049551F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04952AC4	1_2_04952AC4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04953B80	1_2_04953B80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A76CC0	1_2_04A76CC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A769C0	1_2_04A769C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A78910	1_2_04A78910
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A76140	1_2_04A76140
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A79040	1_2_04A79040
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A78DB0	1_2_04A78DB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A79490	1_2_04A79490
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A75AE0	1_2_04A75AE0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A766E0	1_2_04A766E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A78BC0	1_2_04A78BC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A76430	1_2_04A76430

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: String function: 0072C468 appears 55 times

Source: Kofc4rRZdp.exe, 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelgpllibs.dll8 vs Kofc4rRZdp.exe
Source: Kofc4rRZdp.exe, 00000000.00000002.2077529522.0000000002D84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREGSVR32.EXE.MUIj% vs Kofc4rRZdp.exe
Source: Kofc4rRZdp.exe, 00000000.00000003.2076923027.0000000002D84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREGSVR32.EXE.MUIj% vs Kofc4rRZdp.exe
Source: Kofc4rRZdp.exe, 00000000.00000003.2076820826.0000000002D84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREGSVR32.EXE.MUIj% vs Kofc4rRZdp.exe
Source: Kofc4rRZdp.exe, 00000000.00000003.2077046352.0000000002D84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameREGSVR32.EXE.MUIj% vs Kofc4rRZdp.exe

Source: Kofc4rRZdp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.winEXE@3/1@0/0

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_00712E6F GetLastError,FormatMessageW,_wcslen,LocalFree,

0_2_00712E6F

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_00725C5C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00725C5C

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_3806687

Jump to behavior

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Command line argument: ht	0_2_0072B2FE
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Command line argument: sfxname	0_2_0072B2FE
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Command line argument: sfxstime	0_2_0072B2FE
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Command line argument: STARTDLG	0_2_0072B2FE

Source: Kofc4rRZdp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Kofc4rRZdp.exe

Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

File read: C:\Users\user\Desktop\Kofc4rRZdp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Kofc4rRZdp.exe "C:\Users\user\Desktop\Kofc4rRZdp.exe"
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /u /s .\42ZQUg._
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /u /s .\42ZQUg._	Jump to behavior

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Kofc4rRZdp.exe

Static file information: File size 3049000 > 1048576

Source: Kofc4rRZdp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Kofc4rRZdp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Kofc4rRZdp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Kofc4rRZdp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Kofc4rRZdp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Kofc4rRZdp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Kofc4rRZdp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Kofc4rRZdp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: Kofc4rRZdp.exe

Source: Kofc4rRZdp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Kofc4rRZdp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Kofc4rRZdp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Kofc4rRZdp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Kofc4rRZdp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_3806687

Jump to behavior

Source: Kofc4rRZdp.exe	Static PE information: section name: .didat
Source: 42ZqUg._.0.dr	Static PE information: section name: .qdata
Source: 42ZqUg._.0.dr	Static PE information: section name: 510OCR

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0072C403 push ecx; ret		0_2_0072C416
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0072D4B0 push ecx; ret		0_2_0072D4C3

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

File created: C:\Users\user\AppData\Local\Temp\42ZqUg._

Jump to dropped file

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

File created: C:\Users\user\AppData\Local\Temp\42ZqUg._

Jump to dropped file

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\42ZqUg._

Jump to dropped file

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00714D8A __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00714D8A
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_00728590 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	0_2_00728590
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_007386E8 FindFirstFileExA,	0_2_007386E8

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_0072BC1D VirtualQuery,GetSystemInfo,

0_2_0072BC1D

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

API call chain: ExitProcess graph end node

graph_0-24427

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_0072D242 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0072D242

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_007353C2 mov eax, dword ptr fs:[00000030h]

0_2_007353C2

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_007393D0 GetProcessHeap,

0_2_007393D0

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0072D242 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0072D242
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_007312B4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007312B4
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0072D3E5 SetUnhandledExceptionFilter,	0_2_0072D3E5
Source: C:\Users\user\Desktop\Kofc4rRZdp.exe	Code function: 0_2_0072C69D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0072C69D

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" /u /s .\42ZQUg._

Jump to behavior

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_0072D05E cpuid

0_2_0072D05E

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00726CF5

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_0072B2FE GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0072B2FE

Source: C:\Users\user\Desktop\Kofc4rRZdp.exe

Code function: 0_2_00715032 GetVersionExW,

0_2_00715032

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Kofc4rRZdp.exe	39%	Virustotal		Browse
Kofc4rRZdp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\42ZqUg._	100%	Avira	HEUR/AGEN.1300756
C:\Users\user\AppData\Local\Temp\42ZqUg._	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\42ZqUg._	25%	Virustotal		Browse

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429029
Start date and time:	2024-04-20 05:47:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Kofc4rRZdp.exe renamed because original name is a hash value
Original Sample Name:	243149fc79e420c9dfe7f0affa166238.exe
Detection:	MAL
Classification:	mal72.winEXE@3/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 106 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Process:	C:\Users\user\Desktop\Kofc4rRZdp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2899968
Entropy (8bit):	7.9563253833154
Encrypted:	false
SSDEEP:	49152:PUlXiX5/dTY14YysazQG0gK5LHmjQeOXlVjZmk7PLOfy:qip/dTRYoMdgKcaVtmk7zOfy
MD5:	035DC2E7367EEBA224351B508CE94506
SHA1:	EA6E03D6FAF286CB3DC5ED4A9110305B2D974AF5
SHA-256:	4AA2D8EFA84E67993A694C22763F750BE466D32F26498F0A3351316F2766BE8F
SHA-512:	951CFA7CF1EE8AC85BFDE173DAB0A5BECE860D61F91F480D61A5640370FC7F86481652E733BE28F46DB1E4C064A62BF03B5AE21272494776EB6DBDE5BA6F35EA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 25%, Browse
Reputation:	low
Preview:	MZ......................@...................................$...g.hV#g..#g..#g..L....g...<...g.. ...wf......ef..M:..wf..E....f..#g...f....\|..f....z..f..#g..Pg..L...kg...>..jg...<...g..8...=f.......g..E...Mg....\|..g..#g..6g...<...f..^....f..Rich#g..............................................PE..L....h#f...........!.....@...L...F..N........................................@,....._.,..............................X......LV..P.....+.......................+.D...@d...............................................P..X............................text....*.......0.................. ..`.idata.......@.......@.............. ..`.rdata.......P.......P.................@.data........`.......`..............@....qdata..gd&......p&.................@...510OCR..2.....).......).............@....CRT.........p+......p+.............@..@.rsrc.........+.......+..............?.@.reloc.......+.......+.............@..B....................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9596931280584595
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Kofc4rRZdp.exe
File size:	3'049'000 bytes
MD5:	243149fc79e420c9dfe7f0affa166238
SHA1:	8289040f7e4043f6b6320684a63f2019714aaab6
SHA256:	fee7bb0a897a66e0ff928aa8abc71ab11a59d960d88e10c1a05f60495c08522a
SHA512:	1722b5e597d14c6720d6b22b0e802fbfa84cf933e1676ecbb1b9c7087eab8f5d9810c80a139a057473022bc655a5c70870d00913fc3ab1791d7db739fc0994db
SSDEEP:	49152:XcL4/Td35hyvDldRgzCyymaTQ+EU6p/1mjAeOX5LL9ac1PvmaFq:XcL4tPyLldR1yOsnU6KaLhac1Hmag
TLSH:	9BE5235133D4C5B0C2A315368565AB512A3CFC711F2A8AEF67F02D6DEB359C0EA31B92
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y...y...y....~..y....\|.!y....}..y..+.r..y..+....y..+....y..+....y.......y.......y...y...x..%....y..%....y..%.p..y..%....y.

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41d000
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65DC537F [Mon Feb 26 09:01:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	10b73c5f7fc148e21f974da703236659

Entrypoint Preview

Instruction
call 00007FED40D6F341h
jmp 00007FED40D6ECADh
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FED40D6E40Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FED40D6E3F9h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FED40D6DE31h
push 0043BF68h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FED40D6FB67h
int3
jmp 00007FED40D7546Ch
push ebp
mov ebp, esp
and dword ptr [0045B89Ch], 00000000h
sub esp, 24h
or dword ptr [0043E770h], 01h
push 0000000Ah
call dword ptr [0043218Ch]
test eax, eax
je 00007FED40D6EFE2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp+00h], eax

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3cef0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cf24	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0xe360	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6c000	0x2f38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a020	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3a080	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x346f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x24c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3c4fc	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3023c	0x30400	eab8c49347b2363b3fdd36257b1df951	False	0.5767132852979274	data	6.682129404058095	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0xbc34	0xbe00	e5f2fdc4aee2f1a0726781d86b4f8c02	False	0.4407483552631579	data	5.126576177856284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x1df78	0x1200	94ebd057e10782ee3aa0d3ba58c1a1bf	False	0.3856336805555556	DOS executable (block device driver w{\362ko\3050)	3.9129841433728263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x5c000	0x17c	0x200	f6f8a7d940bc508fbb3b807359e5a063	False	0.42578125	data	3.261134286324671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0xe360	0xe400	7a6b7bfd44ad2f52769a07648c6facb0	False	0.6301569353070176	data	6.5965558628721315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6c000	0x2f38	0x3000	83735fea8ebd9a3faee82aa0e6812001	False	0.7744140625	data	6.687384285279319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x5d680	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x5e1c8	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x5f778	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x5fce0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x60588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x61430	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x61898	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x62940	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x64ee8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x695b8	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x69388	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x694c8	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x69258	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x68f20	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x68cc8	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x69f98	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x6a180	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x6a350	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x6a508	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x6a650	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x6aac0	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x6ac28	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x6ad80	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x6ae90	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x6af50	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0x6b110	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0x68c60	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x69840	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileTime, CloseHandle, CreateFileW, GetCurrentProcessId, CreateDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, MoveFileW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapReAlloc, HeapSize, SetStdHandle, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	VariantClear, SysFreeString, SysAllocString
gdiplus.dll	GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdiplusShutdown, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	05:47:54
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\Kofc4rRZdp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Kofc4rRZdp.exe"
Imagebase:	0x710000
File size:	3'049'000 bytes
MD5 hash:	243149FC79E420C9DFE7F0AFFA166238
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:47:54
Start date:	20/04/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\regsvr32.exe" /u /s .\42ZQUg._
Imagebase:	0xb50000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.1%
Total number of Nodes:	1774
Total number of Limit Nodes:	23

Executed Functions

Function 0072B2FE Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 252
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0071A590: GetModuleHandleW.KERNEL32(kernel32,D5FC40FB), ref: 0071A5DC
Part of subcall function 0071A590: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0071A5EE
Part of subcall function 0071A590: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0071A618

Part of subcall function 00715D94: __EH_prolog3.LIBCMT ref: 00715D9B
Part of subcall function 00715D94: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00716209,?,000000FF,\\?\,D5FC40FB,?,000000FF,?,?,0073FF80,000000FF), ref: 00715DA4

Part of subcall function 0072655D: OleInitialize.OLE32(00000000), ref: 00726576
Part of subcall function 0072655D: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 007265AD
Part of subcall function 0072655D: SHGetMalloc.SHELL32(0076AA78), ref: 007265B7

GetCommandLineW.KERNEL32 ref: 0072B3BC
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp,?,00000000), ref: 0072B403
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000009,?,00000000), ref: 0072B415
UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 0072B423
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,00000000), ref: 0072B431

Part of subcall function 00726BF9: __EH_prolog3.LIBCMT ref: 00726C00

Part of subcall function 0072AE2D: __EH_prolog3_GS.LIBCMT ref: 0072AE34
Part of subcall function 0072AE2D: SetEnvironmentVariableW.KERNEL32(sfxcmd,?,?,?,?,?,?,00000028), ref: 0072AE4C
Part of subcall function 0072AE2D: SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 0072AEB7

Part of subcall function 00718D34: _wcslen.LIBCMT ref: 00718D58

UnmapViewOfFile.KERNEL32(00000000,0076AB80,00000400,0076AB80,0076AB80,00000400,00000000,00000001,?,00000000), ref: 0072B480
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0072B487
SetEnvironmentVariableW.KERNEL32(sfxname,0074E668,00000000), ref: 0072B4E3
GetLocalTime.KERNEL32(?), ref: 0072B4EE
_swprintf.LIBCMT ref: 0072B52D
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0072B542
GetModuleHandleW.KERNEL32(00000000), ref: 0072B549
LoadIconW.USER32(00000000,00000064), ref: 0072B560
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00017860,00000000), ref: 0072B5B7
Sleep.KERNEL32(00000000), ref: 0072B5E8
DeleteObject.GDI32 ref: 0072B60C
DeleteObject.GDI32(00050E1A), ref: 0072B61C

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

Part of subcall function 0072894E: __EH_prolog3_GS.LIBCMT ref: 00728955

CloseHandle.KERNEL32 ref: 0072B65E

Strings

STARTDLG, xrefs: 0072B5AC
ht, xrefs: 0072B4B7
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0072B51E
sfxname, xrefs: 0072B4DE
winrarsfxmappingfile.tmp, xrefs: 0072B3F7
sfxstime, xrefs: 0072B53D

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$AddressCloseDeleteH_prolog3H_prolog3_ModuleObjectProcUnmap_wcslen$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingOpenParamSleepStartupTime_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$ht$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3142445277-2829514963
Opcode ID: 454a9b3b73469be2e35f8c2c5b4bf5a6f4f0e24909573dd87016fce1ab55e6aa
Instruction ID: 59e6c6d545e28b66a41e446a6f049d0ddda79121b081a02ee63320852a741b84
Opcode Fuzzy Hash: 454a9b3b73469be2e35f8c2c5b4bf5a6f4f0e24909573dd87016fce1ab55e6aa
Instruction Fuzzy Hash: BB91A2B1504354EFC321EF64EC49FAB77E8AB49700F40881EF54AA2292DB7C9945CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0071720F Relevance: 21.8, APIs: 2, Strings: 10, Instructions: 753COMMON

Download Yara Rule

APIs

Part of subcall function 0071B976: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0071B946,?,?,?,?,0000000C), ref: 0071B992

_wcslen.LIBCMT ref: 0071760C
__fprintf_l.LIBCMT ref: 00717759

Strings

*messages***, xrefs: 007173EC
@'t, xrefs: 007175EC
`'t, xrefs: 007175FA
l't, xrefs: 00717601
*messages***, xrefs: 00717425
,, xrefs: 00717794
P't, xrefs: 007175F3
@%s:, xrefs: 00717743, 0071774F
RTL, xrefs: 0071771B
$%s:, xrefs: 0071773C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_wcslen
String ID: ,$$%s:$*messages***$*messages***$@%s:$@'t$P't$RTL$`'t$l't
API String ID: 1796436225-1881979431
Opcode ID: dd14cd8cafb29c69ce98e4c92d4d88a23954e6e1c7f5b61d37081395a70a6abd
Instruction ID: e3abe5eb2c3d52ec3ea1b446d4a40699b43c5b3fa35f012ecb43cf152992b18a
Opcode Fuzzy Hash: dd14cd8cafb29c69ce98e4c92d4d88a23954e6e1c7f5b61d37081395a70a6abd
Instruction Fuzzy Hash: 8652A571904259EBDF28DFACC889AEE77B5FF04310F50452AF505AB2C1E7789A85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00725C5C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,007277A5,00000066), ref: 00725C6F
SizeofResource.KERNEL32(00000000,?,?,?,007277A5,00000066), ref: 00725C86
LoadResource.KERNEL32(00000000,?,?,?,007277A5,00000066), ref: 00725C9D
LockResource.KERNEL32(00000000,?,?,?,007277A5,00000066), ref: 00725CAC
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,007277A5,00000066), ref: 00725CC7
GlobalLock.KERNEL32(00000000,?,?,?,?,?,007277A5,00000066), ref: 00725CD8
GlobalUnlock.KERNEL32(00000000), ref: 00725D60

Part of subcall function 00725BD6: GdipAlloc.GDIPLUS(00000010), ref: 00725BDC

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00725D41
GlobalFree.KERNEL32(00000000), ref: 00725D67

Strings

PNG, xrefs: 00725C60

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: 177fc33ef74cd11638f5504258731ef3b36ef86343fc677466c437f4080fdca0
Instruction ID: 2e44f4759dbd8072bada09125c6185de9414203b339ea89d2c04696e28fea821
Opcode Fuzzy Hash: 177fc33ef74cd11638f5504258731ef3b36ef86343fc677466c437f4080fdca0
Instruction Fuzzy Hash: 7F319F75600B26BFC3109F21EC8C92BBBA9FF46751704851AF90692272EB79DC11CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 00714D8A Relevance: 9.1, APIs: 6, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00714D94
FindFirstFileW.KERNELBASE(?,-00000278,00000274,00714C97,000000FF,?,?,?,?,0071FA7D,0076B1E4,-00000070,00000000), ref: 00714DBD
FindFirstFileW.KERNELBASE(-00000028,-00000278,?,-00000028,?,?,?,?,?,?,?,?,?,?,0072114C,00000000), ref: 00714E08
GetLastError.KERNEL32(?,-00000028,?,?,?,?,?,?,?,?,?,?,0072114C,00000000), ref: 00714E66
FindNextFileW.KERNEL32(?,-00000278,00000274,00714C97,000000FF,?,?,?,?,0071FA7D,0076B1E4,-00000070,00000000), ref: 00714E91
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0072114C,00000000), ref: 00714E9E

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$H_prolog3_Next
String ID:
API String ID: 3831798110-0
Opcode ID: f7860fb5a02b47719c07ab1577475be75f68722ae58b7d362a3a3ef1c5498c3c
Instruction ID: eb5398be7e13ab1a4b68224e957422975302faab7a516ebf0e1635e016a6e229
Opcode Fuzzy Hash: f7860fb5a02b47719c07ab1577475be75f68722ae58b7d362a3a3ef1c5498c3c
Instruction Fuzzy Hash: F5516E75904219DFCF14DF68D889AEDB7B4BF08320F100299E419A32D1DB38AAD9CF54

Uniqueness

Uniqueness Score: -1.00%

Function 007353C2 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007363DC,?,00735398,007363DC,0074C1F0,0000000C,007354EF,007363DC,00000002,00000000,?,007363DC), ref: 007353E3
TerminateProcess.KERNEL32(00000000,?,00735398,007363DC,0074C1F0,0000000C,007354EF,007363DC,00000002,00000000,?,007363DC), ref: 007353EA
ExitProcess.KERNEL32 ref: 007353FC

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 213fff598b26a31626913f2e975b6e43eefab577c0b2a63b28ac72a68b792397
Instruction ID: 1e64ae53b2c01344f68117900a313a0fbdb94dc23aabb48406c7015de61bdafe
Opcode Fuzzy Hash: 213fff598b26a31626913f2e975b6e43eefab577c0b2a63b28ac72a68b792397
Instruction Fuzzy Hash: A6E04635000688EBDF016F68CD08A893B6AEB01385F908014F9068A133CB3DEC93CA84

Uniqueness

Uniqueness Score: -1.00%

Function 0071E3FB Relevance: 1.9, APIs: 1, Instructions: 352COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0071E4C0

Part of subcall function 0071F4EE: __EH_prolog3_GS.LIBCMT ref: 0071F4F5

Part of subcall function 00714235: __EH_prolog3_GS.LIBCMT ref: 0071423C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4214654750-0
Opcode ID: 04e3e20b1b31fe8b9f92e718ec95e0e4f21536d8f16895ffa934f81417344d94
Instruction ID: b3f3926ee1416778af21d78c539e499e83a91c6b2f2045f7503ed23936267ed0
Opcode Fuzzy Hash: 04e3e20b1b31fe8b9f92e718ec95e0e4f21536d8f16895ffa934f81417344d94
Instruction Fuzzy Hash: 9ED1A070504341AFD725AF2CEC496A93BA5FB55314F088229FC52A32E2D7BC98C1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0071FBD3 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

c, xrefs: 0071FEF4

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 491923b985624419b869fd99ba8d53ee05ad7a4b418d2b4e23a66a19db910dea
Instruction ID: fc2425437b3e14ea81780671f67030a1d619f4e0bfaaeab4c6b8cb19b92e8001
Opcode Fuzzy Hash: 491923b985624419b869fd99ba8d53ee05ad7a4b418d2b4e23a66a19db910dea
Instruction Fuzzy Hash: 6EE14971A083558FC724DF2CD580AAAF7E1BBC8308F10493EE99997391D734E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0071A590 Relevance: 91.4, APIs: 16, Strings: 36, Instructions: 394
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,D5FC40FB), ref: 0071A5DC
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0071A5EE
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0071A618
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0071A8DF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0071A8F4
ReadFile.KERNEL32(00000000,?,00007FFE,?,00000000), ref: 0071A914
CloseHandle.KERNEL32(00000000), ref: 0071A99C
CompareStringW.KERNEL32(00000400,00001001,?,000000FF,DXGIDebug.dll,000000FF,?,?,?), ref: 0071AA0D
AllocConsole.KERNEL32 ref: 0071AB73
GetCurrentProcessId.KERNEL32 ref: 0071AB7D
AttachConsole.KERNEL32(00000000), ref: 0071AB84
GetStdHandle.KERNEL32(000000F4,00000000,00000000,?,00000000), ref: 0071ABA4
WriteConsoleW.KERNEL32(00000000), ref: 0071ABAB
Sleep.KERNEL32(00002710), ref: 0071ABB6
FreeConsole.KERNEL32 ref: 0071ABBC
ExitProcess.KERNEL32 ref: 0071ABCC

Strings

+t, xrefs: 0071A72F
4*t, xrefs: 0071A6CB
<-t, xrefs: 0071A80B
(t, xrefs: 0071A642
<.t, xrefs: 0071A86F
l-t, xrefs: 0071A81F
8+t, xrefs: 0071A739
L)t, xrefs: 0071A66D
T.t, xrefs: 0071A879
kernel32, xrefs: 0071A5D3
DXGIDebug.dll, xrefs: 0071A64C, 0071A9F5
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 0071AB63
(-t, xrefs: 0071A801
SetDllDirectoryW, xrefs: 0071A5E8
T-t, xrefs: 0071A815
4)t, xrefs: 0071A663
P+t, xrefs: 0071A743
`*t, xrefs: 0071A6DF
dwmapi.dll, xrefs: 0071AAC8
|)t, xrefs: 0071A681
SetDefaultDllDirectories, xrefs: 0071A612
d)t, xrefs: 0071A677
t.t, xrefs: 0071A883
l+t, xrefs: 0071A74D
x*t, xrefs: 0071A6E9
,t, xrefs: 0071A7E3
.t, xrefs: 0071A865
uxtheme.dll, xrefs: 0071AAD2
H*t, xrefs: 0071A6D5
T,t, xrefs: 0071A7A7
$,t, xrefs: 0071A793
d,t, xrefs: 0071A7B1
-t, xrefs: 0071A851
<,t, xrefs: 0071A79D
+t, xrefs: 0071A77F
)t, xrefs: 0071A6AD

