Edit tour

Windows Analysis Report
doc-1.exe

Overview

General Information

Sample name:	doc-1.exe
Analysis ID:	1431427
MD5:	cb0453ea959b40b3a0500dac08b0a309
SHA1:	574ee3b44cf4e11ea8a2b19554e2b9c709c5177a
SHA256:	9f3034de7f891cbccf1e97f2ce5a806907149a573258ed1c094301b5919d3bba
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found API chain indicative of debugger detection

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

doc-1.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\doc-1.exe" MD5: CB0453EA959B40B3A0500DAC08B0A309)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: doc-1.exe

Virustotal: Detection: 7%

Perma Link

Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00479B50 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,		0_2_00479B50
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0042FF42 BCryptGenRandom,SystemFunction036,		0_2_0042FF42

Source: doc-1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: doc-1.exe

String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-supportyfqBCUuiHMkgJBsjVLIZXuZmbxVFvbUFzjnbhVPhCE

Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00406F46 memcpy,memcpy,memcpy,memset,AcquireSRWLockExclusive,AcquireSRWLockExclusive,ReleaseSRWLockExclusive,ReleaseSRWLockExclusive,ReleaseSRWLockExclusive,GlobalMemoryStatusEx,K32GetPerformanceInfo,PdhOpenQueryA,PdhCollectQueryData,NtQuerySystemInformation,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,GetUserNameW,GetUserNameW,GetNativeSystemInfo,GetCurrentProcessId,memcpy,memset,	0_2_00406F46
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047CF27 NtQueryInformationProcess,NtQueryInformationProcess,	0_2_0047CF27
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047BFDF NtQueryInformationProcess,NtQueryInformationProcess,	0_2_0047BFDF

Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00471040	0_2_00471040
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00441000	0_2_00441000
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0040B011	0_2_0040B011
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004320CC	0_2_004320CC
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0044C090	0_2_0044C090
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0041B160	0_2_0041B160
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00415130	0_2_00415130
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004711E0	0_2_004711E0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0041E1E8	0_2_0041E1E8
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0048327F	0_2_0048327F
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004242F5	0_2_004242F5
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00417280	0_2_00417280
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0046B300	0_2_0046B300
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0043132E	0_2_0043132E
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0041C330	0_2_0041C330
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00426473	0_2_00426473
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0041141C	0_2_0041141C
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00416430	0_2_00416430
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004354CA	0_2_004354CA
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004084D4	0_2_004084D4
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004084D9	0_2_004084D9
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004084DE	0_2_004084DE
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0042F4F7	0_2_0042F4F7
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004334BF	0_2_004334BF
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00408543	0_2_00408543
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00408545	0_2_00408545
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0040852D	0_2_0040852D
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0040852F	0_2_0040852F
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00408531	0_2_00408531
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004735D0	0_2_004735D0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00405648	0_2_00405648
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047A670	0_2_0047A670
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00427712	0_2_00427712
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00401731	0_2_00401731
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0043E7A0	0_2_0043E7A0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004397A4	0_2_004397A4
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00422850	0_2_00422850
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0041B810	0_2_0041B810
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0043F830	0_2_0043F830
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0043383B	0_2_0043383B
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0043883F	0_2_0043883F
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0048794D	0_2_0048794D
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00445932	0_2_00445932
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00423938	0_2_00423938
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047CA4A	0_2_0047CA4A
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0041FA00	0_2_0041FA00
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00405A2B	0_2_00405A2B
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00411ACC	0_2_00411ACC
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00417AE0	0_2_00417AE0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0042BAEE	0_2_0042BAEE
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00411A8C	0_2_00411A8C
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047BAA8	0_2_0047BAA8
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00479B50	0_2_00479B50
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00465BD0	0_2_00465BD0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00441BF0	0_2_00441BF0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00437BA5	0_2_00437BA5
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00434C66	0_2_00434C66
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047EC69	0_2_0047EC69
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00467C10	0_2_00467C10
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00479CA0	0_2_00479CA0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00471D50	0_2_00471D50
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047BD62	0_2_0047BD62
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00424D7E	0_2_00424D7E
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0042CD25	0_2_0042CD25
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0042CE47	0_2_0042CE47
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0043CE50	0_2_0043CE50
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00413E20	0_2_00413E20
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00402E36	0_2_00402E36
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00414EF0	0_2_00414EF0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00406F46	0_2_00406F46
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00410F6F	0_2_00410F6F
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00484F78	0_2_00484F78
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0046AFC0	0_2_0046AFC0
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_0047BFDF	0_2_0047BFDF
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00430FB4	0_2_00430FB4

Source: C:\Users\user\Desktop\doc-1.exe	Code function: String function: 00414310 appears 76 times
Source: C:\Users\user\Desktop\doc-1.exe	Code function: String function: 00414630 appears 129 times

Source: classification engine

Classification label: mal52.evad.winEXE@1/0@0/0

Source: doc-1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\doc-1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: doc-1.exe

Virustotal: Detection: 7%

Source: C:\Users\user\Desktop\doc-1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc-1.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc-1.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc-1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc-1.exe	Section loaded: umpdc.dll	Jump to behavior

Source: doc-1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\doc-1.exe

Code function: 0_2_0048F830 LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_0048F830

Source: doc-1.exe

Static PE information: real checksum: 0xc2eec should be: 0xb6eb6

Source: doc-1.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00419540 push 75058D48h; retf		0_2_00419608
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004195A0 push 75058D48h; retf		0_2_00419608

Source: C:\Users\user\Desktop\doc-1.exe

Code function: 0_2_00406F46 memcpy,memcpy,memcpy,memset,AcquireSRWLockExclusive,AcquireSRWLockExclusive,ReleaseSRWLockExclusive,ReleaseSRWLockExclusive,ReleaseSRWLockExclusive,GlobalMemoryStatusEx,K32GetPerformanceInfo,PdhOpenQueryA,PdhCollectQueryData,NtQuerySystemInformation,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,GetUserNameW,GetUserNameW,GetNativeSystemInfo,GetCurrentProcessId,memcpy,memset,

0_2_00406F46

Source: C:\Users\user\Desktop\doc-1.exe

API coverage: 0.9 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\doc-1.exe

Code function: 0_2_004320CC GetSystemInfo,memcpy,memcpy,memcpy,memcpy,CloseHandle,

0_2_004320CC

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\doc-1.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-40973

Source: C:\Users\user\Desktop\doc-1.exe

0_2_00406F46

Source: C:\Users\user\Desktop\doc-1.exe

Code function: 0_2_0048F830 LoadLibraryA,GetProcAddress,FreeLibrary,

0_2_0048F830

Source: C:\Users\user\Desktop\doc-1.exe

Code function: 0_2_0047D854 GetProcessHeap,

0_2_0047D854

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_initterm,GetStartupInfoA,exit,	0_2_00401180
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004023D4 RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetLastError,	0_2_004023D4
Source: C:\Users\user\Desktop\doc-1.exe	Code function: 0_2_004B8A18 SetUnhandledExceptionFilter,	0_2_004B8A18

Source: C:\Users\user\Desktop\doc-1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\doc-1.exe

Code function: 0_2_0042B09E CreateNamedPipeW,memcpy,CreateIoCompletionPort,

0_2_0042B09E

Source: C:\Users\user\Desktop\doc-1.exe

Code function: 0_2_0048E400 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0048E400

Source: C:\Users\user\Desktop\doc-1.exe

0_2_00406F46

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
doc-1.exe	7%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://docs.rs/getrandom#nodejs-es-module-supportyfqBCUuiHMkgJBsjVLIZXuZmbxVFvbUFzjnbhVPhCE	doc-1.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431427
Start date and time:	2024-04-25 05:06:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	doc-1.exe
Detection:	MAL
Classification:	mal52.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.395965924406632
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	doc-1.exe
File size:	741'888 bytes
MD5:	cb0453ea959b40b3a0500dac08b0a309
SHA1:	574ee3b44cf4e11ea8a2b19554e2b9c709c5177a
SHA256:	9f3034de7f891cbccf1e97f2ce5a806907149a573258ed1c094301b5919d3bba
SHA512:	ba2fb7d55fefc568e02591be107e95a16c6d689457b53b27a20bdfd9eb925c3d1d5f4e4c0603dcb8bdd877cbea365492bb7426eee1d56565ea6b2e1d621209b1
SSDEEP:	12288:pHb/x4iH+TYlPsHAhObXHrEDMgwYjfj4dv0kS2EAgOqtwcd:BZ4ieTYlsgkbC4h0kS2Ilh
TLSH:	3BF45C07F29650BDC4AEC174875B6272FA72BC4D0535BA6F0BD48B313E25B50AB1EB18
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....(f........../..........N................@...........................................`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6628ABDB [Wed Apr 24 06:51:07 2024 UTC]
TLS Callbacks:	0x446d50
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	64a0a11f6bac8e22afe78f6842288e69

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000A8F15h]
mov dword ptr [eax], 00000001h
call 00007F2DC0C35D2Fh
call 00007F2DC0BA8AAAh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000A8EE5h]
mov dword ptr [eax], 00000000h
call 00007F2DC0C35CFFh
call 00007F2DC0BA8A7Ah
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax+00h]
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 28h
call 00007F2DC0C31014h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F2DC0BA8DC9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push esi
push edi
push ebp
push ebx
dec eax
sub esp, 00000248h
movaps esp+00000230h, dqword ptr [xmm6]
dec ecx
mov edi, ecx
call 00007F2DC0BACC9Bh
dec eax
test eax, eax
je 00007F2DC0BA8DF6h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb8000	0x1ef0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xab000	0x4038	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa9fe0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb8730	0x640	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8ed08	0x8ee00	82e33ab797aced224cc1a1da5852a179	False	0.5409899934383202	data	6.32049451646991	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x90000	0x2b0	0x400	55418744122f18690206799e38f7f5c4	False	0.15625	data	1.0300332799297227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x91000	0x19420	0x19600	2aed4bdd1cf185e23c02d64535332f3c	False	0.5187711668719212	data	5.983924071076773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0xab000	0x4038	0x4200	c57ac2dfec47985597882d15a8dc4f1c	False	0.4698745265151515	data	5.799901732107319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0xb0000	0x5ed0	0x6000	d7db3f704a09250f8dd43b410253b6be	False	0.3329264322916667	data	5.187616423289117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xb6000	0x1560	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb8000	0x1ef0	0x2000	3d12909de2f093e4ea8874bb6f36ba43	False	0.30615234375	data	4.547364614399058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xba000	0x78	0x200	8dcd437c88c8b7791159864cb6c2d3f2	False	0.091796875	data	0.396790685092107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xbb000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.dll	AcquireSRWLockExclusive, AcquireSRWLockShared, AddVectoredExceptionHandler, CancelIoEx, CloseHandle, CompareStringOrdinal, ConnectNamedPipe, CreateFileMappingA, CreateFileW, CreateIoCompletionPort, CreateNamedPipeW, CreateProcessW, CreateThread, CreateToolhelp32Snapshot, CreateWaitableTimerExW, DeleteCriticalSection, DeleteProcThreadAttributeList, DuplicateHandle, EnterCriticalSection, ExitProcess, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, GetCommandLineW, GetComputerNameExW, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetEnvironmentVariableW, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetNativeSystemInfo, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessIoCounters, GetProcessTimes, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetSystemTimes, GetTickCount, GetWindowsDirectoryW, GlobalMemoryStatusEx, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSection, InitializeProcThreadAttributeList, IsDBCSLeadByteEx, K32GetPerformanceInfo, LeaveCriticalSection, LoadLibraryA, LoadLibraryExA, LocalAlloc, LocalFree, MapViewOfFile, Module32FirstW, Module32NextW, MultiByteToWideChar, OpenProcess, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadFile, ReadFileEx, ReadProcessMemory, ReleaseSRWLockExclusive, ReleaseSRWLockShared, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlUnwindEx, RtlVirtualUnwind, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepConditionVariableSRW, SleepEx, SwitchToThread, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, UnmapViewOfFile, UpdateProcThreadAttribute, VirtualProtect, VirtualQuery, VirtualQueryEx, WaitForSingleObject, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile, WriteFileEx, __C_specific_handler
msvcrt.dll	___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _endthreadex, _errno, _fmode, _fpreset, _initterm, _onexit, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, signal, strerror, strncmp, vfprintf
ntdll.dll	memcmp, memcpy, memmove, memset, pow, strlen, wcslen
ntdll.dll	NtCancelIoFileEx, NtDeviceIoControlFile, NtQueryInformationProcess, NtQuerySystemInformation, NtWriteFile, RtlGetVersion, RtlNtStatusToDosError
advapi32.dll	AllocateAndInitializeSid, CopySid, FreeSid, GetLengthSid, GetTokenInformation, GetUserNameW, InitializeSecurityDescriptor, IsValidSid, OpenProcessToken, SetEntriesInAclW, SetSecurityDescriptorDacl, SystemFunction036
bcrypt.dll	BCryptGenRandom
oleaut32.dll	GetErrorInfo, SysFreeString, SysStringLen
pdh.dll	PdhAddEnglishCounterW, PdhCloseQuery, PdhCollectQueryData, PdhGetFormattedCounterValue, PdhOpenQueryA, PdhRemoveCounter
powrprof.dll	CallNtPowerInformation
psapi.dll	GetModuleFileNameExW, GetProcessMemoryInfo
shell32.dll	CommandLineToArgvW