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentExitFreeModulePointerReadSleepStringWrite
String ID: +t$ .t$$,t$(-t$4)t$4*t$8+t$<,t$<-t$<.t$DXGIDebug.dll$H*t$L)t$P+t$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T,t$T-t$T.t$`*t$d)t$d,t$dwmapi.dll$kernel32$l+t$l-t$t.t$uxtheme.dll$x*t$|)t$(t$)t$+t$,t$-t
API String ID: 2644799563-619109046
Opcode ID: c06f63dba1da5ae712495ff4a95421abe56b4d54e23ed6a5d8099f22874b03f8
Instruction ID: c4b6f96ce3dfd8c76a3163a977759a44fbe615ecdfe96aa8b3e2b4163ff74b74
Opcode Fuzzy Hash: c06f63dba1da5ae712495ff4a95421abe56b4d54e23ed6a5d8099f22874b03f8
Instruction Fuzzy Hash: B1F194B140128CEBCB35DF68CC49BDD3BA8BF05314F904129F9095B292DB78569ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00727860 Relevance: 90.2, APIs: 43, Strings: 8, Instructions: 935windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0072786A

Part of subcall function 00711B78: GetDlgItem.USER32(00000000,00003021), ref: 00711BBC
Part of subcall function 00711B78: SetWindowTextW.USER32(00000000,00742668), ref: 00711BD2

EndDialog.USER32(?,00000000), ref: 00727978
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 007279B7
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007279D1
IsDialogMessageW.USER32(?,?), ref: 007279E4
TranslateMessage.USER32(?), ref: 007279F2
DispatchMessageW.USER32(?), ref: 007279FC
EndDialog.USER32(?,00000001), ref: 00727A3E
GetDlgItem.USER32(?,00000068), ref: 00727A64
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00727A7F
SendMessageW.USER32(00000000,000000C2,00000000,00742668), ref: 00727A92
SetFocus.USER32(00000000), ref: 00727A99
GetLastError.KERNEL32(00000000,?), ref: 00727B80
GetLastError.KERNEL32(00000000,?), ref: 00727BAC
GetTickCount.KERNEL32 ref: 00727BD9
GetLastError.KERNEL32 ref: 00727C35
GetCommandLineW.KERNEL32 ref: 00727D59
_wcslen.LIBCMT ref: 00727D66
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,?,winrarsfxmappingfile.tmp,?,0076AB80,00000400,00000001,00000001), ref: 00727DE5
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00727E03
ShellExecuteExW.SHELL32(0000003C), ref: 00727E3C
WaitForInputIdle.USER32(?,00002710), ref: 00727E6B
Sleep.KERNEL32(00000064), ref: 00727E85
UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,0076AB80,00000400), ref: 00727EC1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0076AB80,00000400), ref: 00727ECD
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00727FD2

Part of subcall function 00711B53: GetDlgItem.USER32(?,?), ref: 00711B68
Part of subcall function 00711B53: ShowWindow.USER32(00000000), ref: 00711B6F

SetDlgItemTextW.USER32(?,00000065,00742668), ref: 00727FEA
GetDlgItem.USER32(?,00000065), ref: 00727FF3
GetWindowLongW.USER32(00000000,000000F0), ref: 00728002
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_00017630,00000000,?), ref: 00728382
EndDialog.USER32(?,00000001), ref: 00728396
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00728011

Part of subcall function 00725335: __EH_prolog3_GS.LIBCMT ref: 0072533C
Part of subcall function 00725335: ShowWindow.USER32(?,00000000,00000038), ref: 00725364
Part of subcall function 00725335: GetWindowRect.USER32(?,?), ref: 007253A8
Part of subcall function 00725335: ShowWindow.USER32(?,00000005,?,00000000), ref: 00725443

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 007280AF
SendMessageW.USER32(?,00000080,00000001,0001044F), ref: 007281E4
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,00050E1A), ref: 007281FD
GetDlgItem.USER32(?,00000068), ref: 00728206
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0072821E
GetDlgItem.USER32(?,00000066), ref: 00728246
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 007282BD
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 007282D1
EnableWindow.USER32(?,00000000), ref: 00728507
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00728548
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0072856D

Part of subcall function 00728CAF: __EH_prolog3_GS.LIBCMT ref: 00728CB9

Strings

LICENSEDLG, xrefs: 00728377
STARTDLG, xrefs: 0072787C
-el -s2 "-d%s" "-sp%s", xrefs: 00727CD5
__tmp_rar_sfx_access_check_, xrefs: 00727BF1
@, xrefs: 00727CF8
,@t, xrefs: 00727D08
winrarsfxmappingfile.tmp, xrefs: 00727DD1
<, xrefs: 00727CEE

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Item$Message$TextWindow$Send$Dialog$ErrorFileLastShow$H_prolog3_LongView$CloseCommandCountCreateDispatchEnableExecuteFocusH_prolog3_catch_HandleIdleInputLineMappingParamRectShellSleepTickTranslateUnmapWait_wcslen
String ID: ,@t$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_$winrarsfxmappingfile.tmp
API String ID: 3616063595-1030301971
Opcode ID: b744e821772973a3fa2bd52056a559ad51a193794f7ade1f94273346de9ec988
Instruction ID: e39720e9860f96f8bfa7e89f2055330b47c074edafd9074a7ef2946d78bfb2cc
Opcode Fuzzy Hash: b744e821772973a3fa2bd52056a559ad51a193794f7ade1f94273346de9ec988
Instruction Fuzzy Hash: F172D670905358EEEB25EB64EC49FEE7B78AB11300F008059F106B61D2DBBC5A85CF26

Uniqueness

Uniqueness Score: -1.00%

Function 0072A4D2 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007275D8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 007275E9
Part of subcall function 007275D8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007275FA
Part of subcall function 007275D8: IsDialogMessageW.USER32(0001044A,?), ref: 0072760E
Part of subcall function 007275D8: TranslateMessage.USER32(?), ref: 0072761C
Part of subcall function 007275D8: DispatchMessageW.USER32(?), ref: 00727626

GetDlgItem.USER32(00000068,00000000), ref: 0072A4F5
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,00726CE1,00000001,?,?), ref: 0072A51A
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0072A529
SendMessageW.USER32(00000000,000000C2,00000000,00742668), ref: 0072A537
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0072A551
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0072A56B
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0072A5AF
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0072A5C2
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0072A5D5
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0072A5FC
SendMessageW.USER32(00000000,000000C2,00000000,00742690), ref: 0072A60B

Strings

\, xrefs: 0072A55B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: db2432d4abf6f82785f5d6ed92f4f796032c71524389bfcc29770f3b84ac16ca
Instruction ID: d748e70e377cca7803d330d828275a5413fd9ad4553b2826f43fcce1110d1424
Opcode Fuzzy Hash: db2432d4abf6f82785f5d6ed92f4f796032c71524389bfcc29770f3b84ac16ca
Instruction Fuzzy Hash: 0D31F8F1145304BFE311EF24DC59F6BBBA8EF47314F408509F69296291D7B899048BAB

Uniqueness

Uniqueness Score: -1.00%

Function 0072A800 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 291
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0072A807
ShellExecuteExW.SHELL32(?), ref: 0072AA04
IsWindowVisible.USER32(?), ref: 0072AA2F
ShowWindow.USER32(?,00000000), ref: 0072AA3D
WaitForInputIdle.USER32(?,000007D0), ref: 0072AA4D
GetExitCodeProcess.KERNELBASE(?,?), ref: 0072AA6F
FindCloseChangeNotification.KERNELBASE(?), ref: 0072AA93
ShowWindow.USER32(?,00000001), ref: 0072AAD6

Strings

.exe, xrefs: 0072AA9D
.inf, xrefs: 0072A973

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Window$Show$ChangeCloseCodeExecuteExitFindH_prolog3_IdleInputNotificationProcessShellVisibleWait
String ID: .exe$.inf
API String ID: 2125671723-3750412487
Opcode ID: 40caae55a658d39428fd5000b768c9b16964260ceb8cf6bd62ac78a169b174d6
Instruction ID: bf2faf4013678fdf0b04767e47425feb41f13daf679809047393b9672ba7a199
Opcode Fuzzy Hash: 40caae55a658d39428fd5000b768c9b16964260ceb8cf6bd62ac78a169b174d6
Instruction Fuzzy Hash: 7CB1C071E00269EFDF16DF64EA48BED77B5AF44300F148019E845A7251E77CAD86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0071CEA4 Relevance: 15.5, APIs: 3, Strings: 5, Instructions: 1525COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0071D739

Part of subcall function 0071CB19: _swprintf.LIBCMT ref: 0071CB52

__allrem.LIBCMT ref: 0071D7B1
_wcslen.LIBCMT ref: 0071DB92

Part of subcall function 0071C24D: __EH_prolog3_catch.LIBCMT ref: 0071C254

Part of subcall function 0071EE8E: __EH_prolog3_GS.LIBCMT ref: 0071EE98

Strings

zx01, xrefs: 0071D5B7
z01, xrefs: 0071D5BE, 0071D5C8
AES-0017, xrefs: 0071D36C
zipx, xrefs: 0071D6B7
zip, xrefs: 0071D6BE, 0071D6C8

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: __allrem$H_prolog3_H_prolog3_catch_swprintf_wcslen
String ID: AES-0017$z01$zip$zipx$zx01
API String ID: 538351651-1958518654
Opcode ID: 0de8c653d1d955d5a55d661dba51a7eece24c7851ac6cce7ff006ebf22ce282b
Instruction ID: ec5a62bcfcb542b2f8d9c4f72bfc1b65a446df0a2292fe81e933fc22e076c558
Opcode Fuzzy Hash: 0de8c653d1d955d5a55d661dba51a7eece24c7851ac6cce7ff006ebf22ce282b
Instruction Fuzzy Hash: CED28AB1900348EBDB25DF68D884AED7BB5FB09300F14816AE806A7291D7BC9EC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00729773 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00729813

Strings

MIN, xrefs: 00729904
HIDE, xrefs: 0072989D
MAX, xrefs: 007298D0
<>t, xrefs: 0072A494

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _wcslen
String ID: <>t$HIDE$MAX$MIN
API String ID: 176396367-4029015526
Opcode ID: 9b11c574d4c83e5f46a0605206b8ec96f820b96cff281c4844b6a6425d681463
Instruction ID: afa738c4d1970e81c1b26adeeccd1f63440db855a1fe1c941cddad5bca523bda
Opcode Fuzzy Hash: 9b11c574d4c83e5f46a0605206b8ec96f820b96cff281c4844b6a6425d681463
Instruction Fuzzy Hash: CBB1D331D00268DBCF24EFA8DC88ADDB7B8BF45310F54015AE505B7282EB789A85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0071ACD0 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 0071AD33

Part of subcall function 00715032: GetVersionExW.KERNEL32(?), ref: 00715063

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0071AD57
FileTimeToSystemTime.KERNEL32(?,?), ref: 0071AD71
TzSpecificLocalTimeToSystemTime.KERNELBASE(00000000,?,?), ref: 0071AD84
SystemTimeToFileTime.KERNEL32(?,?), ref: 0071AD94
SystemTimeToFileTime.KERNEL32(?,?), ref: 0071ADA4

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 9b9fff6040cd60de15a65d2ec13760c0e8379a0450b9491ce775303d251c88da
Instruction ID: d1c5f022989deafa66661973fab34c54322fafd7a127e0774dcbb9dd8495d84a
Opcode Fuzzy Hash: 9b9fff6040cd60de15a65d2ec13760c0e8379a0450b9491ce775303d251c88da
Instruction Fuzzy Hash: 5D413D791083059BC704DFA8D88499BB7F8FF98710F44891EF585C7260E734D545CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0072AF00 Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0072AF0C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0072AF26
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0072AF37
TranslateMessage.USER32(?), ref: 0072AF41
DispatchMessageW.USER32(?), ref: 0072AF4B
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0072AF56

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: e5c017c56cd929fa1b2595f4d2b6c448b20dbd5aa115460f4684b22bd9b2dcb4
Instruction ID: 96d16056c403b85d7c5d85ab4f3ab298cc7227bad586e3240ec4946ecc823208
Opcode Fuzzy Hash: e5c017c56cd929fa1b2595f4d2b6c448b20dbd5aa115460f4684b22bd9b2dcb4
Instruction Fuzzy Hash: 6AF0A9B2A00229BBCF216BA1EC4CDEF7F2CEF42391B008021F60AD2051D67CC546CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 007293F3 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000066), ref: 00729609
SendMessageW.USER32(00000000,00000143,00000000,0076AAD0), ref: 00729636
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00729662
__EH_prolog3_GS.LIBCMT ref: 0072A452

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00729554
ProgramFilesDir, xrefs: 00729540

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: MessageSend$H_prolog3_Item
String ID: ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 4098331016-2634093826
Opcode ID: 7816132e337d5516791d17de74e5df796a424ee85a3251e1f5aaf65a53fe2546
Instruction ID: 3438ea3e13b42fa7b9396bdfb47fcdb2528203975fd2fdb65f61c4737e10eff9
Opcode Fuzzy Hash: 7816132e337d5516791d17de74e5df796a424ee85a3251e1f5aaf65a53fe2546
Instruction Fuzzy Hash: ED81A131800268DBCF15EBE4D895FEEB778AF18300F54405AE646B7181EB785BC9CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00726357 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00726378
SHAutoComplete.SHLWAPI(?,00000010), ref: 007263AF

Part of subcall function 0071BF3C: CompareStringW.KERNEL32(00000400,00001001,D5FC40FB,000000FF,?,000000FF,007153ED,0000002E,-00000002,00000000,?,00000000,?,00000008,?,?), ref: 0071BF52

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0072639F

Strings

EDIT, xrefs: 00726383, 0072638E, 0072639B
@Ut, xrefs: 007263AF

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @Ut$EDIT
API String ID: 4243998846-2065656831
Opcode ID: 78810b168490038c0af8aa6a3e5524029164ff635e7721c9fb66e13e31684990
Instruction ID: db852a6066a0ba0e564be31083db9da7d45d91d087983d1908b01363b851edbb
Opcode Fuzzy Hash: 78810b168490038c0af8aa6a3e5524029164ff635e7721c9fb66e13e31684990
Instruction Fuzzy Hash: 74F0A431601328BBDB21DB649D05FAE77BC9F46710F004065FA41E7181D7B8EE058AA9

Uniqueness

Uniqueness Score: -1.00%

Function 0072655D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0071A473: __EH_prolog3_GS.LIBCMT ref: 0071A47A
Part of subcall function 0071A473: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 0071A4AF

OleInitialize.OLE32(00000000), ref: 00726576
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 007265AD
SHGetMalloc.SHELL32(0076AA78), ref: 007265B7

Strings

3Po, xrefs: 0072658E
riched20.dll, xrefs: 00726565

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: DirectoryGdiplusH_prolog3_InitializeMallocStartupSystem
String ID: riched20.dll$3Po
API String ID: 2446841611-3847370236
Opcode ID: de81607aedb32886d11399bc6e1b30ab0b6fe0236da9fce2a1b710a3d1a3778d
Instruction ID: 1b4c758d5252b5b3d23fd2a37a3be5be44f78537c4b2690768f8040c24f1598f
Opcode Fuzzy Hash: de81607aedb32886d11399bc6e1b30ab0b6fe0236da9fce2a1b710a3d1a3778d
Instruction Fuzzy Hash: 81F049B1900249EBCB10AFA9DD499EFFBFCEF95700F00801AE856A2241C7B85605CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00713650 Relevance: 7.7, APIs: 5, Instructions: 183
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,?,00000000,00000003,08000000,00000000,D5FC40FB,?,00000000,?,?,?,00000000,0073FCB8,000000FF), ref: 00713718
GetLastError.KERNEL32(?,?,00000000,0073FCB8,000000FF), ref: 0071372A
CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000,?,?,?,?,00000000,0073FCB8,000000FF), ref: 00713776
GetLastError.KERNEL32(?,?,00000000,0073FCB8,000000FF), ref: 0071377F
SetFileTime.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,0073FCB8,000000FF), ref: 00713816

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 90becdfee05475ab20827ee45e9586435791460121da05ab75686bbe83fbc9ae
Instruction ID: b2b2bf4172e3d8e384de0bd430e7060392078355b06a0404f7b0ed0952a6dc2f
Opcode Fuzzy Hash: 90becdfee05475ab20827ee45e9586435791460121da05ab75686bbe83fbc9ae
Instruction Fuzzy Hash: EB61AFB4904249AFDB14CF68C985BEE7BA4FF04324F20421AF915973D1D7789A84CB94

Uniqueness

Uniqueness Score: -1.00%

Function 007275D8 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 007275E9
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007275FA
IsDialogMessageW.USER32(0001044A,?), ref: 0072760E
TranslateMessage.USER32(?), ref: 0072761C
DispatchMessageW.USER32(?), ref: 00727626

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: df96f33839a9e6a5aea12de7d4a9cf603c4b86af10c3c369295d0ab281847550
Instruction ID: 299967850b15fb3e037a664e6f7323928351bcafa64ba9360da70586b0f32067
Opcode Fuzzy Hash: df96f33839a9e6a5aea12de7d4a9cf603c4b86af10c3c369295d0ab281847550
Instruction Fuzzy Hash: EAF0B7B290222AABCB24ABF6AD4CDEB7F7CEE052907408415F546D3050E6BCD505CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 007217B1 Relevance: 6.3, APIs: 4, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 00721886
_strncpy.LIBCMT ref: 0072196E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007219AC
_strncpy.LIBCMT ref: 00721A85

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _strncpy$Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 2527496121-0
Opcode ID: 591f5b862415c08786b0c81e9e9004b2580f776ddda8e5a9fe6c4d6c8ec0e6f4
Instruction ID: cd82419d59acccdee3d16dab10cd7f06403b1add745c6a7d1c3f85cad526862f
Opcode Fuzzy Hash: 591f5b862415c08786b0c81e9e9004b2580f776ddda8e5a9fe6c4d6c8ec0e6f4
Instruction Fuzzy Hash: C6B1A3B1505310AFC704DF28EC85A2A77F5FBA8310F15852EE546A3361E7BCA9448F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00713D88 Relevance: 6.1, APIs: 4, Instructions: 117fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00713D8F
GetStdHandle.KERNEL32(000000F5,0000002C,0071F3B8,?,?,?,?,?,0071FBCE,0075A6BC,?,00720570,00010000), ref: 00713DB8
WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00713DFE

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FileH_prolog3_HandleWrite
String ID:
API String ID: 2898186245-0
Opcode ID: 483b2ae5b0756c11ccf8e3c7161c2a0ec1dcfbff93e31a00c35bb1f5b2c0c734
Instruction ID: e8d9ba686ea170246dd710f5c353ee240fe16d073ef14431d76067e997cd7acc
Opcode Fuzzy Hash: 483b2ae5b0756c11ccf8e3c7161c2a0ec1dcfbff93e31a00c35bb1f5b2c0c734
Instruction Fuzzy Hash: 4141B034B01244ABDF14DF68E884BED7B76BF95700F044129F841AB2D1CB799E89CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00714740 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00714747
CreateDirectoryW.KERNELBASE(?,00000000,?,00000024,007142E9,?,00000001,00000000,?,?,?,?,?,00000024), ref: 00714770
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,00000024,007142E9,?,00000001,00000000,?,?), ref: 007147C6
GetLastError.KERNEL32(?,?,00000024,007142E9,?,00000001,00000000,?,?,?,?,?,00000024), ref: 00714834

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CreateDirectory$ErrorH_prolog3_Last
String ID:
API String ID: 3709856315-0
Opcode ID: 52fe3e209e7b35cb2904d309b1a9220fb29fe90cda44d62141507a385ee3382e
Instruction ID: f1b87afcdd808405a19cc7b12576662186562890caa2c29799b6511344569b0a
Opcode Fuzzy Hash: 52fe3e209e7b35cb2904d309b1a9220fb29fe90cda44d62141507a385ee3382e
Instruction Fuzzy Hash: 6331C174900259DBDF10EFECD888AEEBBF8AF49310F14442AE500E72D1D7389A80CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00713509 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00713519
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00713531
GetLastError.KERNEL32 ref: 00713563
GetLastError.KERNEL32 ref: 00713582

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 9bb2d962f574f6a95cefd04baaf1b523cc124cc02122669e19fd4e3533691868
Instruction ID: 2978e11e5678f2f51c9fe784068ddb13c2fc8af37de52102945937bbf080beac
Opcode Fuzzy Hash: 9bb2d962f574f6a95cefd04baaf1b523cc124cc02122669e19fd4e3533691868
Instruction Fuzzy Hash: 7A117335500204EBDF205F38C8085ED3BAAAB06B61F508A2AF526851E0D779DFE1DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0071338A Relevance: 4.6, APIs: 3, Instructions: 115fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00713391
CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,?,?,00000024), ref: 00713405
CreateFileW.KERNEL32(?,?,?,00000000,00000002,00000000,00000000,?,?,?,?,?,?,?,00000024), ref: 00713455

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CreateFile$H_prolog3_
String ID:
API String ID: 1771569470-0
Opcode ID: 6dde5d15c7adc23ad3129446b0d809f2f091aaced5f6f3885500b17a64046a75
Instruction ID: ff66a5452c945b0c056d429ecacebc4880696fbc66fd174ffd13b184d845265a
Opcode Fuzzy Hash: 6dde5d15c7adc23ad3129446b0d809f2f091aaced5f6f3885500b17a64046a75
Instruction Fuzzy Hash: 6E416471D10248DFDF14DFA8D889BEEB7B4BB08320F10461EE551E62D1D7789A84CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0071A473 Relevance: 4.6, APIs: 3, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0071A47A
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 0071A4AF
LoadLibraryW.KERNELBASE(00000000,?,?,00000000,00000000,?), ref: 0071A521

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: DirectoryH_prolog3_LibraryLoadSystem
String ID:
API String ID: 1552931673-0
Opcode ID: 1deae1a6caeb04475fc6a1654079e944ec8f80488c1699a7107732ad0a75850d
Instruction ID: 007766ea4f8c875f33a52713855a37ce18023b9659d6f8ed9d32fbece04e37b1
Opcode Fuzzy Hash: 1deae1a6caeb04475fc6a1654079e944ec8f80488c1699a7107732ad0a75850d
Instruction Fuzzy Hash: 60318175D04248EBCB01DFE8D889BEEBBB9AF44714F10411DE505BB282DB785A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00714A2F Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00714A36
SetFileAttributesW.KERNELBASE(?,00000000,00000024,00714830,?,?,?,?,?,?,00000024,007142E9,?,00000001,00000000,?), ref: 00714A4C
SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,?,00000024), ref: 00714A8F

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AttributesFile$H_prolog3_
String ID:
API String ID: 2559025557-0
Opcode ID: acfaafc6e3786c247007298abbf937f2dd51c5fa5a7b30ffe258f630a647c281
Instruction ID: 5bf82be0b2413cac89a97c1a157ef6271b8cdd97633f86a78da99fae4732fcfb
Opcode Fuzzy Hash: acfaafc6e3786c247007298abbf937f2dd51c5fa5a7b30ffe258f630a647c281
Instruction Fuzzy Hash: 4A113D71940219DBDF05DFA8E9459DEB7B8EF08311F14802AF540F7251D738DA94CB68

Uniqueness

Uniqueness Score: -1.00%

Function 007143A5 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007143AC
DeleteFileW.KERNELBASE(000000FF,00000024,00713503,?,?,007132FA,?,?,D5FC40FB,?,?,0073FC52,000000FF), ref: 007143BF
DeleteFileW.KERNEL32(?,000000FF,?,?,007132FA,?,?,D5FC40FB,?,?,0073FC52,000000FF), ref: 007143FF

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: DeleteFile$H_prolog3_
String ID:
API String ID: 3558260747-0
Opcode ID: 5054b58ac1d7334940a56989a6ad8a50784bc07c3614b3e80640703562a47a12
Instruction ID: de418dd485bd6c07b1104fee24c5e2f71ce3b670eb5b7083262837e6627b6362
Opcode Fuzzy Hash: 5054b58ac1d7334940a56989a6ad8a50784bc07c3614b3e80640703562a47a12
Instruction Fuzzy Hash: D7111971900259DBDF04DFA8E849ADEB7B8AF08710F54402AF900F7291DB389A84CB79

Uniqueness

Uniqueness Score: -1.00%

Function 00714461 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00714468
GetFileAttributesW.KERNELBASE(?,00000024,00714458,?,0071478C,?,?,00000024,007142E9,?,00000001,00000000,?,?), ref: 0071447B
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00000024), ref: 007144BB

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AttributesFile$H_prolog3_
String ID:
API String ID: 2559025557-0
Opcode ID: 0e982a679df275da4a01d7e62b5b9d5991af9d988ba3006e1c4a9a274a0d3b12
Instruction ID: 307b62425749b09a0c6f48b671bb165392058805021f14f9a41fc8a1ac885891
Opcode Fuzzy Hash: 0e982a679df275da4a01d7e62b5b9d5991af9d988ba3006e1c4a9a274a0d3b12
Instruction Fuzzy Hash: E5111C71D102589BCF14DFACD889ADDBBF5AB08321F14452AF804F3391D7389A85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0071386D Relevance: 3.1, APIs: 2, Instructions: 140COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 007139F7
GetLastError.KERNEL32 ref: 00713A06

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cafe24fac43712b95966343923ea522aa20b99ba7952ae81748a55e7b458d63e
Instruction ID: 5efc798d2f01485479ab5a4b8acded1ec72af635f12f495a2763885a327f9763
Opcode Fuzzy Hash: cafe24fac43712b95966343923ea522aa20b99ba7952ae81748a55e7b458d63e
Instruction Fuzzy Hash: 7D41D331608345DBD7249F68C4846EAB7E5FB49324F14492EE88687281D7FCFEC58BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00713C12 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 00713C2C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00713CE0

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 239af07ad6cfe681145f6705b3185d3082dddb15e0d5d9b1180ed897816ee329
Instruction ID: 15fbc0a9d73aee183f2a5889d31ae1a83f20dade302d597c8388e9c5771199e4
Opcode Fuzzy Hash: 239af07ad6cfe681145f6705b3185d3082dddb15e0d5d9b1180ed897816ee329
Instruction Fuzzy Hash: 9021CE31248346ABCB14CF29C895AEABBE4AF55704F04481DF495931D1D32DEA8DC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00713CF0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00713D37
GetLastError.KERNEL32 ref: 00713D44

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e3f244cfc25cd7e3aa342f334d219a403264821525e730b1c273d14b50e35e09
Instruction ID: 7a4c1592a97b7c28115570a285d46fc5b85b1512cffef6ad2ac6ecefbef3db9b
Opcode Fuzzy Hash: e3f244cfc25cd7e3aa342f334d219a403264821525e730b1c273d14b50e35e09
Instruction Fuzzy Hash: 8F11E531700600ABE734962CE844BE677E8AB45371F604A29E492D25E1D778EEC6C760

Uniqueness

Uniqueness Score: -1.00%

Function 00711A16 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00711A1D
GetDlgItem.USER32(?,?), ref: 00711A35

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_Item_wcslen
String ID:
API String ID: 896027972-0
Opcode ID: 1001af3b19b10b70f053b34cee1655afbac8ead0795c09fbde8efc4251452b16
Instruction ID: be1f5364c6dbe13f74924a91d587b9199048dc6f7540001ca1473974dcd6446e
Opcode Fuzzy Hash: 1001af3b19b10b70f053b34cee1655afbac8ead0795c09fbde8efc4251452b16
Instruction Fuzzy Hash: 4201D870A41304DED711EF6CC85ABEDBBF8AF54740F804119F6419B2D1C7B89985C750

Uniqueness

Uniqueness Score: -1.00%

Function 007265C3 Relevance: 3.0, APIs: 2, Instructions: 31comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,0074086E,000000FF), ref: 00726601
OleUninitialize.OLE32(?,?,?,?,0074086E,000000FF), ref: 00726606

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: db14597abbe8e6d3bfce9f90d68da6fb138fa57e2f37bcf527365af809c58d44
Instruction ID: 3530ab96809b0a3ac299342edd43480c2873dcbd09722c6f1ce5314001100414
Opcode Fuzzy Hash: db14597abbe8e6d3bfce9f90d68da6fb138fa57e2f37bcf527365af809c58d44
Instruction Fuzzy Hash: 4FF0827A604614EFD701DB59ED05B4ABBA8FB4AB30F008627F416D3760DB78A840CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00726D92 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00726D99
_wcslen.LIBCMT ref: 00726DC3

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_catch_wcslen
String ID:
API String ID: 1260878687-0
Opcode ID: 7543c17cd5de54c8a2fcd819c950e05bc2e4b215d59b076b525ae1aaccfe5e09
Instruction ID: 659f6d99dbc18683fab2f3f84ba48f2f01adb8d42f98e5d4917b0f902647cbbd
Opcode Fuzzy Hash: 7543c17cd5de54c8a2fcd819c950e05bc2e4b215d59b076b525ae1aaccfe5e09
Instruction Fuzzy Hash: C7F0FE7290012DDADB01FFA4E906AEF7BB8AF14310F204066F604B6141DA395B418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00725919 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0072593A
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00725941

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 201af013e939e9d10508547f94d796f0b4a366cf2109d6028c5262b96d095e1c
Instruction ID: 4bee2b7fd4ed8e319755bb5872d9a5c165ca2198fabd8c6530de97cb59735258
Opcode Fuzzy Hash: 201af013e939e9d10508547f94d796f0b4a366cf2109d6028c5262b96d095e1c
Instruction Fuzzy Hash: DFE0EDB1500228EBCB11DF54D54579DB7F8EB04720F20845AA885A3201E278AE44DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00711B53 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00711B68
ShowWindow.USER32(00000000), ref: 00711B6F

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: dbc4470dfd4fb8d55c564fc64dc29abb13c145361d51f0797fa1c8ba5887e13a
Instruction ID: c3227d07d5748b1b5da0e3bac7c8b9b515ad08452ee244abded39505700ac240
Opcode Fuzzy Hash: dbc4470dfd4fb8d55c564fc64dc29abb13c145361d51f0797fa1c8ba5887e13a
Instruction Fuzzy Hash: 69C012B2058244BECB021BB4DC09C3EBBA8ABA6212F10C908F1E6C1061D23CC014DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0071F0DE Relevance: 1.7, APIs: 1, Instructions: 218COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0071F0E5

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: d9a0a7a8b799c69fa7474d0f3ecac326fcf3565f067aa2465e00462129868c35
Instruction ID: 6accb1a18bd661349b885f3caf7cb7e9e86fa0136a40880b9a2ba4af037c5309
Opcode Fuzzy Hash: d9a0a7a8b799c69fa7474d0f3ecac326fcf3565f067aa2465e00462129868c35
Instruction Fuzzy Hash: 3B719171900219EBDB15DFACD889AEEBBB9EF08310F188525E411F7291DB7CD9808F65

Uniqueness

Uniqueness Score: -1.00%

Function 00721380 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00721387

Part of subcall function 00721D76: __EH_prolog3_GS.LIBCMT ref: 00721D7D

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 85a7837150f90711682eccdb1d3d198fd5add1fab15ebdc0e84db3c889e121b9
Instruction ID: fc2e34900b63d26a6a2dba868cb7575e17974fa8a7c683b857e64c84f40f5cfa
Opcode Fuzzy Hash: 85a7837150f90711682eccdb1d3d198fd5add1fab15ebdc0e84db3c889e121b9
Instruction Fuzzy Hash: 8D414F70D00258DBCB20EFE9D8856DCBBB5FF59310FA4806ED10AA7292DB784985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0071F7FA Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0071F81B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: 17ef88479d0c752830f982fcaa1ffbb12c2b1898ae70127e489ff35fa9e2a4c2
Instruction ID: 51336afb102f01440df8707cff199583bb1ddc3fca12b1345c8b31af49f9b050
Opcode Fuzzy Hash: 17ef88479d0c752830f982fcaa1ffbb12c2b1898ae70127e489ff35fa9e2a4c2
Instruction Fuzzy Hash: 0E319275601310AFC705DF1CEC94A6937A5FB98710B19812AE903E73B1D7BCAC418F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00714235 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0071423C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 920c3ae73198126ab2173a58ebe2963ff073b02b43a2b559a0121044333ebc20
Instruction ID: 569f0ee1367e0caa081c2fab4095e04f992d49f6dd1d6653ffc83eb4c7ef6b6f
Opcode Fuzzy Hash: 920c3ae73198126ab2173a58ebe2963ff073b02b43a2b559a0121044333ebc20
Instruction Fuzzy Hash: 4321AE70600204EADF20EA68884AAEE73E9BF53B80F500518F881AB1C1D73C9EC9C660

Uniqueness

Uniqueness Score: -1.00%

Function 0071F4EE Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0071F4F5

Part of subcall function 00714C75: FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,0071FA7D,0076B1E4,-00000070,00000000), ref: 00714C9D

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CloseFindH_prolog3_
String ID:
API String ID: 2672038326-0
Opcode ID: 80ee9b0d10397637b782d723ce10c1d563d3c96080e3df177ab54dc5549175ce
Instruction ID: 3a09c5666db9ddd104a4256e3d4c9b0bf755bf39981471e7048bd9a121081240
Opcode Fuzzy Hash: 80ee9b0d10397637b782d723ce10c1d563d3c96080e3df177ab54dc5549175ce
Instruction Fuzzy Hash: DD215BB0E05254DADF14EFACA8496EDBBB2BF08700F20413EE406A7392DB7849558F55

Uniqueness

Uniqueness Score: -1.00%

Function 0071B85D Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0072B15E

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: c3b4e3046c6b86994b142cf4ec7c619e07b302e3f0c6ab77ee04365742b8f3bf
Instruction ID: b9c2b84e31f5a55be614b72dee3f7cf29325d7c6b2f4bc82ff29e1d4cb7c3925
Opcode Fuzzy Hash: c3b4e3046c6b86994b142cf4ec7c619e07b302e3f0c6ab77ee04365742b8f3bf
Instruction Fuzzy Hash: 7E2187B1D04218DFDB08EFA4E989EDE7BB9BF44300F140019F101E7291D7399A95CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00739819 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 007384D6: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0073681A,00000001,00000364,?,0072D656,?,?,?,00000000,?,0072C08A,0072C17E), ref: 00738517

_free.LIBCMT ref: 00739885

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: cad4fd7691973b889dac81a4565274e961a8517fcde5adeb8a615647a0e82bc5
Instruction ID: 01c399cba3216f38df54c2129d75da3abe030251512c42865a5ec3d1a07ea0f3
Opcode Fuzzy Hash: cad4fd7691973b889dac81a4565274e961a8517fcde5adeb8a615647a0e82bc5
Instruction Fuzzy Hash: 74012673200345ABF7218F65D88599AFBD8FBC6370F25062DE68483281EA74A805C674

Uniqueness

Uniqueness Score: -1.00%

Function 007384D6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0073681A,00000001,00000364,?,0072D656,?,?,?,00000000,?,0072C08A,0072C17E), ref: 00738517

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d377959355b4ba50b145bb7ccd2c2919b4b65014a4db8193c65c79f40c30fbae
Instruction ID: 0329d0f888b0b08dee5a12da3ce8366cb499c5c48b389ab2a37f13429dc42a66
Opcode Fuzzy Hash: d377959355b4ba50b145bb7ccd2c2919b4b65014a4db8193c65c79f40c30fbae
Instruction Fuzzy Hash: 34F0B432644325A7FF615B22DC05B9B3748EF81760F298012F814D6093DF78DD1186E7

Uniqueness

Uniqueness Score: -1.00%

Function 00736B6E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0072C17E,?,?,0072D656,?,?,?,00000000,?,0072C08A,0072C17E,?,?,?,?), ref: 00736BA0

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 441d1eeec0667092c6dc8e4eda060fb8c177f21c3a62405690aa0dd3add20ca3
Instruction ID: 41b6c1689eb38a6c653bd3ff8aa244f50f0a3da453640d25cc2b23c4d0545127
Opcode Fuzzy Hash: 441d1eeec0667092c6dc8e4eda060fb8c177f21c3a62405690aa0dd3add20ca3
Instruction Fuzzy Hash: B8E065B5244221B7FA213765DC09B5BBA88DF427A0F3AC121EC55D7093DB6DDC0089E4

Uniqueness

Uniqueness Score: -1.00%

Function 00713340 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00713301,?,?,D5FC40FB,?,?,0073FC52,000000FF), ref: 0071335B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8c358b6b6545c04eea392fe42a8fc3326f97fb1a4a6e4ff2fcd90fa2248ff3c0
Instruction ID: d7a47173106a2788cc5eba7a1f868f3736172ec2e9a463fc263984fc1af49c68
Opcode Fuzzy Hash: 8c358b6b6545c04eea392fe42a8fc3326f97fb1a4a6e4ff2fcd90fa2248ff3c0
Instruction Fuzzy Hash: BAF0A0B0445B01CFEB308B2CD8083D277E46B12370F044B1EE0F2824E0CB68ABDADA54

Uniqueness

Uniqueness Score: -1.00%

Function 00714C75 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00714D8A: __EH_prolog3_GS.LIBCMT ref: 00714D94
Part of subcall function 00714D8A: FindFirstFileW.KERNELBASE(?,-00000278,00000274,00714C97,000000FF,?,?,?,?,0071FA7D,0076B1E4,-00000070,00000000), ref: 00714DBD
Part of subcall function 00714D8A: FindFirstFileW.KERNELBASE(-00000028,-00000278,?,-00000028,?,?,?,?,?,?,?,?,?,?,0072114C,00000000), ref: 00714E08
Part of subcall function 00714D8A: GetLastError.KERNEL32(?,-00000028,?,?,?,?,?,?,?,?,?,?,0072114C,00000000), ref: 00714E66

FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,0071FA7D,0076B1E4,-00000070,00000000), ref: 00714C9D

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorH_prolog3_Last
String ID:
API String ID: 765066492-0
Opcode ID: 2fd2b7481c2ec115965241f401906147b3a138c35345d2013766473568ccb08c
Instruction ID: 97fbf362f288ce7dd9c25fa8efdc08e01f39db4be3ce33ebedad936c1e96b849
Opcode Fuzzy Hash: 2fd2b7481c2ec115965241f401906147b3a138c35345d2013766473568ccb08c
Instruction Fuzzy Hash: BCF08235009790EACF215FAC5909ADB7BE06F16330F144B09F0E9026E2C638D4959B62

Uniqueness

Uniqueness Score: -1.00%

Function 00723F16 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00723F1D

Part of subcall function 00713650: CreateFileW.KERNELBASE(00000000,?,?,00000000,00000003,08000000,00000000,D5FC40FB,?,00000000,?,?,?,00000000,0073FCB8,000000FF), ref: 00713718
Part of subcall function 00713650: GetLastError.KERNEL32(?,?,00000000,0073FCB8,000000FF), ref: 0071372A
Part of subcall function 00713650: CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000,?,?,?,?,00000000,0073FCB8,000000FF), ref: 00713776

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CreateFile$ErrorH_prolog3_Last
String ID:
API String ID: 4294874049-0
Opcode ID: 56da200d6962b5c3d6b2fa6b3764e7321ac65d7299cf3420466e38d490ce9dbe
Instruction ID: 1bfde746dfce1c8bc056e639091659831fefda63c710ed6943343eb614d1335a
Opcode Fuzzy Hash: 56da200d6962b5c3d6b2fa6b3764e7321ac65d7299cf3420466e38d490ce9dbe
Instruction Fuzzy Hash: 3CE0A57181026CEACF00FB94DD9AAEE7739BF15744F144019BA096B191DA78AF49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00725BD6 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00725BDC

Part of subcall function 00725919: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0072593A

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 478f8b8c81deb0fc53abe9f08a4f22149e6ab8492a042acd5b5e01f701b0f814
Instruction ID: 28d32cce8eac9b4b195ab2332db43faf118531130292af629318fd5222f0fb0e
Opcode Fuzzy Hash: 478f8b8c81deb0fc53abe9f08a4f22149e6ab8492a042acd5b5e01f701b0f814
Instruction Fuzzy Hash: D6D0A970200629FADF026B20AC06A6E7A98AB00380F00C021B84285181EEB9DE10A6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0072B00B Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,0071B82D), ref: 0072B030

Part of subcall function 007275D8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 007275E9
Part of subcall function 007275D8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007275FA
Part of subcall function 007275D8: IsDialogMessageW.USER32(0001044A,?), ref: 0072760E
Part of subcall function 007275D8: TranslateMessage.USER32(?), ref: 0072761C
Part of subcall function 007275D8: DispatchMessageW.USER32(?), ref: 00727626

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 4c627cbb4591c36a88c42ab5347ec258884d8232ab8cfc465ebd58cec69b7061
Instruction ID: c0dd217c86d7a39db95b8af6abd33fe5bc1fd1aad9ec74e113d17badc9bed228
Opcode Fuzzy Hash: 4c627cbb4591c36a88c42ab5347ec258884d8232ab8cfc465ebd58cec69b7061
Instruction Fuzzy Hash: 36D09E71164300BAE6022B51DE0AF1ABAA2BB88F04F404554B345740F1C6A69D319B06

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7F9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 0b68a6a79e009959eb6ceef7967d56b732b7fb6e10b486de30d90cc040d4cb5c
Instruction ID: 63b7437108002bac5e5cd6e2f47f132570884c36f8182be965ed57053ef2efd0
Opcode Fuzzy Hash: 0b68a6a79e009959eb6ceef7967d56b732b7fb6e10b486de30d90cc040d4cb5c
Instruction Fuzzy Hash: 89B012D6359051EC314961183D17C36138CC0C1B10370842BF941C0141D74C4C801031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7E5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 340241fc1e17bc5c9d7df71a2c7db57b07cbc6716e89a4310f8f3960cbeaa1e0
Instruction ID: fab3ba75141db5e71650f9a6343c71098413c474300dbc0529066c15c2215016
Opcode Fuzzy Hash: 340241fc1e17bc5c9d7df71a2c7db57b07cbc6716e89a4310f8f3960cbeaa1e0
Instruction Fuzzy Hash: 86B012D235B051AC314951087E07C36174CC1C0B10770442BF445C0141D74D0C411031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 43cb7f6f6bef0fd0e98a1463959a1ce98be2827cf1b3c4eeaf058dcc5f5794d0
Instruction ID: 7e88f6388d383ee8ed91e6da83263bf1284ce4955765a1d3b5457527928567b9
Opcode Fuzzy Hash: 43cb7f6f6bef0fd0e98a1463959a1ce98be2827cf1b3c4eeaf058dcc5f5794d0
Instruction Fuzzy Hash: C0B012D235A061AC314961087D17C36134CC1C1B10770852BF845C0141D74C0C401031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7DB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: ca86c2d00872cae963b3ffe18e1b1c3a1e386da908547331af74390263a36a85
Instruction ID: 52ca5a3894e4144536e4c8e8b9e9e1a8ef4b2666664cefe4746e4c8a49c86d4f
Opcode Fuzzy Hash: ca86c2d00872cae963b3ffe18e1b1c3a1e386da908547331af74390263a36a85
Instruction Fuzzy Hash: 1DB012E235A151AD318952087D07C36134CC1C0B10770452BF445C0141D74C0C801031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7C7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: bb9108e61ec6235b619590104b67e7e1e574bc33d8d5a2e4cf5a54e4ec5dc15f
Instruction ID: 2896aa8096a9d8bfab1acb7d80e468d121bb80185b7a1f170e51d1511a3e2cd8
Opcode Fuzzy Hash: bb9108e61ec6235b619590104b67e7e1e574bc33d8d5a2e4cf5a54e4ec5dc15f
Instruction Fuzzy Hash: 05B012E2359091AC3149510D3D07C36134CC0C0B10370842BF441C4141E74C0C441031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7B3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: ee6ce84e00e7eed249bc699b0270f36e2ea7096af18d59ee2bd25822358bb7bb
Instruction ID: 2642e8afc3c74ea34d594a9dbfa420dbc6cad702bd08c63a6acd95a4c0ce7c56
Opcode Fuzzy Hash: ee6ce84e00e7eed249bc699b0270f36e2ea7096af18d59ee2bd25822358bb7bb
Instruction Fuzzy Hash: EFB012E2359151AD3189510C3D07C36134CC0C0B10370852BF441C4141E74C0C841031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7BD Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: f338fc9818d86966b17ebaf81ddf38cb5b52f8b31dfa3bd25ebddef418c46ee6
Instruction ID: 5c44129f51412755dbae662b1747bb38c246eb2bbca37cbb5a0f9164d54e4767
Opcode Fuzzy Hash: f338fc9818d86966b17ebaf81ddf38cb5b52f8b31dfa3bd25ebddef418c46ee6
Instruction Fuzzy Hash: 89B012E2359051AC3149510C3E07C36134CC0C0B10370842BF441C4141E74C0D451031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7A9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e4b0572ff54e0625a52e467e9b083c8cc8f2ffdd49dccd0d9ea852c665620a72
Instruction ID: 2c5a1ed21c194f891efe7c67eb5aaf29ba3d29602239d20be16851415e5fce24
Opcode Fuzzy Hash: e4b0572ff54e0625a52e467e9b083c8cc8f2ffdd49dccd0d9ea852c665620a72
Instruction Fuzzy Hash: 39B012E2359051AC3149610C3D17C36134CC0C1B10370C42BF841C4141E74C0C481031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B79F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d90d4bbff24311ddd69d84ea3090914926dde1b6cf72c300900a074466537564
Instruction ID: ad42cea088e8e035d09884ba1fbe5b49d58501c3f712ff73fb916f2841749b6d
Opcode Fuzzy Hash: d90d4bbff24311ddd69d84ea3090914926dde1b6cf72c300900a074466537564
Instruction Fuzzy Hash: B4B012D2359091AC3149514C3D07C36134CC0C0B103B0882BF541C0241D74C0C441031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B784 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: cbd5f868a1571c995a5e1147a205e40736948717d98e61f789c09a43a3558e48
Instruction ID: 23fcad19e3ffb6c951215e4ebaf6ce44e0392e1c7c80b173fe2f25c562c2c95e
Opcode Fuzzy Hash: cbd5f868a1571c995a5e1147a205e40736948717d98e61f789c09a43a3558e48
Instruction Fuzzy Hash: CAB012D2359059BC310921083E17C36130CC0C1B103B0C52BF951D0141974C0C441032