Target ID:	0
Start time:	05:06:51
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\doc-1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\doc-1.exe"
Imagebase:	0x400000
File size:	741'888 bytes
MD5 hash:	CB0453EA959B40B3A0500DAC08B0A309
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.3%
Total number of Nodes:	99
Total number of Limit Nodes:	4

Executed Functions

Function 00401180 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 189
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00401253
malloc.MSVCRT ref: 00401329
strlen.NTDLL ref: 00401354
malloc.MSVCRT ref: 00401360
memcpy.NTDLL ref: 00401378
_cexit.MSVCRT ref: 004013E5
GetStartupInfoA.KERNEL32 ref: 00401473

Strings

XuK, xrefs: 004011BD
@rK, xrefs: 00401259
PuK, xrefs: 004011F1, 00401410

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled_cexitmemcpystrlen
String ID: @rK$PuK$XuK
API String ID: 1640792405-3341304455
Opcode ID: 4397159f744e3e8f62fa6e36cb323cd077c0a54a2d2a734fb1a9eebee9c21c4a
Instruction ID: 4411f9d487a6dac6681ffd654f1012327162db0198ca0550bbaefefd1efd9bf6
Opcode Fuzzy Hash: 4397159f744e3e8f62fa6e36cb323cd077c0a54a2d2a734fb1a9eebee9c21c4a
Instruction Fuzzy Hash: 46719EB1710A4486EB24EF56E89076A33A1B746B88F44442BEF09A77A1DF3DC854C709

Uniqueness

Uniqueness Score: -1.00%

Function 004023D4 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0040240B

Strings

combase.dll, xrefs: 00402576
p3J, xrefs: 0040248F
=J, xrefs: 0040254E
`XJ, xrefs: 0040255B
main, xrefs: 00402419
8YJ, xrefs: 004024BC

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast
String ID: =J$8YJ$`XJ$combase.dll$main$p3J
API String ID: 1452528299-596559082
Opcode ID: 7941122de0f24320c3e43e294700bbd5ed2be0d7b4ac1be75a1b01f9b2bc0544
Instruction ID: 75ab2eec9a44127937b9acb6a9450944266c4574debb09bb6f3f1ea23bac1e8b
Opcode Fuzzy Hash: 7941122de0f24320c3e43e294700bbd5ed2be0d7b4ac1be75a1b01f9b2bc0544
Instruction Fuzzy Hash: BD51D172309B4091EB11EF11E99439A7360F785788F90402BEB8E537A4EFBDC58AC749

Uniqueness

Uniqueness Score: -1.00%

Function 004470D0 Relevance: 1.5, APIs: 1, Instructions: 36
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadDescription.KERNELBASE ref: 0044712E

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: DescriptionThread
String ID:
API String ID: 2285587249-0
Opcode ID: b8063fee80f944067dc418f5dc6fc201963b3d0dd346ced935feaa811d3d809e
Instruction ID: 97d907a13199f7a7941e2a37e0abbdf7768dba3c99c6ef3e045ff3663c918654
Opcode Fuzzy Hash: b8063fee80f944067dc418f5dc6fc201963b3d0dd346ced935feaa811d3d809e
Instruction Fuzzy Hash: 73F0A45121E99081EA11AB12E40539EA721E781FD4F54802BEA4D17B18DF6DC9878708

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00406F46 Relevance: 104.3, APIs: 29, Strings: 29, Instructions: 2797COMMON