Uniqueness

Uniqueness Score: -1.00%

Function 0072B853 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 4cfd350311bb7cb7bc252a8dcc5460d69600fe22c4e5094f507782cb14860cb8
Instruction ID: a56f5ea6713fde71daed5e89edabef8e53637d312b9f89b6df188379eadf7de3
Opcode Fuzzy Hash: 4cfd350311bb7cb7bc252a8dcc5460d69600fe22c4e5094f507782cb14860cb8
Instruction Fuzzy Hash: 1EB012D235D151AD318951087D07C36134CC0C0B10370452BF481C0141DB4C0C801031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B849 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: b321f43e70de8460ad7f36cbade81817b8ab48db7fd29e394db9c928ac375c88
Instruction ID: 3c3533107556b05f32b6098a422097bc4eefd945a0c7d17c2b761564acd5811e
Opcode Fuzzy Hash: b321f43e70de8460ad7f36cbade81817b8ab48db7fd29e394db9c928ac375c88
Instruction Fuzzy Hash: 33B012D2359051AC314961083D17C36135CC0C1B10370842BF841C0141DB4C0C401032

Uniqueness

Uniqueness Score: -1.00%

Function 0072B835 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 604700e405eb08861b15b9564a560bf5ab9a7a821db29f1abc58b2ef7e5fad1d
Instruction ID: ae8934b6736a251f8109abacf66336ead863fedf07313bcac0eebf9bd95f2dcd
Opcode Fuzzy Hash: 604700e405eb08861b15b9564a560bf5ab9a7a821db29f1abc58b2ef7e5fad1d
Instruction Fuzzy Hash: 16B012D2359051AC315A51087E07C36134CC0C0F10370442BF441C0541D74C0C411031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B83F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e10b65a6e5419652795b0cd4e6f6bba0d1d8cf5b9eb5a5370e51e9fa48bcbb5a
Instruction ID: e1cff0a12b1d4622b228d62ae2abd90bfad4794735071857510701c39cec3201
Opcode Fuzzy Hash: e10b65a6e5419652795b0cd4e6f6bba0d1d8cf5b9eb5a5370e51e9fa48bcbb5a
Instruction Fuzzy Hash: 6CB012D2359091AC315A51083D07C36134CC0C0B10370482BF441C0581D74C0C401031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B821 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 10f7b1ac9340870e19cb4c90cd2da20a94ea572f2a75abb2d90aa00cf2d7a9d3
Instruction ID: c21194edb3d6284b249b62717b0e4dec7916ac37c946acfd8de0ae0e2f917958
Opcode Fuzzy Hash: 10f7b1ac9340870e19cb4c90cd2da20a94ea572f2a75abb2d90aa00cf2d7a9d3
Instruction Fuzzy Hash: C5B012D2359051AC315A61083D17C36134CC0C1B10370843BF841C0541D74C0C401031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B817 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 24c4c7d66ca6c2357071a3a9dd4dc57e68b386616d798b78f1501133d8c95db8
Instruction ID: 66658664e4547312fd354ad0b6e01600364c44aaae6cbb44c370bc65698687e1
Opcode Fuzzy Hash: 24c4c7d66ca6c2357071a3a9dd4dc57e68b386616d798b78f1501133d8c95db8
Instruction Fuzzy Hash: 6EB012E7359095EC314951083D17C36138CC0C0B10370452BF441C0141D74C0C801031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B803 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 55e6012191936cb0009a296fb82c120b5b4eae9bad950c1afec2e5e586ab8328
Instruction ID: 8ee5cecb271732fdfbb0f5dc8ace8fe2788a4eeee3fc590f536e5c7ef680e63f
Opcode Fuzzy Hash: 55e6012191936cb0009a296fb82c120b5b4eae9bad950c1afec2e5e586ab8328
Instruction Fuzzy Hash: FFB012D7359151ED318951083D07C36138CC0C0B10370452BF441C0141D74C0CC01031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B80D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 28f7a0b5f521548db833d8bb51d7e9b6bac779e3ad9f9de4663c503a03ea9c8e
Instruction ID: 48069ec00985d52008c8b59b2e5dfdcd67070d17f30d7d6c4f668161adde64b6
Opcode Fuzzy Hash: 28f7a0b5f521548db833d8bb51d7e9b6bac779e3ad9f9de4663c503a03ea9c8e
Instruction Fuzzy Hash: A4B012E6359051EC314951083E07C3613CCC0C0B10770442BF441C0141D74C0C811031

Uniqueness

Uniqueness Score: -1.00%

Function 0072B9E0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: ce4d50281712cae479ce8e57439ef00d503fc022bffdd1a5d9d8ca583d9ea9c4
Instruction ID: c0e0f379d0fdce5420ab654c7ce2431c76724c31b5da54c1c9f593e4a3e61b2b
Opcode Fuzzy Hash: ce4d50281712cae479ce8e57439ef00d503fc022bffdd1a5d9d8ca583d9ea9c4
Instruction Fuzzy Hash: A7B012E236D021EC3145A1083C0AC3B031CC0C0B10370C03AF981C4040DB4C3C880531

Uniqueness

Uniqueness Score: -1.00%

Function 0072B9D6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: af2b66460bbfd65996cc037e97551c8eb07e6b109a6a257648b9ef3f8bf79eff
Instruction ID: 64ec4bd0c996d48c7636f3ea7a2df7186c819975ca66b0de2a22a79f856a84ee
Opcode Fuzzy Hash: af2b66460bbfd65996cc037e97551c8eb07e6b109a6a257648b9ef3f8bf79eff
Instruction Fuzzy Hash: FFB012D236D061ED314591043D0AD3E031CC0C0B143B0843AF781C0040DB4C3C840531

Uniqueness

Uniqueness Score: -1.00%

Function 0072BA08 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: c36123af2274bcbdab53f7bce9033a8ccf623f717f6ed8f569c69433ec0d7fe8
Instruction ID: 32bb40760b760c31ed8faa82b4b9dd78a744f8a87c9ce33ad7998c8463f4f57b
Opcode Fuzzy Hash: c36123af2274bcbdab53f7bce9033a8ccf623f717f6ed8f569c69433ec0d7fe8
Instruction Fuzzy Hash: D4B012E236D021FC314591483D0AC3B031CC0C0B10370C03AF681C4040DB4D3C850531

Uniqueness

Uniqueness Score: -1.00%

Function 0072BACA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 538562cc428fa4d23e7fe17cb17df508be1a1cfa4bfe1852570c86fa6b203c9f
Instruction ID: 1dfdf52afc008f14fbfb258c5822ad5421cecf90bc6bc9f5e34e13a59bdd0788
Opcode Fuzzy Hash: 538562cc428fa4d23e7fe17cb17df508be1a1cfa4bfe1852570c86fa6b203c9f
Instruction Fuzzy Hash: D1B012D236A212EC374551193C06C3A237CC0C4F103B0C22BF541C0040D74C2C446131

Uniqueness

Uniqueness Score: -1.00%

Function 0072BAAC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e11f26b838954f132edce2ef8772628ebb80baf9d265409b90c9a043d739b07b
Instruction ID: 66e76f5953b12493dd7ce5a4931ff7d73aa972a611a4657aa4f86986cc6bd38b
Opcode Fuzzy Hash: e11f26b838954f132edce2ef8772628ebb80baf9d265409b90c9a043d739b07b
Instruction Fuzzy Hash: 4BB012D236A012FC324951587D07C3A137CC0C4B103F0C22AF641C0040D74C2C012431

Uniqueness

Uniqueness Score: -1.00%

Function 0072BA91 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: c6d9014f7dd8453563ec1d28bfe9c5efa227c45e3431396a1cad63ee2028cac0
Instruction ID: 87b3ae81a0c6ac9efb483f73ca44a8714643c4bf12aeaef3de179f2476c84193
Opcode Fuzzy Hash: c6d9014f7dd8453563ec1d28bfe9c5efa227c45e3431396a1cad63ee2028cac0
Instruction Fuzzy Hash: 5EB012D236A112FC320961147C07C3A133CC0C4B103B0C52AF941C0040D74C2C002031

Uniqueness

Uniqueness Score: -1.00%

Function 0071665E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 0071666B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: b6a5d158cc80a976b2a6a5cb6553c9aa92cf8abe88904eb1ca599754c54b403a
Instruction ID: d7ab13f6fb4099e6d92cc562c82a41c85e419743714f46023c50afd0be36a3d1
Opcode Fuzzy Hash: b6a5d158cc80a976b2a6a5cb6553c9aa92cf8abe88904eb1ca599754c54b403a
Instruction Fuzzy Hash: 72C04870205200DFC704CF6AEA8CE0A77EABF92B06B41C469F400CB172D738D8A1DA29

Uniqueness

Uniqueness Score: -1.00%

Function 0072B7F4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a99b36cf1878e8373859777cb35a3381b1c2352d5a2f2692175147231dfdadf9
Instruction ID: b5f4a6d485c13c37074325e01cc8addfcbd55ca07c3981e33bbee930f2a68832
Opcode Fuzzy Hash: a99b36cf1878e8373859777cb35a3381b1c2352d5a2f2692175147231dfdadf9
Instruction Fuzzy Hash: E0A011E22AA0A2BC300822003E0BC3A030CC0C0B203B0880AF00280080AB8808802030

Uniqueness

Uniqueness Score: -1.00%

Function 0072B876 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 2806f27901a8b5bdd3a0356a6fbdd034b1c8a646e6163ec50cce9053cd7dde52
Instruction ID: b5f4a6d485c13c37074325e01cc8addfcbd55ca07c3981e33bbee930f2a68832
Opcode Fuzzy Hash: 2806f27901a8b5bdd3a0356a6fbdd034b1c8a646e6163ec50cce9053cd7dde52
Instruction Fuzzy Hash: E0A011E22AA0A2BC300822003E0BC3A030CC0C0B203B0880AF00280080AB8808802030

Uniqueness

Uniqueness Score: -1.00%

Function 0072B862 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 0d31e55a54d8ec28d89d6617f57f43ea4b120a0dce6a360419837696d5a4c6dd
Instruction ID: b5f4a6d485c13c37074325e01cc8addfcbd55ca07c3981e33bbee930f2a68832
Opcode Fuzzy Hash: 0d31e55a54d8ec28d89d6617f57f43ea4b120a0dce6a360419837696d5a4c6dd
Instruction Fuzzy Hash: E0A011E22AA0A2BC300822003E0BC3A030CC0C0B203B0880AF00280080AB8808802030

Uniqueness

Uniqueness Score: -1.00%

Function 0072B86C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 57a339568fe6a379f0d88ee2b9465bb18116ae63023ec1c52b2e2400aadcc6ba
Instruction ID: b5f4a6d485c13c37074325e01cc8addfcbd55ca07c3981e33bbee930f2a68832
Opcode Fuzzy Hash: 57a339568fe6a379f0d88ee2b9465bb18116ae63023ec1c52b2e2400aadcc6ba
Instruction Fuzzy Hash: E0A011E22AA0A2BC300822003E0BC3A030CC0C0B203B0880AF00280080AB8808802030

Uniqueness

Uniqueness Score: -1.00%

Function 0072B830 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 81b82821a5d8106bf78260854a2b12e48e30c7cd385d07dec3244b3e05c80a1d
Instruction ID: b5f4a6d485c13c37074325e01cc8addfcbd55ca07c3981e33bbee930f2a68832
Opcode Fuzzy Hash: 81b82821a5d8106bf78260854a2b12e48e30c7cd385d07dec3244b3e05c80a1d
Instruction Fuzzy Hash: E0A011E22AA0A2BC300822003E0BC3A030CC0C0B203B0880AF00280080AB8808802030

Uniqueness

Uniqueness Score: -1.00%

Function 0072B880 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 991ec35b5577e4e1b05e3fcba90de2cac7e0985dfa0c07cf3a60a76f4b1a8f70
Instruction ID: b5f4a6d485c13c37074325e01cc8addfcbd55ca07c3981e33bbee930f2a68832
Opcode Fuzzy Hash: 991ec35b5577e4e1b05e3fcba90de2cac7e0985dfa0c07cf3a60a76f4b1a8f70
Instruction Fuzzy Hash: E0A011E22AA0A2BC300822003E0BC3A030CC0C0B203B0880AF00280080AB8808802030

Uniqueness

Uniqueness Score: -1.00%

Function 0072B88A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B796

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a356ea13e4b734a9cf54d5a97945cf9ce4144748c1b39d277b827a6806309c9f
Instruction ID: b5f4a6d485c13c37074325e01cc8addfcbd55ca07c3981e33bbee930f2a68832
Opcode Fuzzy Hash: a356ea13e4b734a9cf54d5a97945cf9ce4144748c1b39d277b827a6806309c9f
Instruction Fuzzy Hash: E0A011E22AA0A2BC300822003E0BC3A030CC0C0B203B0880AF00280080AB8808802030

Uniqueness

Uniqueness Score: -1.00%

Function 0072B9F9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 057e736e5b026f18515a158738afc39677a113c149446ecb2bbe64c8883c2a42
Instruction ID: f9bf7f0a3040e2086eacff1497a91a72e871b38f6e2c266da81ce1b5b9d11e0a
Opcode Fuzzy Hash: 057e736e5b026f18515a158738afc39677a113c149446ecb2bbe64c8883c2a42
Instruction Fuzzy Hash: 6CA001E66AE162FC7549A2517D0AC7A432CC4C4BA13B0896AF69284481AB8938955931

Uniqueness

Uniqueness Score: -1.00%

Function 0072B9EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 98c7ae122e425135052f00010c0fef120f3b8aeb11f4d735bf704bdcb60a7c39
Instruction ID: f9bf7f0a3040e2086eacff1497a91a72e871b38f6e2c266da81ce1b5b9d11e0a
Opcode Fuzzy Hash: 98c7ae122e425135052f00010c0fef120f3b8aeb11f4d735bf704bdcb60a7c39
Instruction Fuzzy Hash: 6CA001E66AE162FC7549A2517D0AC7A432CC4C4BA13B0896AF69284481AB8938955931

Uniqueness

Uniqueness Score: -1.00%

Function 0072B9D1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d81e7e43e7ccaeac124a34d6f89836666d26d015549250b848d201a10236d54e
Instruction ID: f9bf7f0a3040e2086eacff1497a91a72e871b38f6e2c266da81ce1b5b9d11e0a
Opcode Fuzzy Hash: d81e7e43e7ccaeac124a34d6f89836666d26d015549250b848d201a10236d54e
Instruction Fuzzy Hash: 6CA001E66AE162FC7549A2517D0AC7A432CC4C4BA13B0896AF69284481AB8938955931

Uniqueness

Uniqueness Score: -1.00%

Function 0072B9C7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: fc5f5297ddddbefae0696568fdf2a03373bf168f1e23bbd2f20a2ecbe6ff08f0
Instruction ID: f9bf7f0a3040e2086eacff1497a91a72e871b38f6e2c266da81ce1b5b9d11e0a
Opcode Fuzzy Hash: fc5f5297ddddbefae0696568fdf2a03373bf168f1e23bbd2f20a2ecbe6ff08f0
Instruction Fuzzy Hash: 6CA001E66AE162FC7549A2517D0AC7A432CC4C4BA13B0896AF69284481AB8938955931

Uniqueness

Uniqueness Score: -1.00%

Function 0072B9AC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 3d18e12d4b8642843617f4a9437ba5c1791057473d675195f531a210da2ac086
Instruction ID: f8697d92b2cd7ac56e3225a699ae9ea2d670dcd534da5c5f48a7edbada3db474
Opcode Fuzzy Hash: 3d18e12d4b8642843617f4a9437ba5c1791057473d675195f531a210da2ac086
Instruction Fuzzy Hash: DDA001E66AA162BC7949A2517D4AC7A432CC4C0B613B0856AFA9194481AB8938955931

Uniqueness

Uniqueness Score: -1.00%

Function 0072BA03 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072B9B9

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 19809299fedb39a07d068dae7d48bc4a01b51988d898c23372db78004703e474
Instruction ID: f9bf7f0a3040e2086eacff1497a91a72e871b38f6e2c266da81ce1b5b9d11e0a
Opcode Fuzzy Hash: 19809299fedb39a07d068dae7d48bc4a01b51988d898c23372db78004703e474
Instruction Fuzzy Hash: 6CA001E66AE162FC7549A2517D0AC7A432CC4C4BA13B0896AF69284481AB8938955931

Uniqueness

Uniqueness Score: -1.00%

Function 0072BAE3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 0aef5c999c0498951c8aee1b9e963838bc01c22643a57ae48a4e31b8cc3a45ea
Instruction ID: 6b49eb94dcb93922d2d0cb346bfffb6d8d90ec90fbe5582e9fc751aa1a5551e4
Opcode Fuzzy Hash: 0aef5c999c0498951c8aee1b9e963838bc01c22643a57ae48a4e31b8cc3a45ea
Instruction Fuzzy Hash: 98A011E22AA023BC320822203C0AC3A033CC0C8B203B0C80AF20280080EB8828002030

Uniqueness

Uniqueness Score: -1.00%

Function 0072BAED Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e446de5f670f59f9ecbb910077169a302a14bc25f82c4c2b948c45f959721fbd
Instruction ID: 6b49eb94dcb93922d2d0cb346bfffb6d8d90ec90fbe5582e9fc751aa1a5551e4
Opcode Fuzzy Hash: e446de5f670f59f9ecbb910077169a302a14bc25f82c4c2b948c45f959721fbd
Instruction Fuzzy Hash: 98A011E22AA023BC320822203C0AC3A033CC0C8B203B0C80AF20280080EB8828002030

Uniqueness

Uniqueness Score: -1.00%

Function 0072BAD9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: aad69495228a45948ba7c2eb04a52997a78f05cd44d43b3afdf3966360374249
Instruction ID: 6b49eb94dcb93922d2d0cb346bfffb6d8d90ec90fbe5582e9fc751aa1a5551e4
Opcode Fuzzy Hash: aad69495228a45948ba7c2eb04a52997a78f05cd44d43b3afdf3966360374249
Instruction Fuzzy Hash: 98A011E22AA023BC320822203C0AC3A033CC0C8B203B0C80AF20280080EB8828002030

Uniqueness

Uniqueness Score: -1.00%

Function 0072BAC5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 6272d635a5f59a14c2c544bb972b1aeb5e630ec7b584a2f56fb348a9eb6acb31
Instruction ID: 6b49eb94dcb93922d2d0cb346bfffb6d8d90ec90fbe5582e9fc751aa1a5551e4
Opcode Fuzzy Hash: 6272d635a5f59a14c2c544bb972b1aeb5e630ec7b584a2f56fb348a9eb6acb31
Instruction Fuzzy Hash: 98A011E22AA023BC320822203C0AC3A033CC0C8B203B0C80AF20280080EB8828002030

Uniqueness

Uniqueness Score: -1.00%

Function 0072BABB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAA3

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 90e8958a5da8869f8846ea2635897b98f4b8e857ce739b19e41c76f7b729d32a
Instruction ID: 6b49eb94dcb93922d2d0cb346bfffb6d8d90ec90fbe5582e9fc751aa1a5551e4
Opcode Fuzzy Hash: 90e8958a5da8869f8846ea2635897b98f4b8e857ce739b19e41c76f7b729d32a
Instruction Fuzzy Hash: 98A011E22AA023BC320822203C0AC3A033CC0C8B203B0C80AF20280080EB8828002030

Uniqueness

Uniqueness Score: -1.00%

Function 00711B1B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,?), ref: 00711B30

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 93bcecbeefd04b6daeca1a831d35cb242925cc4427599a3e5f7eea7104fe0146
Instruction ID: 4b938cd73092c2ba26685cba2908db370ba807ea15bc923d184a0e52c4fb7356
Opcode Fuzzy Hash: 93bcecbeefd04b6daeca1a831d35cb242925cc4427599a3e5f7eea7104fe0146
Instruction Fuzzy Hash: 73C01270008200EFCB05CF08E848D1ABBA2FB92311B00C458F094CA031D330D864CB26

Uniqueness

Uniqueness Score: -1.00%

Function 0072BAF2 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0072BAFA

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a8dfb01f2b872e10e192ab123d6521751d92173a48d4ca51e3b08b37f51eb1ac
Instruction ID: 8138945572fd125a3f13daa77f4d4ed3a22948c9edf90175d8378471a799a8b9
Opcode Fuzzy Hash: a8dfb01f2b872e10e192ab123d6521751d92173a48d4ca51e3b08b37f51eb1ac
Instruction Fuzzy Hash: 97A002E77EB152BC714962517D0BC7F432CC4C5F217B0855EF590C4481AB883D954431

Uniqueness

Uniqueness Score: -1.00%

Function 00711B39 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 00711B4A

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 8a33d58c056ed6e2de945f22f88cb14c0e0cea4b21b0b69f7ff1ce7a7618d021
Instruction ID: bd87873daf351afcb1b6f6a29d8b104e88526bc082a85e9b704c5c56bffcec4a
Opcode Fuzzy Hash: 8a33d58c056ed6e2de945f22f88cb14c0e0cea4b21b0b69f7ff1ce7a7618d021
Instruction Fuzzy Hash: E9C04C70104201EFC745DF08D988C16BBA5FB91341B41C468F0858B431D734D894CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00713D79 Relevance: 1.5, APIs: 1, Instructions: 5fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0071E8D6), ref: 00713D7C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 746ffe9fbbcc5d74829077998db03ccb70f65b4430fe946a7d3622725ad5d2f4
Instruction ID: 8542cca628ca608348d25ccadd56b2ea29a61426d2bc9e2843482bb37b18449c
Opcode Fuzzy Hash: 746ffe9fbbcc5d74829077998db03ccb70f65b4430fe946a7d3622725ad5d2f4
Instruction Fuzzy Hash: 9AA001346011058B9B161B21DE09A097AAAAE4669579980AAA50988072DB2A8CA3EA15

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00728590 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 275windowfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0072859A

Part of subcall function 00711B78: GetDlgItem.USER32(00000000,00003021), ref: 00711BBC
Part of subcall function 00711B78: SetWindowTextW.USER32(00000000,00742668), ref: 00711BD2

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0072861B
EndDialog.USER32(?,00000006), ref: 0072862E
GetDlgItem.USER32(?,0000006C), ref: 0072864A
SetFocus.USER32(00000000), ref: 00728651

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

Part of subcall function 00711B1B: SetDlgItemTextW.USER32(?,?,?), ref: 00711B30

SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 007286C3
FindFirstFileW.KERNEL32(?,?), ref: 007286E3
FindClose.KERNEL32(00000000,?,00000000,00000000,00000000,00000099,?,?,00000000), ref: 00728786
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0072880D

Part of subcall function 00711170: _wcslen.LIBCMT ref: 0071117B

Strings

REPLACEFILEDLG, xrefs: 007285AF
%s %s, xrefs: 007287C9, 007288FA

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Item$MessageSend$FindText_wcslen$CloseDialogFileFirstFocusH_prolog3_Window
String ID: %s %s$REPLACEFILEDLG
API String ID: 485132379-439456425
Opcode ID: 3b81e1db7fb96b2defa300788d6ec38896c34c756e2d77557f23f1444aba0711
Instruction ID: 2e9ffa4bbc4a3b2e53b841cc27e2849cff0e7e5d0311184a3d013358878e10c4
Opcode Fuzzy Hash: 3b81e1db7fb96b2defa300788d6ec38896c34c756e2d77557f23f1444aba0711
Instruction Fuzzy Hash: D8A1BF71901228EAEB21EB64DD4EFEE777CAF15700F404095F60AA61C2DB796F84CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0073AEFE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0073B044

Strings

1#INF, xrefs: 0073C251
1#SNAN, xrefs: 0073C243
1#QNAN, xrefs: 0073C24A
1#IND, xrefs: 0073C23C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 13d80dfb2e4b0e971d86a7eaeca2c30be889764eeed32e021bae983e22b02abd
Instruction ID: 717baacda62612948b38826ab4f997024821d5958c740514a9fe411decef8bfd
Opcode Fuzzy Hash: 13d80dfb2e4b0e971d86a7eaeca2c30be889764eeed32e021bae983e22b02abd
Instruction Fuzzy Hash: 0AC24F71E086298FEB25CF28DD447EAB7B5EB44305F1441EAD54DE7242E778AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 0072D242 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0072D24E
IsDebuggerPresent.KERNEL32 ref: 0072D31A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0072D33A
UnhandledExceptionFilter.KERNEL32(?), ref: 0072D344

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f11d94383c2b78f9f1fa3ad20b20060a4db5521d588e3c66e26ff7a8d5105af3
Instruction ID: b2f8febeccfc46ae520e419ef51bd10e64c48c9980199563d81d04b519d31406
Opcode Fuzzy Hash: f11d94383c2b78f9f1fa3ad20b20060a4db5521d588e3c66e26ff7a8d5105af3
Instruction Fuzzy Hash: 3B312975D0522CDBDB20DFA4D9897CCBBB8BF18300F1040AAE50DAB250EB749A85CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00712E6F Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00712E73
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 00712E94
_wcslen.LIBCMT ref: 00712EA3
LocalFree.KERNEL32(?), ref: 00712EB6

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage_wcslen
String ID:
API String ID: 991192900-0
Opcode ID: 8d0874c33c7812dfdd66abcddba79624584323d8d16512759e2f59e46d015d7d
Instruction ID: bafa8d53003292c25045a85a8913a9576eafeb35df9bbef32f42309b3b5ec975
Opcode Fuzzy Hash: 8d0874c33c7812dfdd66abcddba79624584323d8d16512759e2f59e46d015d7d
Instruction Fuzzy Hash: D1F08279610204FBEB049BA5AD09DFF77AC9F85740B10C059FA01A61A2CB789E62D678

Uniqueness

Uniqueness Score: -1.00%

Function 0072BC1D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,0072BB62,0000001C,0072BD57,00000000,?,?,?,?,?,?,?,0072BB62,00000004,0076B520,0072BDE7), ref: 0072BC2E
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,0072BB62,00000004,0076B520,0072BDE7), ref: 0072BC49

Strings

D, xrefs: 0072BC3D

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: fb5d00a0ce49907c84b60feb4a31a3085f42c37b9ca364bd32e9637c79e7928e
Instruction ID: 6414c41eca7a3387c813acc0753aa713c1f7ef892da7decfee01b740d00f0503
Opcode Fuzzy Hash: fb5d00a0ce49907c84b60feb4a31a3085f42c37b9ca364bd32e9637c79e7928e
Instruction Fuzzy Hash: E0012B72600119ABDB14DE29DC05BDE7BA9AFC4324F0CC221FD19D7150DB3CDC528690

Uniqueness

Uniqueness Score: -1.00%

Function 007312B4 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0072C17E), ref: 007313AC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0072C17E), ref: 007313B6
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0072C17E), ref: 007313C3

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: fd0cf6a93ef8eeb93ebdd8f88f355b4aa733f88d9538a16ddfb8d5fe28c35d36
Instruction ID: 5517682341979b994f3a9cfba37066f7cdb8721ed478743fd51964b5c6fb04db
Opcode Fuzzy Hash: fd0cf6a93ef8eeb93ebdd8f88f355b4aa733f88d9538a16ddfb8d5fe28c35d36
Instruction Fuzzy Hash: F931C27590122CABCB21DF64D8897DDBBB8BF18310F5081EAE81CA7251EB749F818F55

Uniqueness

Uniqueness Score: -1.00%

Function 007386E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0073887B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 32debe6d0bebb4eccefea32b292f76efcf27135827cb0137d12c751450231ed1
Instruction ID: a78434dfdb10656d1a2e575931820ddda92e754e1971f0e9760637fbf5b1e873
Opcode Fuzzy Hash: 32debe6d0bebb4eccefea32b292f76efcf27135827cb0137d12c751450231ed1
Instruction Fuzzy Hash: B1313771800249AFEB64DE78CC84EFB7BBEDB81314F2401A8F41897253EA389D408B50

Uniqueness

Uniqueness Score: -1.00%

Function 0073AA50 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdb16e9976882d12b85e4a6a493654685016078fef5a2c446867b91eb1d5b38
Instruction ID: bc4923a877e87f1c647a893b02d97e55e6727bc8d24fdf2b5b5b01b3e2e67498
Opcode Fuzzy Hash: bfdb16e9976882d12b85e4a6a493654685016078fef5a2c446867b91eb1d5b38
Instruction Fuzzy Hash: 80026C72E00219AFEF14CFA8C8816ADF7F1EF88314F258269D859E7345D735AA418B91

Uniqueness

Uniqueness Score: -1.00%

Function 00726CF5 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00726D2B
GetNumberFormatW.KERNEL32(00000400,00000000,?,0074E6E4,?,?), ref: 00726D74

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 4975e1b2f6425825dc6ce5d9020a23d645c910334ac59fc3261e672892942186
Instruction ID: f7f004eeb7ac53f35ed2388652b9d6b8bff0d44fab00bb332eaf788600d89609
Opcode Fuzzy Hash: 4975e1b2f6425825dc6ce5d9020a23d645c910334ac59fc3261e672892942186
Instruction Fuzzy Hash: 62117979211308ABDB00DF64DC01FEB73B8EF18710F00942ABA02A7291D778A905CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0073EE32 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0073EE2D,?,?,00000008,?,?,0073EACD,00000000), ref: 0073F05F

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ba130b7acad801d4e4ff625e666d9398554b219755e2eb975f82a6a145912142
Instruction ID: 4deec8592fd9dfd7104bb38cdad9ee53b5f69b093e978c02f891dfaabad90010
Opcode Fuzzy Hash: ba130b7acad801d4e4ff625e666d9398554b219755e2eb975f82a6a145912142
Instruction Fuzzy Hash: DEB12D71510609DFE719CF28C48AB657BE0FF45364F258668E899CF2E2C379E991CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0072D05E Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0072D074

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 78bc3ba12fddb706475d3fe5d3d2ec348959c46ff27de9cc2bbbc95082763a31
Instruction ID: bdfa882bc47def40d605ba8ec4c4b828d61033bf9738e3ae88b129503e8d5416
Opcode Fuzzy Hash: 78bc3ba12fddb706475d3fe5d3d2ec348959c46ff27de9cc2bbbc95082763a31
Instruction Fuzzy Hash: D8515CB1910219CFEB29CFA9E8857AAB7F4FB45320F15842AD405EB650D379ED41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00715032 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00715063

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 7892db4a94b2b0add24bb30070114f6e42722269bff62bdf16d7ae097f967c41
Instruction ID: 6d5c03bb4cab4a44ca07da53821925957953bfbdb8f6b7c267a5a350a308562a
Opcode Fuzzy Hash: 7892db4a94b2b0add24bb30070114f6e42722269bff62bdf16d7ae097f967c41
Instruction Fuzzy Hash: 9D012874A00308CBD768CF78EC41ADD77E2BB89324F608619E91A933E1D778A9458B48

Uniqueness

Uniqueness Score: -1.00%

Function 0072D3E5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D400,0072CE75), ref: 0072D3EA

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f8ffe14ed39ac6d02485ef7e023e6f46b5fba56c18b779ac9d1e6ff03224e4e6
Instruction ID: fe999e55c322345c5e912f7a842bcdc7bd5ab596ecf3819d844f9fc4707fb8a0
Opcode Fuzzy Hash: f8ffe14ed39ac6d02485ef7e023e6f46b5fba56c18b779ac9d1e6ff03224e4e6
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 007393D0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 007393D0

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a25084160565824a2fd62e7cce49df937521ace26cf01ca2b925ccb7b6b380df
Instruction ID: 106e20a8e8801dc9e75a0a24db12781b9e48e3f274d54ccfb4c95d501590dccd
Opcode Fuzzy Hash: a25084160565824a2fd62e7cce49df937521ace26cf01ca2b925ccb7b6b380df
Instruction Fuzzy Hash: 13A011302003008BA3008F32AE082883AAAAA03280B00C02AE002C0230EB2880A08F08

Uniqueness

Uniqueness Score: -1.00%

Function 00718D89 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10cbf7604baf462b1d0f7a410d3f9693d953a90b2e1a079bcb30284bb94946d4
Instruction ID: fc179c630938822ea5f8f8f75cbedb8242d9c25aa51031652af827fd69e780c4
Opcode Fuzzy Hash: 10cbf7604baf462b1d0f7a410d3f9693d953a90b2e1a079bcb30284bb94946d4
Instruction Fuzzy Hash: 62525A726187018FC718CF19C891A6AF7E1FFCC304F498A2DE5869B245D334EA59CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00720870 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50449acbe6f4897524f01571dc49c54ba359814abd1db9f6757c816ad239f25f
Instruction ID: 1fe14c985d5543bf1fc272dd10fc1bac799689ef4be5443368b1aa3068e932a3
Opcode Fuzzy Hash: 50449acbe6f4897524f01571dc49c54ba359814abd1db9f6757c816ad239f25f
Instruction Fuzzy Hash: 0D22D571504325DFC724EF28FC9442AB7E1FB84320F154A1DE492A73A2D778A9458FE6

Uniqueness

Uniqueness Score: -1.00%

Function 0071837D Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afdc15755f878ab6e0f407b24023f1a31475f18d3f852d5dbbca84b015a20957
Instruction ID: 58660afdefd67ed88f1b15b195bebe663a6e6368bfbfcad8ef3411b3f7a17310
Opcode Fuzzy Hash: afdc15755f878ab6e0f407b24023f1a31475f18d3f852d5dbbca84b015a20957
Instruction Fuzzy Hash: 20D1717450C3C58FC708CF19F8908AABBF0AB9A301F08895EF5D587352C679E615CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 007327A7 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce8fbc00be22a39b2e0a3e27034b02679f00b277de82e2fa071cb9c18e16970
Instruction ID: 111a5fa143de0778ef6faa4ed3ca58e3045bbe40608aba97f6c2e1c7b614a0fc
Opcode Fuzzy Hash: 1ce8fbc00be22a39b2e0a3e27034b02679f00b277de82e2fa071cb9c18e16970
Instruction Fuzzy Hash: 17617A71700719A6FE389A2848557FE23D4EB51B50F14451AE983EF283D61DFE83C356

Uniqueness

Uniqueness Score: -1.00%

Function 00732578 Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 5a2036721fb620c1bd57bc5161464500953a4aad66de26475828deba15d09305
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 1A517771201B48D7FF34596C846B7BE23D59F15300F18095AE982D7AA3DA0DDF438762

Uniqueness

Uniqueness Score: -1.00%

Function 00718934 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e74dba8e03739ccc2345c1b1eec8ba989529b5d9f806db69d62970ca39893fb
Instruction ID: 26f740711fcdbd7d4e52abe278410ea1c1023c983247108546efdaad156452e3
Opcode Fuzzy Hash: 8e74dba8e03739ccc2345c1b1eec8ba989529b5d9f806db69d62970ca39893fb
Instruction Fuzzy Hash: 535116715083D58FC711DF2CD4448AEBFE0AF9A324F09499AE4E54B182D639EB89CB53

Uniqueness

Uniqueness Score: -1.00%

Function 00712606 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7390a92b67c97bb6386d99c391e49f1c7c7cf1a0797bcbd692ebf4bf6df5b084
Instruction ID: a036bbe7ae1bf30c4deef68af3c9693e09b967e293d7379937fe79384cb4ad1c
Opcode Fuzzy Hash: 7390a92b67c97bb6386d99c391e49f1c7c7cf1a0797bcbd692ebf4bf6df5b084
Instruction Fuzzy Hash: 2D41F870501B11CFC71ADF38D5459D6B7E0FF4A700B0248AFD06A8B6A2EB34EA48DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0072E430 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 735a08266316c2123a856fbf262dd101f6ed4f299f026c90b3906126cc150f93
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9311507B3010F187D614EA3DF8B45B7E795EBC6321F2C837AF0418B754D22AD9459640

Uniqueness

Uniqueness Score: -1.00%

Function 00717B5C Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 240COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00717B9C

Part of subcall function 00714C1E: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00714C31

Part of subcall function 0071BBC8: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00717BB8,?,00000000,00000000,?,?,?,00717BB8,?,?,00000050), ref: 0071BBE5

SetDlgItemTextW.USER32(?,0074E16C,?), ref: 00717C16
GetWindowRect.USER32(?,?), ref: 00717C4C
GetClientRect.USER32(?,?), ref: 00717C58
GetWindowLongW.USER32(?,000000F0), ref: 00717D03
GetWindowRect.USER32(?,?), ref: 00717D33
SetWindowTextW.USER32(?,?), ref: 00717D62
GetSystemMetrics.USER32(00000008), ref: 00717D6A
GetWindow.USER32(?,00000005), ref: 00717D75
GetWindowRect.USER32(00000000,?), ref: 00717DA5
GetWindow.USER32(00000000,00000002), ref: 00717E17

Strings

d, xrefs: 00717C78
$%s:, xrefs: 00717B85
lt, xrefs: 00717BD1
CAPTION, xrefs: 00717D4A

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_swprintf
String ID: $%s:$CAPTION$d$lt
API String ID: 3208934588-3387979657
Opcode ID: 0d2a3ba9effc5b0d46995c265d4886f8deb3e6478f276ec6110a5c6f4c6aeae7
Instruction ID: 609c2d70e9a0a46c0926654f7f04330f1c86756f8eb6bbdc4dcbcfd6298ea172
Opcode Fuzzy Hash: 0d2a3ba9effc5b0d46995c265d4886f8deb3e6478f276ec6110a5c6f4c6aeae7
Instruction Fuzzy Hash: FE81ADB2108305AFD315DF68CD89A6FBBF8EB89714F00491DF98593291D778E849CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00739EC2 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00739F06

Part of subcall function 00739AA1: _free.LIBCMT ref: 00739ABE
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739AD0
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739AE2
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739AF4
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B06
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B18
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B2A
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B3C
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B4E
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B60
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B72
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B84
Part of subcall function 00739AA1: _free.LIBCMT ref: 00739B96

_free.LIBCMT ref: 00739EFB

Part of subcall function 00736B34: RtlFreeHeap.NTDLL(00000000,00000000,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?), ref: 00736B4A
Part of subcall function 00736B34: GetLastError.KERNEL32(?,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?,?), ref: 00736B5C

_free.LIBCMT ref: 00739F1D
_free.LIBCMT ref: 00739F32
_free.LIBCMT ref: 00739F3D
_free.LIBCMT ref: 00739F5F
_free.LIBCMT ref: 00739F72
_free.LIBCMT ref: 00739F80
_free.LIBCMT ref: 00739F8B
_free.LIBCMT ref: 00739FC3
_free.LIBCMT ref: 00739FCA
_free.LIBCMT ref: 00739FE7
_free.LIBCMT ref: 00739FFF

Strings

(t, xrefs: 00739FAE
`t, xrefs: 00739ED8

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: (t$`t
API String ID: 161543041-271191166
Opcode ID: edc442dd54fcb3e330f89baff9a217648822f48f90856868a0b363a8ee5d7d06
Instruction ID: 3959d68ab24d4a390fcb8feff613267a2eb72b9af1db62a72f1efcc44e1f4664
Opcode Fuzzy Hash: edc442dd54fcb3e330f89baff9a217648822f48f90856868a0b363a8ee5d7d06
Instruction Fuzzy Hash: FA311F72605606EFFB21AB39D849F56B3E9AF00310F248469F559D7593DBBAEC40CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0072CBE7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0076B878,00000FA0,?,?,0072CBC5), ref: 0072CBF3
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,0072CBC5), ref: 0072CBFE
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0072CBC5), ref: 0072CC0F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0072CC21
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0072CC2F
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,0072CBC5), ref: 0072CC52
DeleteCriticalSection.KERNEL32(0076B878,00000007,?,?,0072CBC5), ref: 0072CC75
CloseHandle.KERNEL32(00000000,?,?,0072CBC5), ref: 0072CC85

Strings

kernel32.dll, xrefs: 0072CC0A
WakeAllConditionVariable, xrefs: 0072CC27
SleepConditionVariableCS, xrefs: 0072CC1B
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0072CBF9

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: ee423e89e176646a6e07bd2c94fcb7fc9398253e2f1c92b6407c2d498c5881f8
Instruction ID: 6b57574b06647fdeb3d76cc745017cb4b54c48b82f32a3ea7d9aafdcc3a4cbd9
Opcode Fuzzy Hash: ee423e89e176646a6e07bd2c94fcb7fc9398253e2f1c92b6407c2d498c5881f8
Instruction Fuzzy Hash: FE01F5B4640722ABDA312B787D0DA2A369CDF93B417058122FD09D3160CBBCC881C679

Uniqueness

Uniqueness Score: -1.00%

Function 00736671 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00736685

Part of subcall function 00736B34: RtlFreeHeap.NTDLL(00000000,00000000,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?), ref: 00736B4A
Part of subcall function 00736B34: GetLastError.KERNEL32(?,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?,?), ref: 00736B5C

_free.LIBCMT ref: 00736691
_free.LIBCMT ref: 0073669C
_free.LIBCMT ref: 007366A7
_free.LIBCMT ref: 007366B2
_free.LIBCMT ref: 007366BD
_free.LIBCMT ref: 007366C8
_free.LIBCMT ref: 007366D3
_free.LIBCMT ref: 007366DE
_free.LIBCMT ref: 007366EC

Strings

0St, xrefs: 0073667C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: 0St
API String ID: 776569668-500467504
Opcode ID: 675e127613e9f3e1ac084db84645ebe6509930cae5ca5cd378f9e71d2af770db
Instruction ID: 958fa2375d2cddab4533bd11b2875d9aefadfe3102dc35769061ec3771db5918
Opcode Fuzzy Hash: 675e127613e9f3e1ac084db84645ebe6509930cae5ca5cd378f9e71d2af770db
Instruction Fuzzy Hash: BA11A4B6611148FFDF01EF54C846CD97BA5EF04350FA181A1BA088B623DA36DA51DF90

Uniqueness

Uniqueness Score: -1.00%

Function 007302A4 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 007303C3
___TypeMatch.LIBVCRUNTIME ref: 007304D1
_UnwindNestedFrames.LIBCMT ref: 00730623
CallUnexpected.LIBVCRUNTIME ref: 0073063E
_abort.LIBCMT ref: 00730643

Strings

csm, xrefs: 0073034E
csm, xrefs: 007303FA
TFt, xrefs: 007303BA
csm, xrefs: 007302E1

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: TFt$csm$csm$csm
API String ID: 322700389-1365524959
Opcode ID: f1314c2b585428b52dbbfdddc9644307fe7d8641bd28489ac6ea4a85e4f80c58
Instruction ID: e6b6b44f2a5eb7140e033bb2875b4d6154207f80a15f53901c6726d559d6466e
Opcode Fuzzy Hash: f1314c2b585428b52dbbfdddc9644307fe7d8641bd28489ac6ea4a85e4f80c58
Instruction Fuzzy Hash: D2B18771800219EFEF15DFA4D9A59AEBBB5BF14310F14416AE815AB203D338DA61CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 007249E2 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007249E9