Download Yara Rule

Strings

/,@, xrefs: 0040A697
combase.dll, xrefs: 004083F8, 00409ADA
x?J, xrefs: 0040836C
[fJ, xrefs: 00409E02
key_used disappeared, xrefs: 00409DFB
task_type, xrefs: 00407DD7
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1, 00409EB1
cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB, xrefs: 00408437, 0040A690
V@J, xrefs: 004080D1
install, xrefs: 0040A328
[fJ, xrefs: 00409E31
payloadentry_namegcparamsentry is invalidexecuteMKVoWAyeGAeLMZfbqan, xrefs: 0040A08F
`async fn` resumed after completion, xrefs: 00407099, 004070A9
lock count overflow in reentrant mutexlibrarydOBCOGZGzyaSjAFgSVrkMGxh, xrefs: 004080CA
stdoutlibrarylzbjFWnLCcuXBvkubN, xrefs: 00407FA1
^gJ, xrefs: 0040A684
8sJ, xrefs: 0040840C
H;J, xrefs: 0040842B
Total CP, xrefs: 00408674
=J, xrefs: 0040814E, 004082C6
data length less than 8, rand string length is not enough, xrefs: 00407887
assertion failed: successwhoami-1.4.1rpUTXVNtgMtVRvf, xrefs: 00409E15
encrypt_key, xrefs: 00406FE7, 00409C04, 00409ECB
nown, xrefs: 004093B0
armv5armv6armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004095D9, 004096AF, 00409852, 004098B2
8sJ, xrefs: 0040718E
assertion failed: vec.capacity() - start >= lenrayon-1.8.1kdtGsCcHxHW, xrefs: 00409E50
global_key_idle disappearedsysinfo-0.30.5fIkhSFuVdsfnqeXHimHqVj, xrefs: 00409E2A
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: =J$/,@$8sJ$8sJ$H;J$Total CP$V@J$[fJ$[fJ$^gJ$`async fn` resumed after completion$armv5armv6armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64$assertion failed: successwhoami-1.4.1rpUTXVNtgMtVRvf$assertion failed: vec.capacity() - start >= lenrayon-1.8.1kdtGsCcHxHW$cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB$combase.dll$data length less than 8, rand string length is not enough$encrypt_key$global_key_idle disappearedsysinfo-0.30.5fIkhSFuVdsfnqeXHimHqVj$install$key_used disappeared$lock count overflow in reentrant mutexlibrarydOBCOGZGzyaSjAFgSVrkMGxh$nown$payloadentry_namegcparamsentry is invalidexecuteMKVoWAyeGAeLMZfbqan$pipe_nameexecuteEhfeYJEicXvOOqC$stdoutlibrarylzbjFWnLCcuXBvkubN$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch$task_type$x?J
API String ID: 0-1434011761
Opcode ID: 84dc46f44deb42089cbf68d135613152f8d4fb837d44b984fc8937f98ab13931
Instruction ID: a4f3015f022de716206989cce3d2bb652b37221d2d24dbb5320d7e082506ad9b
Opcode Fuzzy Hash: 84dc46f44deb42089cbf68d135613152f8d4fb837d44b984fc8937f98ab13931
Instruction Fuzzy Hash: DA439E72608BC081DA21DB26E4453EEB361FB89B88F44822ADF8D17B99DF7CC546C745

Uniqueness

Uniqueness Score: -1.00%

Function 0046AFC0 Relevance: 86.5, APIs: 35, Strings: 13, Instructions: 2518COMMON

Download Yara Rule

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 0046EA42, 0046EA5F
@aJ, xrefs: 0046B2E9
@aJ, xrefs: 0046E42D
assertion failed: self.height > 0, xrefs: 0046EA13
@aJ, xrefs: 0046E95B
h, xrefs: 0046E443
@aJ, xrefs: 0046B2CF
PATHRUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none(), xrefs: 0046CC89
"J, xrefs: 0046EB47
]?\\, xrefs: 0046C07F
(PJ, xrefs: 0046C04D
\?\\, xrefs: 0046C077
.exeprogram not found, xrefs: 0046C3E7

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: "J$(PJ$.exeprogram not found$@aJ$@aJ$@aJ$@aJ$PATHRUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none()$\?\\$]?\\$assertion failed: self.height > 0$h$internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 0-2084285905
Opcode ID: 918293365666b45441832c942344ebfa36257068fe8a03af620b81053b571868
Instruction ID: e00b0217a7be0cf4d1e2695fe292defa670aa695b0262dc06801c9614d81cd43
Opcode Fuzzy Hash: 918293365666b45441832c942344ebfa36257068fe8a03af620b81053b571868
Instruction Fuzzy Hash: 7E33AD72609BC081DA319B16E4843EBA3A0F7C5B84F544227DE9D47B99EF3CC585CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B011 Relevance: 84.7, APIs: 12, Strings: 44, Instructions: 661
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040B1DE
memset.NTDLL ref: 0040B201
memset.NTDLL ref: 0040B22D
memset.NTDLL ref: 0040B259
memcpy.NTDLL ref: 0040B285
memcpy.NTDLL ref: 0040B2A0
memcpy.NTDLL ref: 0040B2BB
memcpy.NTDLL ref: 0040B2DE
memset.NTDLL ref: 0040B300
memset.NTDLL ref: 0040B326
memcpy.NTDLL ref: 0040B5F5
memcpy.NTDLL ref: 0040B6E0