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

_wcslen.LIBCMT ref: 00724A4B
_wcslen.LIBCMT ref: 00724A6A
_wcslen.LIBCMT ref: 00724A86
GlobalAlloc.KERNEL32(00000040,?,00000000,007434A8,00000000,?,00000000,?,<html>,00000006,<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>,?), ref: 00724AFD

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00724A46, 00724A52
<html>, xrefs: 00724A2F
</html>, xrefs: 00724A80, 00724A85, 00724A8D
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00724A07

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _wcslen$AllocGlobalH_prolog3_
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 1478282658-1533471033
Opcode ID: ee4ab26a659bf812ef567a501d8dce0a16e63ca1eb4421811a161e8435269aef
Instruction ID: b32c43a6c97ebfdf8469282c4f4423ba9e035a41d6ccc08e04efaa51bea5635a
Opcode Fuzzy Hash: ee4ab26a659bf812ef567a501d8dce0a16e63ca1eb4421811a161e8435269aef
Instruction Fuzzy Hash: 7051B571900258EFDB05EBA4DC49BEEBB78EF15310F100019E505BB182DB785E81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0072A6F6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0072A724
GetClassNameW.USER32(00000000,?,00000080), ref: 0072A750

Part of subcall function 0071BF3C: CompareStringW.KERNEL32(00000400,00001001,D5FC40FB,000000FF,?,000000FF,007153ED,0000002E,-00000002,00000000,?,00000000,?,00000008,?,?), ref: 0071BF52

GetWindowLongW.USER32(00000000,000000F0), ref: 0072A76C
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0072A783
GetObjectW.GDI32(00000000,00000018,?), ref: 0072A797
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0072A7C0
DeleteObject.GDI32(00000000), ref: 0072A7C7
GetWindow.USER32(00000000,00000002), ref: 0072A7D0

Strings

STATIC, xrefs: 0072A756

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 17c22fec804c148632c56b42a11c288a0057a38c24556f329e30247a7b596ae5
Instruction ID: 3b16d7c6081bda5307ee40eda4183ebb8b95dce5b04e622ec6096ecdeed76b80
Opcode Fuzzy Hash: 17c22fec804c148632c56b42a11c288a0057a38c24556f329e30247a7b596ae5
Instruction Fuzzy Hash: C5210AB2144764BFE2226B24EC4AFBF77ACAF55710F004015FA42A6292D77C890546AA

Uniqueness

Uniqueness Score: -1.00%

Function 00736F4A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00736FD5
__alldvrm.LIBCMT ref: 007371D6
__alldvrm.LIBCMT ref: 007371F8

Strings

}(s, xrefs: 00736F60, 00736FBB, 00736FD4, 0073715A
}(s, xrefs: 00736F54
}(s, xrefs: 00737197

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }(s$}(s$}(s
API String ID: 1036877536-2310250345
Opcode ID: 8881f98e90fdfbbaba227011bdafa62b0478987616c577047395685bcd86fc10
Instruction ID: 70406361624fb42a4df18484e1919681e93c93055bedda208c0d372266b4b595
Opcode Fuzzy Hash: 8881f98e90fdfbbaba227011bdafa62b0478987616c577047395685bcd86fc10
Instruction Fuzzy Hash: 7BA127B2A0838A9FFB39CF18C8817AEBBE5EF55350F2441ADE5959B243D23C8941C750

Uniqueness

Uniqueness Score: -1.00%

Function 0072514E Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00725155
_wcslen.LIBCMT ref: 00725287

Strings

, xrefs: 0072527A, 00725286, 0072528E
</style>, xrefs: 007252B5
<style>, xrefs: 00725298
<br>, xrefs: 00725269
</p>, xrefs: 00725253

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_wcslen
String ID: $</p>$</style>$<br>$<style>
API String ID: 3746244732-3393513139
Opcode ID: 39750edbb65401771d3c8ef73579f28468a3e1284ccdcfef6eed93603a76a457
Instruction ID: a8b3c8bf96529b0eb8dcc06f97944c4b44eee0f02f7e1621add20ad71d9daa9b
Opcode Fuzzy Hash: 39750edbb65401771d3c8ef73579f28468a3e1284ccdcfef6eed93603a76a457
Instruction Fuzzy Hash: 37515AA5B01B32D7DB309A14A8217BA73E1BF64355F944019FDC59B2C1E77D9E81C390

Uniqueness

Uniqueness Score: -1.00%

Function 00727630 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00711B78: GetDlgItem.USER32(00000000,00003021), ref: 00711BBC
Part of subcall function 00711B78: SetWindowTextW.USER32(00000000,00742668), ref: 00711BD2

EndDialog.USER32(?,00000001), ref: 00727680
SendMessageW.USER32(?,00000080,00000001,0001044F), ref: 007276A7
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,00050E1A), ref: 007276C0
GetDlgItem.USER32(?,00000065), ref: 007276DC
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 007276F0
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00727706

Strings

LICENSEDLG, xrefs: 00727644

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: MessageSend$Item$DialogTextWindow
String ID: LICENSEDLG
API String ID: 3077722735-2177901306
Opcode ID: db0d7a3942ab9054995aec991f1c403f8540e8b956f40fbc7255e082064ecfb6
Instruction ID: 20fc52b36a002515f3b6d157f0b23304c5d193827ab150608236c2668965783e
Opcode Fuzzy Hash: db0d7a3942ab9054995aec991f1c403f8540e8b956f40fbc7255e082064ecfb6
Instruction Fuzzy Hash: 8D2106B1208724BFD2156F69FD0CE7B3B6CEB57785F018014F242E51A1C7AE9901C6BA

Uniqueness

Uniqueness Score: -1.00%

Function 00736765 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00731C52,?,?,?,007316CD,00000050,?), ref: 00736769
_free.LIBCMT ref: 0073679C
_free.LIBCMT ref: 007367C4
SetLastError.KERNEL32(00000000,?), ref: 007367D1
SetLastError.KERNEL32(00000000,?), ref: 007367DD
_abort.LIBCMT ref: 007367E3

Strings

ht, xrefs: 007367B7

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID: ht
API String ID: 3160817290-696075778
Opcode ID: 535df997cc940f4215a00ffcba76eb5518e8ff3ab133ae35f58d1314e890a5a8
Instruction ID: 1f11cfced43fd444d11b405fe8c83263a8f25e37bbf76078d56faeb6d68fe652
Opcode Fuzzy Hash: 535df997cc940f4215a00ffcba76eb5518e8ff3ab133ae35f58d1314e890a5a8
Instruction Fuzzy Hash: 59F0F436140600BAF2123324AC4EB2B1599ABC3739F608115F614D2693FF2D88028525

Uniqueness

Uniqueness Score: -1.00%

Function 007158D4 Relevance: 10.7, APIs: 7, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007158DB
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,00000030), ref: 00715910
GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 0071594F
_wcslen.LIBCMT ref: 0071595F
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,00000030), ref: 007159DC
GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00715A1E
_wcslen.LIBCMT ref: 00715A2E

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FullNamePath$_wcslen$H_prolog3_
String ID:
API String ID: 840513527-0
Opcode ID: 4d1e7c7793d33a35a4bad07517b14683df309d49ee22f88ae3ac90f6bac33ab7
Instruction ID: f4b1cf5e0937d22580bbaa3142ec388e88daaeda6426e5afc327632c29f9f0e4
Opcode Fuzzy Hash: 4d1e7c7793d33a35a4bad07517b14683df309d49ee22f88ae3ac90f6bac33ab7
Instruction Fuzzy Hash: 08614F71E00608EADB18DFACD985AEEBBB9EFC4710F544219F411F7291DB789980CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0073C992 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0073D107,?,00000000,?,00000000,00000000), ref: 0073C9D4
__fassign.LIBCMT ref: 0073CA4F
__fassign.LIBCMT ref: 0073CA6A
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 0073CA90
WriteFile.KERNEL32(?,?,00000000,0073D107,00000000,?,?,?,?,?,?,?,?,?,0073D107,?), ref: 0073CAAF
WriteFile.KERNEL32(?,?,00000001,0073D107,00000000,?,?,?,?,?,?,?,?,?,0073D107,?), ref: 0073CAE8

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: def721eed56b483f6a0549cc88a56b8aee87f28877ac8357a3e852a8a39be722
Instruction ID: ee01740c1b9c77bf863833d61b9a4f4b4f2c5b75f2b984631f123e026de91116
Opcode Fuzzy Hash: def721eed56b483f6a0549cc88a56b8aee87f28877ac8357a3e852a8a39be722
Instruction Fuzzy Hash: BA51D6B0A002499FEB11CFA8DC85AEEFBF8EF09310F14811AE955F7252E734A941CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00725335 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0072533C
ShowWindow.USER32(?,00000000,00000038), ref: 00725364
GetWindowRect.USER32(?,?), ref: 007253A8
ShowWindow.USER32(?,00000005,?,00000000), ref: 00725443
ShowWindow.USER32(00000000,00000005), ref: 00725464

Strings

RarHtmlClassName, xrefs: 00725404

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Window$Show$H_prolog3_Rect
String ID: RarHtmlClassName
API String ID: 950582801-1658105358
Opcode ID: 3b19b8310cabc550cded262660088c0a3afc092f8153132c5bc369401350a5bd
Instruction ID: b67e06f6675a04347cfeb1fa726c2ecd3ae6fb62969ec4cc6e56b5d97f04930b
Opcode Fuzzy Hash: 3b19b8310cabc550cded262660088c0a3afc092f8153132c5bc369401350a5bd
Instruction Fuzzy Hash: 7D419FB1900218EFDF15EFA4ED89AAEBBB8FF48301F148155F945AB152DB78D840CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00739C44 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00739C08: _free.LIBCMT ref: 00739C31

_free.LIBCMT ref: 00739C92

Part of subcall function 00736B34: RtlFreeHeap.NTDLL(00000000,00000000,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?), ref: 00736B4A
Part of subcall function 00736B34: GetLastError.KERNEL32(?,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?,?), ref: 00736B5C

_free.LIBCMT ref: 00739C9D
_free.LIBCMT ref: 00739CA8
_free.LIBCMT ref: 00739CFC
_free.LIBCMT ref: 00739D07
_free.LIBCMT ref: 00739D12
_free.LIBCMT ref: 00739D1D

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b35873524a760c03ab9487437f634a877bcf59d48e38088abdb566b69e001564
Instruction ID: 16d453ba3835b61b63b865ee793b43d0099c26ed1a1b08b89dc2a76ef1d63c86
Opcode Fuzzy Hash: b35873524a760c03ab9487437f634a877bcf59d48e38088abdb566b69e001564
Instruction Fuzzy Hash: AA111271641704F6EAA0B770CC0BFCBB7DC6F04700F509D25B399E6553D6AAF5058A61

Uniqueness

Uniqueness Score: -1.00%

Function 007367E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0072C17E,0072C17E,?,00736938,00736BB1,?,?,0072D656,?,?,?,00000000,?,0072C08A,0072C17E,?), ref: 007367EE
_free.LIBCMT ref: 00736823
_free.LIBCMT ref: 0073684A
SetLastError.KERNEL32(00000000,?,0072C17E), ref: 00736857
SetLastError.KERNEL32(00000000,?,0072C17E), ref: 00736860

Strings

ht, xrefs: 0073683E

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorLast$_free
String ID: ht
API String ID: 3170660625-696075778
Opcode ID: 5d1627e32a489c0d528e53e7a03f58c8306d84561db50d4f9ead6cc2779806ca
Instruction ID: f2543a41273d0d1ad0275adc2878b16b03bbc1f42a2e250b6176e63ed365bc6f
Opcode Fuzzy Hash: 5d1627e32a489c0d528e53e7a03f58c8306d84561db50d4f9ead6cc2779806ca
Instruction Fuzzy Hash: 2F01F976241600BBF21237646C4996B265AEBDA374F308039F605E21A3EF3DC8168465

Uniqueness

Uniqueness Score: -1.00%

Function 0072BB68 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0072BBE3,0072BB46,0072BDE7), ref: 0072BB7F
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0072BB95
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0072BBAA

Strings

ReleaseSRWLockExclusive, xrefs: 0072BB9F
AcquireSRWLockExclusive, xrefs: 0072BB8F
KERNEL32.DLL, xrefs: 0072BB7A

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: a57fdca50f0cb172cd9d7a6c5873454911a65dff845668d447a4ae160232d1ca
Instruction ID: 5e62c4d958ed6a8e775be1df8263d5d5b3166f8eecd76a0ff81340f43288c48d
Opcode Fuzzy Hash: a57fdca50f0cb172cd9d7a6c5873454911a65dff845668d447a4ae160232d1ca
Instruction Fuzzy Hash: 6EF0CDF63417339B4B314FA07CC5AA623C89A47761314453AE903E2159E76CCC92A6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00735EE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00735EFE

Part of subcall function 00736B34: RtlFreeHeap.NTDLL(00000000,00000000,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?), ref: 00736B4A
Part of subcall function 00736B34: GetLastError.KERNEL32(?,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?,?), ref: 00736B5C

_free.LIBCMT ref: 00735F10
_free.LIBCMT ref: 00735F23
_free.LIBCMT ref: 00735F34
_free.LIBCMT ref: 00735F45

Strings

0t, xrefs: 00735EF4

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: 0t
API String ID: 776569668-555663880
Opcode ID: e37f76660e996423f4107f4128d607b14997d17e8b92b28622ee9033207a0af0
Instruction ID: a105ec046a017e3ecc1c43f77d518c165f2a0ba15bdb9a939ab5e84307cd8dcf
Opcode Fuzzy Hash: e37f76660e996423f4107f4128d607b14997d17e8b92b28622ee9033207a0af0
Instruction Fuzzy Hash: 47F0B4B1901320DBE6016FA4BC068557760F70A730B25C506F402C3672C7BE48818F9C

Uniqueness

Uniqueness Score: -1.00%

Function 00737D00 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00732DD9,00732DD9,?,?,?,00737F51,00000001,00000001,54E85006), ref: 00737D5A
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00737F51,00000001,00000001,54E85006,?,?,?), ref: 00737DE0
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,54E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00737EDA
__freea.LIBCMT ref: 00737EE7

Part of subcall function 00736B6E: RtlAllocateHeap.NTDLL(00000000,0072C17E,?,?,0072D656,?,?,?,00000000,?,0072C08A,0072C17E,?,?,?,?), ref: 00736BA0

__freea.LIBCMT ref: 00737EF0
__freea.LIBCMT ref: 00737F15

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 9042f9d823d21795c258bef7531ff691a930504f2943363c205857e0ffed6b9c
Instruction ID: 50e8516dafed184369d681d3f4c4ba7e526d6a07ef36c2f6dcd80a31a6653399
Opcode Fuzzy Hash: 9042f9d823d21795c258bef7531ff691a930504f2943363c205857e0ffed6b9c
Instruction Fuzzy Hash: 3351F1B2654216ABFB398F60CC45EBF77A9EF44750F144A69FC04E6182EB38DC51C690

Uniqueness

Uniqueness Score: -1.00%

Function 007263C4 Relevance: 9.1, APIs: 6, Instructions: 102timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,D5FC40FB,?,?,?,?,007409B1,000000FF), ref: 00726413
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,?,007409B1,000000FF), ref: 00726422
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,007409B1,000000FF), ref: 00726430
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,007409B1,000000FF), ref: 0072643E
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032,?,?,?,?,007409B1,000000FF), ref: 00726459
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032,?,?,?,?,007409B1,000000FF), ref: 00726483

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific
String ID:
API String ID: 909090443-0
Opcode ID: 0d83105f1b4add630a3f061e098c61c20befe7ec4d7efe557c05257baf74d12a
Instruction ID: 0123741802d8a3d1d974b837046d1eef885f4914ad54c53fac5b9c332bcc7e2f
Opcode Fuzzy Hash: 0d83105f1b4add630a3f061e098c61c20befe7ec4d7efe557c05257baf74d12a
Instruction Fuzzy Hash: D2313DB650028CABDB21DF64DC45EEF77ACFB09710F40411AFA05D7191EB78AA48CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0072FF6A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0072FF61,0072FEEC,0072D444), ref: 0072FF78
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0072FF86
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0072FF9F
SetLastError.KERNEL32(00000000,0072FF61,0072FEEC,0072D444), ref: 0072FFF1

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d221a0fac3bb280721b02799f4e8f120c7285acb96f70134fe0d25ee7ee0739c
Instruction ID: cbd9125dd8ff3e6c91e5d1586a07dec1be5195ed9414610d48ba8775657091b7
Opcode Fuzzy Hash: d221a0fac3bb280721b02799f4e8f120c7285acb96f70134fe0d25ee7ee0739c
Instruction Fuzzy Hash: 4F018436219332EEB72627B47D8996A2BA5EF13774B20423BF214451F2EF5D4C119248

Uniqueness

Uniqueness Score: -1.00%

Function 00724D65 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00724D6C
_wcslen.LIBCMT ref: 00724E31
_wcslen.LIBCMT ref: 00724E7C

Strings

 , xrefs: 00724E77, 00724E83
<br>, xrefs: 00724E2C, 00724E38

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _wcslen$H_prolog3
String ID:  $<br>
API String ID: 1035939448-26742755
Opcode ID: 98ef713243bcbb226db1b63d939fba4db5cb0ce458368b53a071c56abb1ab81c
Instruction ID: bc4752b9794ea0448569783b3930d3c07c632593de7c0d3fc8892bf878496a57
Opcode Fuzzy Hash: 98ef713243bcbb226db1b63d939fba4db5cb0ce458368b53a071c56abb1ab81c
Instruction Fuzzy Hash: DE418131B00221DBEB24DF54E885A3D7332FB94704F61842DE5159F2C2EBB89992CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0072AE2D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0072AE34
SetEnvironmentVariableW.KERNEL32(sfxcmd,?,?,?,?,?,?,00000028), ref: 0072AE4C
SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 0072AEB7

Strings

sfxpar, xrefs: 0072AEB2
sfxcmd, xrefs: 0072AE47

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: EnvironmentVariable$H_prolog3_
String ID: sfxcmd$sfxpar
API String ID: 3605364767-3493335439
Opcode ID: ca04e71f376b0421ba53056fdde3947587b7981567aec43526f06796fd2e6975
Instruction ID: 3d1d5e6092576d350bae9ec3d85aa9959a89e20f0ae3c434ece620b1e098c000
Opcode Fuzzy Hash: ca04e71f376b0421ba53056fdde3947587b7981567aec43526f06796fd2e6975
Instruction Fuzzy Hash: 9A213BB0D00218EFCB15DFA8E9899EDB7B9EF08300F50441AF541B7341EB38AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00727745 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00727755
GetObjectW.GDI32(00000000,00000018,?), ref: 0072777A
DeleteObject.GDI32(00000000), ref: 007277AC
DeleteObject.GDI32(00000000), ref: 007277CF

Part of subcall function 00725C5C: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,007277A5,00000066), ref: 00725C6F
Part of subcall function 00725C5C: SizeofResource.KERNEL32(00000000,?,?,?,007277A5,00000066), ref: 00725C86
Part of subcall function 00725C5C: LoadResource.KERNEL32(00000000,?,?,?,007277A5,00000066), ref: 00725C9D
Part of subcall function 00725C5C: LockResource.KERNEL32(00000000,?,?,?,007277A5,00000066), ref: 00725CAC
Part of subcall function 00725C5C: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,007277A5,00000066), ref: 00725CC7
Part of subcall function 00725C5C: GlobalLock.KERNEL32(00000000,?,?,?,?,?,007277A5,00000066), ref: 00725CD8
Part of subcall function 00725C5C: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00725D41
Part of subcall function 00725C5C: GlobalUnlock.KERNEL32(00000000), ref: 00725D60
Part of subcall function 00725C5C: GlobalFree.KERNEL32(00000000), ref: 00725D67

Strings

], xrefs: 00727782

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 56bfe99b7aab94077a89c60662f15724f0ca4587097de22cbb6e50e0e5c7685a
Instruction ID: a91385c0cc87b43641e5b58120ee473daf83b00e0493f3e32e34f5e098b90ea9
Opcode Fuzzy Hash: 56bfe99b7aab94077a89c60662f15724f0ca4587097de22cbb6e50e0e5c7685a
Instruction Fuzzy Hash: F101D232544B22E7C7122BA4AE0AA7F367AAB90B56F040010F901B7390DBBD8D0586B1

Uniqueness

Uniqueness Score: -1.00%

Function 00735447 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,007353F8,007363DC,?,00735398,007363DC,0074C1F0,0000000C,007354EF,007363DC,00000002), ref: 00735467
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0073547A
FreeLibrary.KERNEL32(00000000,?,?,?,007353F8,007363DC,?,00735398,007363DC,0074C1F0,0000000C,007354EF,007363DC,00000002,00000000), ref: 0073549D

Strings

CorExitProcess, xrefs: 00735472
mscoree.dll, xrefs: 00735460

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e60ced80152f0f9c19c83eea35c54a1f2b6f97c317ec2c567958ed69a9759179
Instruction ID: d7c5b38bb2c7087cdfb274aecfdd39309b98602d21c0bd91b19179303dab570d
Opcode Fuzzy Hash: e60ced80152f0f9c19c83eea35c54a1f2b6f97c317ec2c567958ed69a9759179
Instruction Fuzzy Hash: 27F0C235A0060CBBDB159F90EC09BAEBFF4EF05766F408065F805A2162EB7C4E91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00718C09 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0071A473: __EH_prolog3_GS.LIBCMT ref: 0071A47A
Part of subcall function 0071A473: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 0071A4AF

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00718C28
GetProcAddress.KERNEL32(0075A138,CryptUnprotectMemory), ref: 00718C38

Strings

CryptProtectMemory, xrefs: 00718C22
CryptUnprotectMemory, xrefs: 00718C2E
Crypt32.dll, xrefs: 00718C12

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AddressProc$DirectoryH_prolog3_System
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 270589589-1753850145
Opcode ID: 4c2ecb9fdf6c05841e39ac94d382ae543492590fc011c01784b7249f13046f9f
Instruction ID: 950285ca60d1e58f6d023d23f609f2d3c2230eedbf62a0423b2889cf60c8b008
Opcode Fuzzy Hash: 4c2ecb9fdf6c05841e39ac94d382ae543492590fc011c01784b7249f13046f9f
Instruction Fuzzy Hash: E8E0DFB0901742AECB315F389C087827ED49F04700B04C85EF0C6C2192DBBCD0D18B60

Uniqueness

Uniqueness Score: -1.00%

Function 0073004D Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00730114
___AdjustPointer.LIBCMT ref: 00730137
_abort.LIBCMT ref: 00730185
___AdjustPointer.LIBCMT ref: 007301D3

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: a0fb88c7eee023d40d8378811600b1c3c9c3e52f54ffa57ed031fbdfee81034d
Instruction ID: 78c1c72fec8b8b14ae3a8a02c90da738de6b93d2f208b3930a15f406d67ab8c2
Opcode Fuzzy Hash: a0fb88c7eee023d40d8378811600b1c3c9c3e52f54ffa57ed031fbdfee81034d
Instruction Fuzzy Hash: 2B51AF72A0120AEFFB298F58D865BAA77A4FF40710F14452DE815872A3E739ED40C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00714862 Relevance: 7.7, APIs: 5, Instructions: 161filetimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00714869
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?), ref: 007148F4
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?), ref: 0071494B
SetFileTime.KERNEL32(?,00000000,00000000,00000000), ref: 00714A0D
CloseHandle.KERNEL32(?), ref: 00714A14

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: File$Create$CloseH_prolog3_HandleTime
String ID:
API String ID: 4002707884-0
Opcode ID: 0cf78b46c21f258771396339a5ecd0f6e6cd0cc47a99db8e1bb279357dbb26f7
Instruction ID: fc0eedf6f7277982ae59bb5ce643b07342bb815e43d80ed10f534d2a17619dc9
Opcode Fuzzy Hash: 0cf78b46c21f258771396339a5ecd0f6e6cd0cc47a99db8e1bb279357dbb26f7
Instruction Fuzzy Hash: A4519E70E00249ABEF15DFE8D849BEDBBB5AF09310F244119F451B72C1D738AA84CB68

Uniqueness

Uniqueness Score: -1.00%

Function 007392D0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 007392D9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007392FC

Part of subcall function 00736B6E: RtlAllocateHeap.NTDLL(00000000,0072C17E,?,?,0072D656,?,?,?,00000000,?,0072C08A,0072C17E,?,?,?,?), ref: 00736BA0

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00739322
_free.LIBCMT ref: 00739335
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00739344

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 21739706fff7a80808373f0a526829f73084dad48970828ece1de08265c1b641
Instruction ID: c09a843bc622ce9d2446303fc7fed45cede343d9d3664bd07dac578e361b8293
Opcode Fuzzy Hash: 21739706fff7a80808373f0a526829f73084dad48970828ece1de08265c1b641
Instruction Fuzzy Hash: 1C0184B66426157F732116665CCCC7F6A6DDEC2B60B554129BA04C2192EAA98C1285B0

Uniqueness

Uniqueness Score: -1.00%

Function 00739B9F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00739BB7

Part of subcall function 00736B34: RtlFreeHeap.NTDLL(00000000,00000000,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?), ref: 00736B4A
Part of subcall function 00736B34: GetLastError.KERNEL32(?,?,00739C36,?,00000000,?,00000000,?,00739C5D,?,00000007,?,?,0073A05A,?,?), ref: 00736B5C

_free.LIBCMT ref: 00739BC9
_free.LIBCMT ref: 00739BDB
_free.LIBCMT ref: 00739BED
_free.LIBCMT ref: 00739BFF

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 86cf371679be0dcb10a09df871f26228918db97735d13808f06370f6fbdd47dd
Instruction ID: d8811dd47d03d0cc3b8e9741df1b50874ec4950e1e5c0921808575cfcf09e48e
Opcode Fuzzy Hash: 86cf371679be0dcb10a09df871f26228918db97735d13808f06370f6fbdd47dd
Instruction Fuzzy Hash: 1FF012B2605210B7B660DB68F5C6C16B7D9BA01720F798806F149D7943CBBDFC808A78

Uniqueness

Uniqueness Score: -1.00%

Function 00729EED Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 350COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0072A104

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

__EH_prolog3_GS.LIBCMT ref: 0072A452

Strings

0, xrefs: 0072A1C1
.lnk, xrefs: 0072A0FE, 0072A103, 0072A10B
lnk, xrefs: 0072A0C5

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _wcslen$H_prolog3_
String ID: .lnk$0$lnk
API String ID: 2000020936-906397761
Opcode ID: 9a47787f8f166881729d6fe9b81c9150651f688d82ac3bc23132d9979a55e47d
Instruction ID: 27a67ccf35f50ff96355f661995f602da41ce8d986b80b94f1dea83b7099fd49
Opcode Fuzzy Hash: 9a47787f8f166881729d6fe9b81c9150651f688d82ac3bc23132d9979a55e47d
Instruction Fuzzy Hash: 45E12D71904268DFDB24DBA4DC89BDDB7B8BF09300F5404AAE509A7292EB385BC4CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00729A86 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000105,00000000,00000000,0000020A), ref: 00729AC6

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

Part of subcall function 0071559C: _wcslen.LIBCMT ref: 007155AC

EndDialog.USER32(?,00000001), ref: 00729E3A

Strings

@set:user, xrefs: 00729C80
, xrefs: 00729DE8

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _wcslen$DialogPathTemp
String ID: $@set:user
API String ID: 2172748170-1503366402
Opcode ID: b0a6438f28dac5c9f1e327d4baeb4267b912c2e30a1a1fffff09c1acd6319d43
Instruction ID: 8547d2111d92ea8b77f1fa2c94a4134bc8b64c30d9f27c423860c4a31ad1b5d1
Opcode Fuzzy Hash: b0a6438f28dac5c9f1e327d4baeb4267b912c2e30a1a1fffff09c1acd6319d43
Instruction Fuzzy Hash: 65C16D71D00268DADF21DBA4DD49BDDBBB8AF15300F4440AAE949B7282DB785AC4CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00735542 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Kofc4rRZdp.exe,00000104), ref: 00735582
_free.LIBCMT ref: 0073564D
_free.LIBCMT ref: 00735657

Strings

C:\Users\user\Desktop\Kofc4rRZdp.exe, xrefs: 00735579, 00735580, 007355AF, 007355E7

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\Kofc4rRZdp.exe
API String ID: 2506810119-95934980
Opcode ID: 7aeb20772e97bd253987037c65d10650086c991549871680527ede342e15aa34
Instruction ID: bf728c33e290b71a1bfc10681984955d9f578e9d6e46ac594c7d1975d509e192
Opcode Fuzzy Hash: 7aeb20772e97bd253987037c65d10650086c991549871680527ede342e15aa34
Instruction Fuzzy Hash: D331B3B1A00608EFEB21DF94DC85D9EBBF9EF89710F244066F404D7212D6785A40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00730649 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0073066E
_abort.LIBCMT ref: 00730779

Strings

MOC, xrefs: 00730680
RCC, xrefs: 00730688

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: ded52633e5cc4f2961b2b6f7b42ca85bdffebeebdfc7f2ffc95921169777c84d
Instruction ID: f82f0e615079de1e694f31a91085c26c2ba07a4b4796e38274128c0707a8359e
Opcode Fuzzy Hash: ded52633e5cc4f2961b2b6f7b42ca85bdffebeebdfc7f2ffc95921169777c84d
Instruction Fuzzy Hash: 71417971900209EFDF15CF98DD95AEEBBB5BF48300F148159F908A7222D339A961CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00717040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 007170C0
_strncpy.LIBCMT ref: 0071710B

Part of subcall function 0071BBC8: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00717BB8,?,00000000,00000000,?,?,?,00717BB8,?,?,00000050), ref: 0071BBE5

Strings

@%s, xrefs: 007170AA
$%s, xrefs: 007170B5

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: ea880f798da154119a388857a2e472b1e2d678a508648ab977709ca523da2d37
Instruction ID: 7e5b73724e4b3388de8163cbc03561ee1ee4588e9eef79cc669f1dcae758c139
Opcode Fuzzy Hash: ea880f798da154119a388857a2e472b1e2d678a508648ab977709ca523da2d37
Instruction Fuzzy Hash: C6216FB260430DEBEB24DEACCC45EEE77B8BB05310F040515FA1097292E738EA55CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0072AF66 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0072AFB4, 0072AFEE
RENAMEDLG, xrefs: 0072AFC7

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 5e5769af5987c6f4163068197d988a38ca12888fd47765ff83ab772f65a100ce
Instruction ID: 637411641b8ef7b6caa14881a1478e877903323689deb58e0252665b58d8b2ad
Opcode Fuzzy Hash: 5e5769af5987c6f4163068197d988a38ca12888fd47765ff83ab772f65a100ce
Instruction Fuzzy Hash: EE1170B1605320BFC3218F15FD449677BA5E749355B04882AF447A3220D3BDE804DF6B

Uniqueness

Uniqueness Score: -1.00%

Function 00731082 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00731033,00000000,?,0076B8E8,?,?,?,007311D6,00000004,InitializeCriticalSectionEx,00745294,InitializeCriticalSectionEx), ref: 0073108F
GetLastError.KERNEL32(?,00731033,00000000,?,0076B8E8,?,?,?,007311D6,00000004,InitializeCriticalSectionEx,00745294,InitializeCriticalSectionEx,00000000,?,00730F8D), ref: 00731099
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 007310C1

Strings

api-ms-, xrefs: 007310A6

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a8aaa1d85a834fc33d50d5aa5a8f77ed35f41975d49e6a0d1e0c2d44905883ba
Instruction ID: ccd33a6e4346fb579b58abd4a7c315daa5e7b3ee1170f631cc9f5cf4883ddc86
Opcode Fuzzy Hash: a8aaa1d85a834fc33d50d5aa5a8f77ed35f41975d49e6a0d1e0c2d44905883ba
Instruction Fuzzy Hash: EEE04834680208F7FB201B60EC06B193B99AB11B90F504021FA4CAD4E3D7699A61C988

Uniqueness

Uniqueness Score: -1.00%

Function 00739D28 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,54E85006,00731DA4,00000000,00000000,00732DD9,?,00732DD9,?,00000001,00731DA4,54E85006,00000001,00732DD9,00732DD9), ref: 00739D75
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00739DFE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00739E10
__freea.LIBCMT ref: 00739E19

Part of subcall function 00736B6E: RtlAllocateHeap.NTDLL(00000000,0072C17E,?,?,0072D656,?,?,?,00000000,?,0072C08A,0072C17E,?,?,?,?), ref: 00736BA0

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: c2a095a1529645d661f6ba5d291ecfe91f93e8eca2f09517522f57afc4e191d0
Instruction ID: b9182df6cd4cf697da13ae35bc0041e304dccc7bcab56ccd0c42d67e0686c057
Opcode Fuzzy Hash: c2a095a1529645d661f6ba5d291ecfe91f93e8eca2f09517522f57afc4e191d0
Instruction Fuzzy Hash: 7D31D872A1021AABEF24CF64DC45DEE7BA5EB00310F044168FD04D7292EB39CDA0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00719ADC Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00719AE3
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000010), ref: 00719AFA
ExpandEnvironmentStringsW.KERNEL32(?,?,?,00000000,?,?,?,?,?,00000010), ref: 00719B37
_wcslen.LIBCMT ref: 00719B47

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: EnvironmentExpandStrings$H_prolog3_wcslen
String ID:
API String ID: 3741103063-0
Opcode ID: ccd3157d934caa67c4ce5aa09b6a7f0ae0f40c2e752f1cc295ead9c337500324
Instruction ID: 990bca3b266400d71a4f11dbb4be6603d94b84b5e98cf76e4f08d33c94f72be7
Opcode Fuzzy Hash: ccd3157d934caa67c4ce5aa09b6a7f0ae0f40c2e752f1cc295ead9c337500324
Instruction Fuzzy Hash: AC1191B0A0521AEB9B14DF6898999FFB779FF41310B504119B511A7281DB38AD86CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00715CF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00715CFE

Part of subcall function 00715032: GetVersionExW.KERNEL32(?), ref: 00715063

FoldStringW.KERNEL32(00000020,?,000000FF,00000000,00000000,0000000C,0072419F,?,?,?), ref: 00715D25
FoldStringW.KERNEL32(00000020,?,000000FF,?,00000008,00000000), ref: 00715D5F
_wcslen.LIBCMT ref: 00715D6A

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FoldString$H_prolog3Version_wcslen
String ID:
API String ID: 535866816-0
Opcode ID: 32310033c0384286c41b97672d174c5d8e1a6326a3ea2c1d75033bab6cd78cc1
Instruction ID: f5dde6da6055075ec9c2ded5b6907ad6ad349e3bd65058acdcf08737e946192d
Opcode Fuzzy Hash: 32310033c0384286c41b97672d174c5d8e1a6326a3ea2c1d75033bab6cd78cc1
Instruction Fuzzy Hash: 2F11C831A01525EAD704AF6CDC4E9BF7B78AF45720F140205F410A71D2CB389980C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 007380D4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0073807B,?,00000000,00000000,00000000,?,00738278,00000006,FlsSetValue), ref: 00738106
GetLastError.KERNEL32(?,0073807B,?,00000000,00000000,00000000,?,00738278,00000006,FlsSetValue,00746870,FlsSetValue,00000000,00000364,?,00736837), ref: 00738112
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0073807B,?,00000000,00000000,00000000,?,00738278,00000006,FlsSetValue,00746870,FlsSetValue,00000000), ref: 00738120

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a0b64c0ca0c31613614cede73e1e4b29deedd79d4fbf65452cba37f4dcea5982
Instruction ID: 2b6d5abb66ece05d56140a2087dcd774f472b9810206bcde6c5c6d80e15b4de1
Opcode Fuzzy Hash: a0b64c0ca0c31613614cede73e1e4b29deedd79d4fbf65452cba37f4dcea5982
Instruction Fuzzy Hash: A701473620133EABD7214B68DC44A563BA8EF06BA1F254125FA06D3142DF38C803C6E5

Uniqueness

Uniqueness Score: -1.00%

Function 00715D94 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00715D9B
GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00716209,?,000000FF,\\?\,D5FC40FB,?,000000FF,?,?,0073FF80,000000FF), ref: 00715DA4
GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,000000FF,?,?,0073FF80,000000FF), ref: 00715DD3
_wcslen.LIBCMT ref: 00715DDC

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CurrentDirectory$H_prolog3_wcslen
String ID:
API String ID: 19219720-0
Opcode ID: 268ddbdb0244ab04c021e66ab8e0f63a2f893ffe76067c0c90d37f339c8963a1
Instruction ID: ee9832f6af645d12c43228fea7c3dfbb3dce7fcef4a62214da3ee9f36b6bdda8
Opcode Fuzzy Hash: 268ddbdb0244ab04c021e66ab8e0f63a2f893ffe76067c0c90d37f339c8963a1
Instruction Fuzzy Hash: 5701A772D00525EA8B15AFF898099FF7B79AF81B20B544209F501AB281CB384941C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0072CD5E Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,0072CCFB,00000064), ref: 0072CD81
LeaveCriticalSection.KERNEL32(0076B878,?,?,0072CCFB,00000064,?,?,?,?,?,00000000,00740349,000000FF), ref: 0072CD8B
WaitForSingleObjectEx.KERNEL32(?,00000000,?,0072CCFB,00000064,?,?,?,?,?,00000000,00740349,000000FF), ref: 0072CD9C
EnterCriticalSection.KERNEL32(0076B878,?,0072CCFB,00000064,?,?,?,?,?,00000000,00740349,000000FF), ref: 0072CDA3

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 1f2ee8062ec9d34b743c83786d22967f6b406ce542d29a0dcdc55e0ed42b80a0
Instruction ID: 3244e3c365eafbced44e0a5b8bb75333f3d6676f60e73e9b4942b93eb2cc70b3
Opcode Fuzzy Hash: 1f2ee8062ec9d34b743c83786d22967f6b406ce542d29a0dcdc55e0ed42b80a0
Instruction Fuzzy Hash: 00E09235681228FBCB022B61FC0899D3F1DEB07751B048132FA0A93120C7AD58A18BC8

Uniqueness

Uniqueness Score: -1.00%

Function 00725BFD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00725C00
GetDeviceCaps.GDI32(00000000,00000058), ref: 00725C0F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00725C1D
ReleaseDC.USER32(00000000,00000000), ref: 00725C2B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 63a3b7b24b00bf3064cf2b6dacce51d6a831268625d4173c641c6b4e7f081748
Instruction ID: fd1567d29571ed5afc8f723791d01e801462ccd71400b4ddad4452d146822b27
Opcode Fuzzy Hash: 63a3b7b24b00bf3064cf2b6dacce51d6a831268625d4173c641c6b4e7f081748
Instruction Fuzzy Hash: 3AE0EC31982B20EBD6222BB47D0DB9B3B54AB05B52F00C502F643AA194DBFC84048BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0071AE7D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0071B4A9

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

Part of subcall function 007277DE: __EH_prolog3_GS.LIBCMT ref: 007277E5
Part of subcall function 007277DE: GetLastError.KERNEL32(0000001C,0071B459,?,00000000,00000086,?,D5FC40FB,?,?,?,?,?,00000000,00740349,000000FF), ref: 007277FD
Part of subcall function 007277DE: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00740349,000000FF), ref: 00727836

Strings

%ls, xrefs: 0071AF0C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorLast$H_prolog3_Init_thread_footer_wcslen
String ID: %ls
API String ID: 1279724102-3246610740
Opcode ID: 89fdd49a8b2a3ceff00000c0c10a5e147c08b9e95e7d3ed4b3e9ce28fef37c56
Instruction ID: 129756eca45aacecaeb1452ec8dce1f61311db68879df578ad0bfcf4369ead7a
Opcode Fuzzy Hash: 89fdd49a8b2a3ceff00000c0c10a5e147c08b9e95e7d3ed4b3e9ce28fef37c56
Instruction Fuzzy Hash: A4B1C370809249EADB20EF58D94AFDD7BB4FF14B00F108419F942661D1EBBC9B99DA41

Uniqueness

Uniqueness Score: -1.00%

Function 00728EE2 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 272fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00715D94: __EH_prolog3.LIBCMT ref: 00715D9B
Part of subcall function 00715D94: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00716209,?,000000FF,\\?\,D5FC40FB,?,000000FF,?,?,0073FF80,000000FF), ref: 00715DA4

Part of subcall function 00716449: __EH_prolog3_GS.LIBCMT ref: 00716450

Part of subcall function 00714CC7: __EH_prolog3_GS.LIBCMT ref: 00714CCE

Part of subcall function 00714A2F: __EH_prolog3_GS.LIBCMT ref: 00714A36
Part of subcall function 00714A2F: SetFileAttributesW.KERNELBASE(?,00000000,00000024,00714830,?,?,?,?,?,?,00000024,007142E9,?,00000001,00000000,?), ref: 00714A4C
Part of subcall function 00714A2F: SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,?,00000024), ref: 00714A8F

MoveFileW.KERNEL32(?,?), ref: 0072921E
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00729238

Part of subcall function 00715F86: __EH_prolog3_GS.LIBCMT ref: 00715F8D

Strings

.tmp, xrefs: 0072918B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FileH_prolog3_$AttributesMove$CurrentDirectoryH_prolog3
String ID: .tmp
API String ID: 3107500630-2986845003
Opcode ID: b34f61c47527fda462830a2b7660f0a0a63a6f23b8c597ab0abf0b73d14dfef3
Instruction ID: d75c71f7bb67f231e13237267658aa9cf50c08020628e51198adda9238eef13d
Opcode Fuzzy Hash: b34f61c47527fda462830a2b7660f0a0a63a6f23b8c597ab0abf0b73d14dfef3
Instruction Fuzzy Hash: B3C1C471C00268DADB25DFA4D889BDDB7B8BF09300F5441EAE549B3291DB385AC9CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00725FAA Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

Part of subcall function 00725C33: GetDC.USER32(00000000), ref: 00725C37
Part of subcall function 00725C33: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00725C42
Part of subcall function 00725C33: ReleaseDC.USER32(00000000,00000000), ref: 00725C4D

GetObjectW.GDI32(?,00000018,?), ref: 00725FEE

Part of subcall function 00726275: GetDC.USER32(00000000), ref: 0072627E
Part of subcall function 00726275: GetObjectW.GDI32(?,00000018,?), ref: 007262AD
Part of subcall function 00726275: ReleaseDC.USER32(00000000,?), ref: 00726345

Strings

(, xrefs: 00726143

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: b851d6a2e825c8dbb53d7b86f2bd2aad3a7fd43e8037f271029da7e57af9709d
Instruction ID: 2f7ce35706b77837476b8b4b95052ea564dc61b27af366068e54b0a6d47bd0d6
Opcode Fuzzy Hash: b851d6a2e825c8dbb53d7b86f2bd2aad3a7fd43e8037f271029da7e57af9709d
Instruction Fuzzy Hash: 6E9103756093549FC720DF29D844A2BBBE8FFC9B14F10891EF58AD3261CB74A905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00728CAF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00728CB9

Strings

<>t, xrefs: 0072A494

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3_
String ID: <>t
API String ID: 2427045233-3298651070
Opcode ID: f79da743b17a25fa336aac12852ccf3fcba29b23ff29fc8f0df4613a5ffd1043
Instruction ID: 2c814faf24dc27cb39566d56c01b5b375f12c3b1b45a48ec7c67984bb0f39278
Opcode Fuzzy Hash: f79da743b17a25fa336aac12852ccf3fcba29b23ff29fc8f0df4613a5ffd1043
Instruction Fuzzy Hash: 90A15E71C00268DBCF65DF68DC48BDDB7B8BF09300F5041AAE549A7292DB789A89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00738558 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007386C4

Part of subcall function 007314AB: IsProcessorFeaturePresent.KERNEL32(00000017,0073147D,0072C17E,?,?,?,0072C17E,00000016,?,?,0073148A,00000000,00000000,00000000,00000000,00000000), ref: 007314AD
Part of subcall function 007314AB: GetCurrentProcess.KERNEL32(C0000417,?,0072C17E), ref: 007314CF
Part of subcall function 007314AB: TerminateProcess.KERNEL32(00000000,?,0072C17E), ref: 007314D6

Strings

., xrefs: 0073887B
*?, xrefs: 0073859B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: b63559d0858a43ca95d39679e396630d290c71714544b7807d7bcc40eb2fce06
Instruction ID: 48d5544cd92e23490f8537a17a325a36a30c18d6fca8b73f00bf6fc73551fca2
Opcode Fuzzy Hash: b63559d0858a43ca95d39679e396630d290c71714544b7807d7bcc40eb2fce06
Instruction Fuzzy Hash: 2D518375E00209EFEF14DFA8C885AADB7B5FF58314F244169F854E7342EA399E018B51

Uniqueness

Uniqueness Score: -1.00%

Function 0071F9D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0071F9DB

Part of subcall function 00714C75: FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,0071FA7D,0076B1E4,-00000070,00000000), ref: 00714C9D