Strings

@aJ, xrefs: 004106BB
pJ, xrefs: 0040FF36
8zJ, xrefs: 0040F3A8
combase.dll, xrefs: 0040B8CC, 0040C762, 0040E376, 0040FBFC, 0041005F, 004100FE
UFH, xrefs: 0040E08E
pQI, xrefs: 0040F780
mismatchtask_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 0040D176
8zJ, xrefs: 0040EFED, 0040F131, 0040F217, 0040F287, 0040F2EC
cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB, xrefs: 004100CA
8zJ, xrefs: 0040EF6E
attempt to calculate the remainder with a divisor of zerothere is no such thing as a release load, xrefs: 0040F884
8zJ, xrefs: 00410112
-ppipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 0040BE17
8zJ, xrefs: 0040EEB7
TOKIO_WORKER_THREADStokio-1.35.1GAAxoBVfUTzhofHypXPb"" cannot be set to 0, xrefs: 0040D0E3
8zJ, xrefs: 0040FAC7
corrupt deflate stream, xrefs: 0040B4F9
=, xrefs: 0040D09B
^gJ, xrefs: 004100BE
8zJ, xrefs: 0040F88B
internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 0040F940
Failed to `Enter::block_on`, xrefs: 0040FAD3
pJ, xrefs: 0040FFCC
`hJ, xrefs: 0040FBBE
HwJ, xrefs: 0040FBE2, 00410045
assertion failed: sharded_size.is_power_of_two()tokio-1.35.1opIOpzNydtZxIBFUvuldgnSwy, xrefs: 0041002D
failed to park thread, xrefs: 0040FC35
8zJ, xrefs: 0040EF8B, 0040F0DC, 0040F1E0, 0040F245, 0040F2B5
r, xrefs: 0040F92C
%^bind_hash, xrefs: 0040CB0A
assertion failed: shared.shutdown_tx.is_some()tokio-1.35.1RbMLmBPTJKkaSEdIeYoymHIMvViHl, xrefs: 0040FB37
/,@, xrefs: 0040FADA, 0040FC3C, 004100D1
/,@, xrefs: 0040D04C
@aJ, xrefs: 004106A3
pipe_prefix, xrefs: 0040CF83
flow when subtracting durations, xrefs: 0040BDCA
8zJ, xrefs: 0040EED0
called `Result::unwrap()` on an `Err` value, xrefs: 0040FB8F
Slice must be the same length as the array, xrefs: 0040BC0C
8zJ, xrefs: 0040F1CA
thread name may not contain interior null bytes, xrefs: 0040FBCA
pJ, xrefs: 00410021
pQI, xrefs: 0040FAB3
8zJ, xrefs: 0040EEA1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpymemset
String ID: %^bind_hash$-ppipe_nameexecuteEhfeYJEicXvOOqC$/,@$/,@$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$=$@aJ$@aJ$Failed to `Enter::block_on`$HwJ$Slice must be the same length as the array$TOKIO_WORKER_THREADStokio-1.35.1GAAxoBVfUTzhofHypXPb"" cannot be set to 0$UFH$^gJ$`hJ$assertion failed: sharded_size.is_power_of_two()tokio-1.35.1opIOpzNydtZxIBFUvuldgnSwy$assertion failed: shared.shutdown_tx.is_some()tokio-1.35.1RbMLmBPTJKkaSEdIeYoymHIMvViHl$attempt to calculate the remainder with a divisor of zerothere is no such thing as a release load$called `Result::unwrap()` on an `Err` value$cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB$combase.dll$corrupt deflate stream$failed to park thread$flow when subtracting durations$internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value$mismatchtask_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch$pQI$pQI$pipe_prefix$r$thread name may not contain interior null bytes$pJ$pJ$pJ
API String ID: 1297977491-1208857643
Opcode ID: d694f27ebe95ce67f2d84dbf2978ec6085a915772ac81f2725fed9cb0d253f6d
Instruction ID: 76a5c4816ad096abcfe36a02320e855553cf288c30bc229e17a732141b92b5ef
Opcode Fuzzy Hash: d694f27ebe95ce67f2d84dbf2978ec6085a915772ac81f2725fed9cb0d253f6d
Instruction Fuzzy Hash: EC529C72318BC081DB25DB26E4503EA7365F789B88F44852AEE8D17B59DF3CC686C748

Uniqueness

Uniqueness Score: -1.00%

Function 00402E36 Relevance: 38.6, APIs: 5, Strings: 20, Instructions: 1080COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 004039DB
memcpy.NTDLL ref: 00403B51
memcpy.NTDLL ref: 00403BE0
memcpy.NTDLL ref: 00403C57
memcpy.NTDLL ref: 00403CB1

Strings

^gJ, xrefs: 00403F80
PjJ, xrefs: 00403E15
8zJ, xrefs: 00402F39
8zJ, xrefs: 004030C6
combase.dll, xrefs: 0040301C, 00403E4F, 00403E8B, 00403EF1, 00403F2F
8zJ, xrefs: 00403030
8zJ, xrefs: 00402F82
/,@, xrefs: 00403F93
cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB, xrefs: 00403F8C
8zJ, xrefs: 00403F56
8zJ, xrefs: 00402E3A
called `Option::unwrap()` on a `None` value, xrefs: 00403EBD, 00403F4F, 00403FAE, 00403FC1
8zJ, xrefs: 0040306D
PjJ, xrefs: 00403E24
PjJ, xrefs: 00403882
8zJ, xrefs: 00403086
8zJ, xrefs: 00402F51
8zJ, xrefs: 00403057
PjJ, xrefs: 00403860
assertion failed: end >= start && end <= len, xrefs: 00403EA8

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: /,@$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$8zJ$PjJ$PjJ$PjJ$PjJ$^gJ$assertion failed: end >= start && end <= len$called `Option::unwrap()` on a `None` value$cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB$combase.dll
API String ID: 3510742995-2276254108
Opcode ID: 37b62789dbb2af39cf3d3d434ede05e9efd4933400441581a4073133d6a6d65e
Instruction ID: a0601ade94bcee6b7352bb77d3843c5137fdca6b41fec980860ee74367801750
Opcode Fuzzy Hash: 37b62789dbb2af39cf3d3d434ede05e9efd4933400441581a4073133d6a6d65e
Instruction Fuzzy Hash: FA92E172704B8081DA20EF16E4413AE6765F789BD8F448627DE9D67799EF3CC686C308

Uniqueness

Uniqueness Score: -1.00%

Function 004735D0 Relevance: 26.8, APIs: 13, Strings: 2, Instructions: 526
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 00473763
GetFullPathNameW.KERNEL32 ref: 00473776
GetLastError.KERNEL32 ref: 00473782
GetLastError.KERNEL32 ref: 0047379B

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 00473950, 00473CFF
PJ, xrefs: 0047365F

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value$PJ
API String ID: 2482867836-1401652814
Opcode ID: 841b243c78ecf8a73e2c425edca1418e0c008ba2e62147f26240f6319a4527ad
Instruction ID: 8d0b19c310dd350b213b16ac8c2f0db788d1d9529e1dac2e2d35d5eb30489b30
Opcode Fuzzy Hash: 841b243c78ecf8a73e2c425edca1418e0c008ba2e62147f26240f6319a4527ad
Instruction Fuzzy Hash: 0C12D462304B8086DB20AF12E4453AFA760F7857D8F54852BEE8D47B99DF7CC682D709

Uniqueness

Uniqueness Score: -1.00%

Function 00415130 Relevance: 22.0, APIs: 7, Strings: 7, Instructions: 988COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00415443
memcpy.NTDLL ref: 00415723
memcpy.NTDLL ref: 00415759
memcpy.NTDLL ref: 0041578F

Strings

assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00416262
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00416248
assertion failed: d.mant > 0, xrefs: 00416204
assertion failed: d.plus > 0, xrefs: 0041622E
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0, xrefs: 004161D4
XqI, xrefs: 00416132, 0041613B, 00416151, 00416167, 0041617F, 004161AB, 004161C1, 004161DB, 004161EE
assertion failed: d.minus > 0, xrefs: 00416214

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: XqI$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0
API String ID: 3510742995-1859209338
Opcode ID: b03a328fd84dcb5b5abc8a136ee1edca051c8f3d32b5d5a6abe10895541f81ba
Instruction ID: e06bcd12a69d30aa9c9316e12209fac90077ab5338151b874089aec6725d7fd4
Opcode Fuzzy Hash: b03a328fd84dcb5b5abc8a136ee1edca051c8f3d32b5d5a6abe10895541f81ba
Instruction Fuzzy Hash: 1E822272B19BC086EB20CB11E5407EAB361F3D5798F945227DA9913B99DB3CC5C6CB08

Uniqueness

Uniqueness Score: -1.00%

Function 00401731 Relevance: 18.5, APIs: 1, Strings: 11, Instructions: 517
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL ref: 00401CC9

Strings

YFI, xrefs: 0040202E
number of permits must not overflow, xrefs: 0040200D
internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 00402047
YFI, xrefs: 004020EA
combase.dll, xrefs: 00401D8C, 004020D8
`async fn` resumed after completion, xrefs: 00402027
8sJ, xrefs: 00401B69
HwJ, xrefs: 004020BE
lock must be acquired before waiting, xrefs: 0040206C
failed to park thread, xrefs: 00402111
/,@, xrefs: 00402118

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: /,@$8sJ$HwJ$YFI$YFI$`async fn` resumed after completion$combase.dll$failed to park thread$internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value$lock must be acquired before waiting$number of permits must not overflow
API String ID: 3510742995-2564312932
Opcode ID: dafd0d47f0704096200f97a47eeecd766aeed259536927fd3825c499dc724e83
Instruction ID: cb26dce142c07ec51f08a9d84ed942857971069c35a17b19f7769927fa338987
Opcode Fuzzy Hash: dafd0d47f0704096200f97a47eeecd766aeed259536927fd3825c499dc724e83
Instruction Fuzzy Hash: A8228B72209BC081DA21DB15E4543EFB760F799B88F44812BEA8E17BA9DF7CC585C748

Uniqueness

Uniqueness Score: -1.00%

Function 004320CC Relevance: 18.3, APIs: 6, Strings: 4, Instructions: 817COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 004325CB

Part of subcall function 004304F8: memcpy.NTDLL ref: 00430511
Part of subcall function 004304F8: memcpy.NTDLL ref: 00430543

memcpy.NTDLL ref: 004326A8
memcpy.NTDLL ref: 004326E1
memcpy.NTDLL ref: 00432A82
memcpy.NTDLL ref: 00432BDA

Part of subcall function 00412E60: HeapReAlloc.KERNEL32 ref: 00412F2A

Part of subcall function 00472D10: GetLastError.KERNEL32 ref: 00472DA7

CloseHandle.KERNEL32 ref: 00432E65

Strings

`hJ, xrefs: 004330B7
thread name may not contain interior null bytes, xrefs: 004330C3
RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildError, xrefs: 004324D3
6`J, xrefs: 00432AA0

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy$AllocCloseErrorHandleHeapInfoLastSystem
String ID: 6`J$RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildError$`hJ$thread name may not contain interior null bytes
API String ID: 1257019547-2802671382
Opcode ID: 7bee79a52ec50498139701627d6463c508d9d987499d0aa4fec356b41b75a5bb
Instruction ID: 3f82ec14c7e7bfdfa48546c3881b054d12e9088e25b8b4e33d1bb718ddc73891
Opcode Fuzzy Hash: 7bee79a52ec50498139701627d6463c508d9d987499d0aa4fec356b41b75a5bb
Instruction Fuzzy Hash: 31826832209BC481D6758B16E9513EEB3A4F798B84F44921ADFCC17B59DF78C296CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00465BD0 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 439COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00465D92
GetFullPathNameW.KERNEL32 ref: 00465DA5
GetLastError.KERNEL32 ref: 00465DB1
GetLastError.KERNEL32 ref: 00465DC6

Strings

\\?\\\?\UNC\, xrefs: 00465E77
internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 00466155
combase.dll, xrefs: 00465BD6, 00465E8B, 00465EF2

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\\\?\UNC\$combase.dll$internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 2482867836-213592486
Opcode ID: 2a2c4a07f3f68e773469f9894b9d14b0e4bd5e32229247b2956a9dd0707d42fb
Instruction ID: 30ee45dd72bba7fed295efdf1bc4c45e79db868138c9ec5f126d603b4136bae7
Opcode Fuzzy Hash: 2a2c4a07f3f68e773469f9894b9d14b0e4bd5e32229247b2956a9dd0707d42fb
Instruction Fuzzy Hash: 2302FF72608F9081DB20DF16E4443AAA365F395B98F558127EF8D47B95EF7CC882C70A