Part of subcall function 0071CB19: _swprintf.LIBCMT ref: 0071CB52

Strings

zipx, xrefs: 0071FABC
zip, xrefs: 0071FAC3, 0071FACD

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CloseFindH_prolog3__swprintf
String ID: zip$zipx
API String ID: 4097574867-1268445101
Opcode ID: d86111db2dc1ab03e8cdefa1ab3bba6afbba4ef99dab3ec7dd9ec7dc2a851098
Instruction ID: 47bb231cc35e2082dd2106995d84cdc28e79f8a2699c054f3d722e8cf57793df
Opcode Fuzzy Hash: d86111db2dc1ab03e8cdefa1ab3bba6afbba4ef99dab3ec7dd9ec7dc2a851098
Instruction Fuzzy Hash: 5F519DB0905204EBCB19DF68EC58AAD77B4BF45314F14812AF406E72E1DB7CA985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0072FBA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0072FBDF
__IsNonwritableInCurrentImage.LIBCMT ref: 0072FC93

Strings

csm, xrefs: 0072FC7D

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5f2ccc04b91e6d9d749da13fdb7f338033630771bf3b39be03c20504f91c6935
Instruction ID: a77fb027fdcbae2dbcd78bd48508c631ccf621be8c7a3ad706c7c877153dd8f7
Opcode Fuzzy Hash: 5f2ccc04b91e6d9d749da13fdb7f338033630771bf3b39be03c20504f91c6935
Instruction Fuzzy Hash: BA41C238A0022DDBCF10DF68D894A9EBBB5FF45324F148175EC149B392C7399942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00724B9E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00724BA5

Part of subcall function 00714FA6: __EH_prolog3.LIBCMT ref: 00714FAD

Strings

about:blank, xrefs: 00724CA3
Shell.Explorer, xrefs: 00724BE1

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3
String ID: Shell.Explorer$about:blank
API String ID: 431132790-874089819
Opcode ID: 21f2efbc5ad14fda91008d39c766f7a0698d8d72e9dcd07fc2ea721c9f12eee7
Instruction ID: ab6bb1a72dfcc77162f121187a731e3aef96eb7bf56963c2c61fd272ad92654a
Opcode Fuzzy Hash: 21f2efbc5ad14fda91008d39c766f7a0698d8d72e9dcd07fc2ea721c9f12eee7
Instruction Fuzzy Hash: 69417F74701221DFDB18DF68E955B7A77B5BF88700F24805DE8069F2A1DB78AD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00738DC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00736765: GetLastError.KERNEL32(?,?,00731C52,?,?,?,007316CD,00000050,?), ref: 00736769
Part of subcall function 00736765: _free.LIBCMT ref: 0073679C
Part of subcall function 00736765: SetLastError.KERNEL32(00000000,?), ref: 007367DD
Part of subcall function 00736765: _abort.LIBCMT ref: 007367E3

Part of subcall function 00738EEE: _abort.LIBCMT ref: 00738F20
Part of subcall function 00738EEE: _free.LIBCMT ref: 00738F54

Part of subcall function 00738B5B: GetOEMCP.KERNEL32(00000000,?,?,00738DE4,?), ref: 00738B86

_free.LIBCMT ref: 00738E3F
_free.LIBCMT ref: 00738E75

Strings

0t, xrefs: 00738E69

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: 0t
API String ID: 2991157371-555663880
Opcode ID: c2478ee3049b4251eadc1a36ace9470872fa843f1e40035a8fbadea482f4a2cb
Instruction ID: b6c4aac0a37f779aa20f181a08670cbc276864eb743144b734f71353bdcb35a6
Opcode Fuzzy Hash: c2478ee3049b4251eadc1a36ace9470872fa843f1e40035a8fbadea482f4a2cb
Instruction Fuzzy Hash: D131BC31904209EFEB50EFA8D845BADB7E5EF40720F25409AF4049B2A3EF7A9D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00727070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00711B78: GetDlgItem.USER32(00000000,00003021), ref: 00711BBC
Part of subcall function 00711B78: SetWindowTextW.USER32(00000000,00742668), ref: 00711BD2

EndDialog.USER32(?,00000001), ref: 007270DB
SetDlgItemTextW.USER32(?,00000067,?), ref: 00727119

Strings

GETPASSWORD1, xrefs: 007270A8

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: d76b776b7b4c70bc088f56d68cb5b9da7cb3e8d6f3b2c5ba339bb8b5976a2e7e
Instruction ID: eaa931bf3aa3744982f9d51f78946df250eb98c8627dee85f189f07f4b53a840
Opcode Fuzzy Hash: d76b776b7b4c70bc088f56d68cb5b9da7cb3e8d6f3b2c5ba339bb8b5976a2e7e
Instruction Fuzzy Hash: C31129B2608328ABD2359624AD49FFB779CEB85710F004829F745A70C1C66DA845C276

Uniqueness

Uniqueness Score: -1.00%

Function 00718C7E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00718C09: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00718C28
Part of subcall function 00718C09: GetProcAddress.KERNEL32(0075A138,CryptUnprotectMemory), ref: 00718C38

GetCurrentProcessId.KERNEL32(?,?,?,00718C79), ref: 00718D0C

Strings

CryptUnprotectMemory failed, xrefs: 00718D04
CryptProtectMemory failed, xrefs: 00718CC3

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 0e1b1ed71ac00b7768e7692877548ce0ce6bcc69b691f980884d943ee6c5d733
Instruction ID: 12decf09b75c4d45f318c55a4129e2b95084b467b759188e3515e1182ba98d03
Opcode Fuzzy Hash: 0e1b1ed71ac00b7768e7692877548ce0ce6bcc69b691f980884d943ee6c5d733
Instruction Fuzzy Hash: 14112931B01728ABCB255F2CAC045EE3B65EF18760B04815AFC416B2D2DF7C9D9187E6

Uniqueness

Uniqueness Score: -1.00%

Function 00736950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0073697E
_free.LIBCMT ref: 007369A4

Strings

ht, xrefs: 00736A0B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: _free
String ID: ht
API String ID: 269201875-696075778
Opcode ID: 601b91fcbc732adf1ed147bf6a06ce441a83bf320e9d704caa3523483336f78e
Instruction ID: c3df535d8a740ebab5fac71af350c71372a12857d35543d288b9ae38cb0a3b08
Opcode Fuzzy Hash: 601b91fcbc732adf1ed147bf6a06ce441a83bf320e9d704caa3523483336f78e
Instruction Fuzzy Hash: E411C871B01300A6F720AF78AC05B563794F741734F14C229F516DB5D2E7BCD8824785

Uniqueness

Uniqueness Score: -1.00%

Function 0071CA6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0071CA76

Part of subcall function 007114A3: _wcslen.LIBCMT ref: 007114B4

Strings

.zipx, xrefs: 0071CA90
.zx, xrefs: 0071CAB9

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3__wcslen
String ID: .zipx$.zx
API String ID: 3251556500-3683210447
Opcode ID: 224aced744c15bb9af51b73e4e33d7688ad89301705ab92c3f6a023678641bed
Instruction ID: 184f1408ef131d7653d20635fd1d39bec38d8427c0ffc0cf25fe72955364083f
Opcode Fuzzy Hash: 224aced744c15bb9af51b73e4e33d7688ad89301705ab92c3f6a023678641bed
Instruction Fuzzy Hash: BB11217494034CDDDB02EBE8C89AADDBB78AF14354F444029E511BA2C2D7789A89CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0072B03E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(0001044A), ref: 0072B06B
DialogBoxParamW.USER32(GETPASSWORD1,0001044A,00727070,?), ref: 0072B094

Strings

GETPASSWORD1, xrefs: 0072B089

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: 9f511ea2da730519ded189f53adcd4faae7297e84e96aad4dbd5b10633955ebc
Instruction ID: 78389583f1eeee4d4a2c07a5c484831c6f230fc746dfb2bc82d904ad174ba70c
Opcode Fuzzy Hash: 9f511ea2da730519ded189f53adcd4faae7297e84e96aad4dbd5b10633955ebc
Instruction Fuzzy Hash: 1B01D6B1245361FBC7229F64EC45EA73B59AB01300F058115F856A3592C7AC9C45CF77

Uniqueness

Uniqueness Score: -1.00%

Function 00738EEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00736765: GetLastError.KERNEL32(?,?,00731C52,?,?,?,007316CD,00000050,?), ref: 00736769
Part of subcall function 00736765: _free.LIBCMT ref: 0073679C
Part of subcall function 00736765: SetLastError.KERNEL32(00000000,?), ref: 007367DD
Part of subcall function 00736765: _abort.LIBCMT ref: 007367E3

_abort.LIBCMT ref: 00738F20
_free.LIBCMT ref: 00738F54

Strings

0t, xrefs: 00738F4B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: 0t
API String ID: 289325740-555663880
Opcode ID: 7d4f8ccbd6fe49187a935877d0ce359dbbf645cf59876186d119e66399c5f955
Instruction ID: 768d1b505883410da858eb5e26f65310116acaf077bb1de6fd720850f803b139
Opcode Fuzzy Hash: 7d4f8ccbd6fe49187a935877d0ce359dbbf645cf59876186d119e66399c5f955
Instruction Fuzzy Hash: 0B016D76D01733DBEBA1AF98940166DB361BB04B21F29460AF85463282CB7D7D018FC6

Uniqueness

Uniqueness Score: -1.00%

Function 00711B78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00717B5C: _swprintf.LIBCMT ref: 00717B9C
Part of subcall function 00717B5C: SetDlgItemTextW.USER32(?,0074E16C,?), ref: 00717C16
Part of subcall function 00717B5C: GetWindowRect.USER32(?,?), ref: 00717C4C
Part of subcall function 00717B5C: GetClientRect.USER32(?,?), ref: 00717C58

GetDlgItem.USER32(00000000,00003021), ref: 00711BBC
SetWindowTextW.USER32(00000000,00742668), ref: 00711BD2

Strings

0, xrefs: 00711B7B

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: ItemRectTextWindow$Client_swprintf
String ID: 0
API String ID: 758586884-4108050209
Opcode ID: 3f9a8f57897d5dac6f1a50bb9a8a11b59f307893f1c60e575db4b2e0a04295a1
Instruction ID: 65d44a3869484a2410091304d9430ec81f453273179c99649815922da966bc74
Opcode Fuzzy Hash: 3f9a8f57897d5dac6f1a50bb9a8a11b59f307893f1c60e575db4b2e0a04295a1
Instruction Fuzzy Hash: A0F081B010D38CA7DF2A1FA98C09AF93B68AB06304F40C014FE85680D2D77CC8D4DA90

Uniqueness

Uniqueness Score: -1.00%

Function 00737B32 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

Strings

ls, xrefs: 00737B34
Zt, xrefs: 00737B58

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID:
String ID: ls$Zt
API String ID: 0-3834685665
Opcode ID: 2f994f0b1943a4d57d7120778a8735cb7c85ba9b4d1e138b41e61899d36b3ad5
Instruction ID: f951b57c699ba9c3d3e87bba810c357bfa93a6afc99a3226ed515b55e303f84e
Opcode Fuzzy Hash: 2f994f0b1943a4d57d7120778a8735cb7c85ba9b4d1e138b41e61899d36b3ad5
Instruction Fuzzy Hash: 40F0BBE9108159BAEB289F91C841AF9B3B8DF04710F50806EFD45C7181F6789E91D369

Uniqueness

Uniqueness Score: -1.00%

Function 0071CB19 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 0071CA6F: __EH_prolog3_GS.LIBCMT ref: 0071CA76

_swprintf.LIBCMT ref: 0071CB52

Strings

z%s%02d, xrefs: 0071CB47
h&t, xrefs: 0071CB3C

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: H_prolog3__swprintf
String ID: h&t$z%s%02d
API String ID: 971793590-2793636128
Opcode ID: 519dace7688c6e7a78760fae24d4feb2cecf8cca2f7828df340e4b54d43767cf
Instruction ID: 9af9c99df1d9933501e1576e199650beb2854c788f9a7e272f79d588716dca1b
Opcode Fuzzy Hash: 519dace7688c6e7a78760fae24d4feb2cecf8cca2f7828df340e4b54d43767cf
Instruction Fuzzy Hash: 87F05471A0111CFB9B05EBA8D906DEE73BDDF09710B808116F911AB182DB7C9E4547A5

Uniqueness

Uniqueness Score: -1.00%

Function 007382AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00737956), ref: 007382F5

Strings

InitializeCriticalSectionEx, xrefs: 007382BB, 007382C5
Vys, xrefs: 007382DA

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$Vys
API String ID: 2593887523-2198215079
Opcode ID: 470b54bbb30230f70c51f1791ac342c9b388af94feface62e0432c451e6d3376
Instruction ID: 314defc1fda74db8e1d98c6f32d0d01f6f01be7ee2cbe41d6c87ca95371f840b
Opcode Fuzzy Hash: 470b54bbb30230f70c51f1791ac342c9b388af94feface62e0432c451e6d3376
Instruction Fuzzy Hash: FCF0BE7568121CBBDF019F50DC05CAE7F65EF06761F408066FD085A261CF7A8A21DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0072C18D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0072C199

Part of subcall function 0072C11B: std::exception::exception.LIBCONCRT ref: 0072C128

Part of subcall function 0072DD8A: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,00000000,?,?,0072C18C,?,0074BFA0,?), ref: 0072DDEA

___delayLoadHelper2@8.DELAYIMP ref: 0072C1BF

Part of subcall function 0072BDD7: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0072BDE2
Part of subcall function 0072BDD7: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0072BE4A
Part of subcall function 0072BDD7: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0072BE5B

Strings

@Ut, xrefs: 0072C1AD, 0072C1B9

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: AccessDloadExceptionRaiseSectionWrite$AcquireHelper2@8LoadRelease___delaystd::exception::exceptionstd::invalid_argument::invalid_argument
String ID: @Ut
API String ID: 2834720752-141846247
Opcode ID: 4d9b646e666efd93c8c40514bdd7c25b4489dd6e645c96b352beee013ebbcb67
Instruction ID: 6ccebe7e9fbeb707249616bcd2d0c06fd81771b319d9d3c8e8ea08d347ba822e
Opcode Fuzzy Hash: 4d9b646e666efd93c8c40514bdd7c25b4489dd6e645c96b352beee013ebbcb67
Instruction Fuzzy Hash: 81D05BF990411CFE9705B6A4BD1BC7D772CC954700B6084A6F951D1042E7AC691549A1

Uniqueness

Uniqueness Score: -1.00%

Function 00717B12 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000064,00000000,00000000,?,?,?,00000000,0000005C,D5FC40FB), ref: 00717B17
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00717B25

Strings

RTL, xrefs: 00717B1F

Memory Dump Source

Source File: 00000000.00000002.2077168073.0000000000711000.00000020.00000001.01000000.00000003.sdmp, Offset: 00710000, based on PE: true

Associated: 00000000.00000002.2077152736.0000000000710000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077193325.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000074E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000757000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077209805.0000000000762000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2077267841.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_Kofc4rRZdp.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e230b04611ead21a075f67c4e691a104eb3acae2eb619d1daafc769747268357
Instruction ID: 16f35ecb78be605a97b6ecb36fe4f6a35a7f34edde5c4c52ece6a2750663aebb
Opcode Fuzzy Hash: e230b04611ead21a075f67c4e691a104eb3acae2eb619d1daafc769747268357
Instruction Fuzzy Hash: 69C0127164871156E73017357C4DB832AA45B01711F858545F141DA5D1DBEDD492CBB4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 3220, Parent PID: 2520COMMON

Execution Graph

Execution Coverage:	28.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.3%
Total number of Nodes:	43
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04951000 Relevance: 6.4, APIs: 4, Instructions: 424
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 049514CE
VirtualProtect.KERNELBASE(?,?,?,?), ref: 049514FC
VirtualProtect.KERNELBASE(?,?,?,?), ref: 0495177D
VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0495180B

Memory Dump Source

Source File: 00000001.00000002.2076391307.0000000004951000.00000020.00001000.00020000.00000000.sdmp, Offset: 04951000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4951000_regsvr32.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: 0bc8ee07a5546a3c43276986cde8fe94f42d4ec68a15947ce53d6279f0dd398b
Instruction ID: 3be74e3e1590f39d507d77b753ffd257c2ab0f7640a0844bf67ae82ba1226667
Opcode Fuzzy Hash: 0bc8ee07a5546a3c43276986cde8fe94f42d4ec68a15947ce53d6279f0dd398b
Instruction Fuzzy Hash: D9025E72E002199FDB18CF69CC41BD9B7F2BF88314F1485AAD519EB654D734AA85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04A79040 Relevance: 1.8, APIs: 1, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,?), ref: 04A79388

Memory Dump Source

Source File: 00000001.00000002.2076520566.0000000004A71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a71000_regsvr32.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 6ab722221787e69d894194c5c4c42e3b2d71896f7f4b6b3772e6f58312f379ff
Instruction ID: f3051a65c900a8276b7d0e6379e1b734ac76f1382cdce1c3d73523e37a111046
Opcode Fuzzy Hash: 6ab722221787e69d894194c5c4c42e3b2d71896f7f4b6b3772e6f58312f379ff
Instruction Fuzzy Hash: 28C14C76E00129CBDB24CF59C8806DEB7B2BF98310F15859AD909BB254DB74AE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04A76140 Relevance: 1.7, APIs: 1, Instructions: 228
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 04A762A0

Memory Dump Source

Source File: 00000001.00000002.2076520566.0000000004A71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a71000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: ab7a877ffd79899cc7603fe45b61c1814a440daea63f53cd2ebc209e6ee9fc69
Instruction ID: 9a5089c440e869d09c9f8ac1e97ab549d6922381fd9141c952cc5f639d314dda
Opcode Fuzzy Hash: ab7a877ffd79899cc7603fe45b61c1814a440daea63f53cd2ebc209e6ee9fc69
Instruction Fuzzy Hash: EA81B4326096508FD310CF29C88469FFBE3BFC8320F198959E4949B3A4D774E806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04A769C0 Relevance: 1.7, APIs: 1, Instructions: 226
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 04A76C44

Memory Dump Source

Source File: 00000001.00000002.2076520566.0000000004A71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a71000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 537b1be1b2e84878ef3fe60934e0b74becee2addf5d73403542023327351b549
Instruction ID: f77781c85b7690fcfe35ae1fa3849c58c0a2a2cd55695fa0d0fc38a886b3bd60
Opcode Fuzzy Hash: 537b1be1b2e84878ef3fe60934e0b74becee2addf5d73403542023327351b549
Instruction Fuzzy Hash: BC917C76E006188FCB24CF69C841ADEBBB6FF88320F158199D519AB355DB31AD46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04A76CC0 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 04A76E0C

Memory Dump Source

Source File: 00000001.00000002.2076520566.0000000004A71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a71000_regsvr32.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cfdd9022297cde4a78b5dc8bb0d26ac1c81bb3a7edd0609dfc727c5b2bc2bfbe
Instruction ID: 35d4fd743e8a147215a8ed977e975f5343195a706fa55d59a3d96ba9838cf81b
Opcode Fuzzy Hash: cfdd9022297cde4a78b5dc8bb0d26ac1c81bb3a7edd0609dfc727c5b2bc2bfbe
Instruction Fuzzy Hash: CB719E76618B118FC314CF29C98062AF7E2FBC8320F1A8A6DE4959B394D774F845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04A78910 Relevance: 1.4, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 04A78B3C

Memory Dump Source

Source File: 00000001.00000002.2076520566.0000000004A71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a71000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2e1137750f0f6d465f5da4117e84bfb0b5eaaba48c13b3ab895e7976f072736
Instruction ID: 85810a49012378ee0b0ffa9ddcfe5723e6bc59c45cef28c8e7bf7f8872cae5dd
Opcode Fuzzy Hash: a2e1137750f0f6d465f5da4117e84bfb0b5eaaba48c13b3ab895e7976f072736
Instruction Fuzzy Hash: B4719E726083518FC724DF29C99466FB7E2BFC8310F168A2EE495D7394D674E806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00962477 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 009625CA

Strings

`, xrefs: 00962536

Memory Dump Source

Source File: 00000001.00000002.2076024678.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Offset: 00960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_960000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 26567fb04521bdaca77a6b4d998c007b2ebf4d8cc87699eb693bc4fbf094c240
Instruction ID: 1f3d35a5c1980d52cb8fc71b552a6fb24ad28c8f10b17da3dce551d86617a6f4
Opcode Fuzzy Hash: 26567fb04521bdaca77a6b4d998c007b2ebf4d8cc87699eb693bc4fbf094c240
Instruction Fuzzy Hash: 2B41ADB5E006288FDB54CF09C980B89BBF1FF88300F15819AC949AB356D735AE81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0096218E Relevance: 1.3, APIs: 1, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00962206

Memory Dump Source

Source File: 00000001.00000002.2076024678.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Offset: 00960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_960000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7abe5941ddb8d6437af1a035234398983b5f0371bd5dce2b9c50ded6af9b63a6
Instruction ID: dbdcabe84b3352c6528905f5b41d9af376880ef892633f8fe67e0737cc7e23ef
Opcode Fuzzy Hash: 7abe5941ddb8d6437af1a035234398983b5f0371bd5dce2b9c50ded6af9b63a6
Instruction Fuzzy Hash: 2841F1B09002058FCB04DFA8C1547AEBBF0FF48308F24846ED858AB341D37AA946CF95

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Kofc4rRZdp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\42ZqUg._

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: Kofc4rRZdp.exePID: 2520, Parent PID: 1028

General

Chronological Activities

Analysis Process: regsvr32.exePID: 3220, Parent PID: 2520

General

Windows Analysis Report
Kofc4rRZdp.exe

Function 0072B2FE Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 252
filesleeptimeCOMMON

Function 00725C5C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Function 00714D8A Relevance: 9.1, APIs: 6, Instructions: 139
fileCOMMON

Function 0071A590 Relevance: 91.4, APIs: 16, Strings: 36, Instructions: 394
libraryfileloaderCOMMON

Function 0072A4D2 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
windowCOMMON

Function 0072A800 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 291
windowCOMMON

Function 00729773 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 300
COMMON

Function 0071ACD0 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Function 0072AF00 Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Function 007293F3 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216
windowCOMMON

Function 00726357 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
COMMON

Function 0072655D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Function 00713650 Relevance: 7.7, APIs: 5, Instructions: 183
filetimeCOMMON

Function 007275D8 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Function 007217B1 Relevance: 6.3, APIs: 4, Instructions: 313
COMMON