Uniqueness

Uniqueness Score: -1.00%

Function 0046B300 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0046B379
CloseHandle.KERNEL32 ref: 0046C282

Strings

(PJ, xrefs: 0046C04D
HOJ, xrefs: 0046E8F8

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CloseEnvironmentHandleStrings
String ID: (PJ$HOJ
API String ID: 1140201626-3485663183
Opcode ID: 78d2b50b89c3cbaa5646d969c42b150eccc015a282df274e70696273c01afc07
Instruction ID: ac2b519b0e1ac70965876836fbebb35ee79271b7975338f3fb3bb132f1740f87
Opcode Fuzzy Hash: 78d2b50b89c3cbaa5646d969c42b150eccc015a282df274e70696273c01afc07
Instruction Fuzzy Hash: C202BF72219BC4C5DA319B12E4443EBA3A4F784B98F044227DF9987B95EF7CC486C74A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A670 Relevance: 17.1, APIs: 5, Strings: 6, Instructions: 640COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 0047ABC5
memcpy.NTDLL ref: 0047AD36
memcpy.NTDLL ref: 0047ADCF

Part of subcall function 0047A108: memcpy.NTDLL ref: 0047A17C

memcpy.NTDLL ref: 0047B2A9

Strings

^gJ, xrefs: 0047B337
0bJ, xrefs: 0047B256
/,@, xrefs: 0047B34A
cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB, xrefs: 0047B343
assertion failed: mid <= self.len(), xrefs: 0047B311
0bJ, xrefs: 0047B243

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: /,@$0bJ$0bJ$^gJ$assertion failed: mid <= self.len()$cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB
API String ID: 3510742995-1808124256
Opcode ID: 96b41d71f21b742d6d5581e74bc061aa7c5e5d193beb206a8a07060d98f87ff4
Instruction ID: 6b19871d81a003402ee28722acced8ebb94bd5e86cce7460628a3ce4b8b9eac9
Opcode Fuzzy Hash: 96b41d71f21b742d6d5581e74bc061aa7c5e5d193beb206a8a07060d98f87ff4
Instruction Fuzzy Hash: 77624672618BC482D6718B16E4803EEB3A4F799B88F54921ADBCD03B59DF3CC295CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00471D50 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 238memorythreadCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32 ref: 00471E13
InitializeProcThreadAttributeList.KERNEL32 ref: 00471E57
UpdateProcThreadAttribute.KERNEL32 ref: 00471EB9

Strings

called `Option::unwrap()` on a `None` value, xrefs: 004720A7, 004720C1
@aJ, xrefs: 004720AE
nPJ, xrefs: 00471DCC
@aJ, xrefs: 004720C8

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AttributeProcThread$AllocHeapInitializeListUpdate
String ID: @aJ$@aJ$called `Option::unwrap()` on a `None` value$nPJ
API String ID: 561812158-3811350012
Opcode ID: c57f15080fc914575f66139c511934b952d355a87820bb947208cb707cc60fab
Instruction ID: 078d98dd071ccb76006127b7cb4a02eca804e3e57d5e9f5b08d761404dd204e4
Opcode Fuzzy Hash: c57f15080fc914575f66139c511934b952d355a87820bb947208cb707cc60fab
Instruction Fuzzy Hash: F071137131168081DE14AB2B96017FA6351FB96BE8F94C627EE6E173E5DE7DC482C308

Uniqueness

Uniqueness Score: -1.00%

Function 00416430 Relevance: 14.4, Strings: 11, Instructions: 654COMMON

Download Yara Rule

Strings

assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 004171D3, 00417A8E
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 004171B9, 00417A74
assertion failed: d.mant > 0, xrefs: 00417175, 00417A3A
assertion failed: d.plus > 0, xrefs: 0041719F, 00417A5A
mSI, xrefs: 00417AC9
attempt to divide by zero, xrefs: 004176A6
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00417AA8
XqI, xrefs: 004150EA, 004150FD, 00415113, 004162A1, 004163CE, 004163E1, 004163F7, 00416418, 00416439, 0041668B, 0041710B, 00417125, 00417149, 0041715F, 004171F4, 00417210, 00417226, 00417243, 00417289, 0041728B
assertion failed: digits < 40assertion failed: other > 0, xrefs: 00416411
assertion failed: d.minus > 0, xrefs: 00417185, 00417A4A
assertion failed: edelta >= 0librarykJRZbZeQRcKnOfHoqhgGppuJVO, xrefs: 00417AC2

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: XqI$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: digits < 40assertion failed: other > 0$assertion failed: edelta >= 0librarykJRZbZeQRcKnOfHoqhgGppuJVO$attempt to divide by zero$mSI
API String ID: 0-3500061563
Opcode ID: 8abdf5cbc469555aa135c3de65ef49a4f92b9e1e76d17b78ab0095280534fb6e
Instruction ID: 4ecf5f77c114069e23e8f9450c712fde8c174ddc81cfebebbb63676abee065de
Opcode Fuzzy Hash: 8abdf5cbc469555aa135c3de65ef49a4f92b9e1e76d17b78ab0095280534fb6e
Instruction Fuzzy Hash: DA32C1B2728BC483EA24CF55E8447EAA321F7957C4F549126EE8D17B58DB3CC686C708

Uniqueness

Uniqueness Score: -1.00%

Function 00479B50 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 377COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00479B65
TlsGetValue.KERNEL32 ref: 00479B90
TlsSetValue.KERNEL32 ref: 00479BEE
BCryptGenRandom.BCRYPT ref: 00479C0E

Strings

GenuineI, xrefs: 0047A086
HygonGen, xrefs: 0047A055
Authenti, xrefs: 0047A039

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Value$CryptRandom
String ID: Authenti$GenuineI$HygonGen
API String ID: 658332386-696657513
Opcode ID: c28ec390998bd561396ea2ed198efac9356ab020b7d08a3d948b6cb7578381f0
Instruction ID: a4fd6dbc48a3e04fcafda16ac339eb8c051582e7a21503e6d3b8434fc60d1e53
Opcode Fuzzy Hash: c28ec390998bd561396ea2ed198efac9356ab020b7d08a3d948b6cb7578381f0
Instruction Fuzzy Hash: 87B1AAB3724A5002FB198B56FC12BEA5991B398BC4F04A43AEE8F97B85D97CCD11C344

Uniqueness

Uniqueness Score: -1.00%

Function 004084DE Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 257COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32 ref: 00408508

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 1766480654-2153574380
Opcode ID: 464667add6c0a92f415aa837c75afd23d716ac2ebcd98429b06307037bfa5985
Instruction ID: 07a0a740a492b08302547c94c589df81ac7fc436f6ec61fa6e0a160ef2e1bdd7
Opcode Fuzzy Hash: 464667add6c0a92f415aa837c75afd23d716ac2ebcd98429b06307037bfa5985
Instruction Fuzzy Hash: 7BC19E32608BC592E7359F26E9453EA73A4F795788F40822AEBC817B59DF3CC195C704

Uniqueness

Uniqueness Score: -1.00%

Function 00408545 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 250nativeCOMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32 ref: 0040856D
GlobalMemoryStatusEx.KERNEL32 ref: 00408749
K32GetPerformanceInfo.KERNEL32 ref: 0040879D
PdhOpenQueryA.PDH ref: 00408832
PdhCollectQueryData.PDH ref: 00408A56
NtQuerySystemInformation.NTDLL ref: 00408BEB

Part of subcall function 0047A108: memcpy.NTDLL ref: 0047A17C

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Query$CollectDataExclusiveGlobalInfoInformationLockMemoryOpenPerformanceReleaseStatusSystemmemcpy
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 2760678902-2153574380
Opcode ID: 176540238da0be68c93818961e96c410285098a3032a4759dca37acff04cb735
Instruction ID: 10757785c111c9ee6d07a455ad8c0bc9a966eda7ec875da2f872c32063e01a68
Opcode Fuzzy Hash: 176540238da0be68c93818961e96c410285098a3032a4759dca37acff04cb735
Instruction Fuzzy Hash: 2BC1AB32608BC492E7259F26E9453EEB3A4F794788F40822AEBC817B59DF7CC195C704

Uniqueness

Uniqueness Score: -1.00%

Function 004084D9 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 247COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32 ref: 0040856D
GlobalMemoryStatusEx.KERNEL32 ref: 00408749

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ExclusiveGlobalLockMemoryReleaseStatus
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 738436483-2153574380
Opcode ID: 8deb8d79ec7fd4035e208e9c4aaf1c1440be276fc4a78abd1d666172f228c977
Instruction ID: 92f3cc1d1f598b98df1270f60a7a26e7f9258f862764d960406ac34d791a9968
Opcode Fuzzy Hash: 8deb8d79ec7fd4035e208e9c4aaf1c1440be276fc4a78abd1d666172f228c977
Instruction Fuzzy Hash: 71C19D32608BC492E7259F26E9413EEB3A4F795788F40922AEBC817B59DF7CC195C704

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA00 Relevance: 12.4, Strings: 9, Instructions: 1170COMMON

Download Yara Rule

Strings

/,@, xrefs: 00420D8F
Error, xrefs: 00420DBE
combase.dll, xrefs: 0041FA0B
called `Result::unwrap()` on an `Err` value, xrefs: 00420D88
internal_code, xrefs: 00420E39
assertion failed: lookahead_size >= len_to_move, xrefs: 00420D4E
unknown_codeOS Error: , xrefs: 00420E88
os_error, xrefs: 00420DF6
description, xrefs: 00420E5F

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: /,@$Error$assertion failed: lookahead_size >= len_to_move$called `Result::unwrap()` on an `Err` value$combase.dll$description$internal_code$os_error$unknown_codeOS Error:
API String ID: 0-4047826160
Opcode ID: b20d8107d4e0bece5f6f73efc11995af06448a61e890d4d4dcb13c04e23c0a51
Instruction ID: 8f56a47f54b4ea51408c27558706ee0887c6f7ea7e22772b53a53aee5b195e6e
Opcode Fuzzy Hash: b20d8107d4e0bece5f6f73efc11995af06448a61e890d4d4dcb13c04e23c0a51
Instruction Fuzzy Hash: BBB2ADB2708BE486DB21CB16F44479AB7A5F388B88F854127EE8E43B55DB7CC585CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00471040 Relevance: 12.2, APIs: 8, Instructions: 213COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00473763
GetFullPathNameW.KERNEL32 ref: 00473776
GetLastError.KERNEL32 ref: 00473782
GetLastError.KERNEL32 ref: 0047379B
memcmp.NTDLL ref: 0047381B
SetLastError.KERNEL32 ref: 00473B12
GetFullPathNameW.KERNEL32 ref: 00473B25
GetLastError.KERNEL32 ref: 00473B30
GetLastError.KERNEL32 ref: 00473B49

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$FullNamePath$memcmp
String ID:
API String ID: 1351486824-0
Opcode ID: f08ab2d5bc32e7ea6b143c3976bb1a1e60f1f2dc4b6b81ba515ad63781b3c55e
Instruction ID: 275f9865ff0a1fefb3bb262572ad6bebfdeec3420608257e38cdf7a5f78aa040
Opcode Fuzzy Hash: f08ab2d5bc32e7ea6b143c3976bb1a1e60f1f2dc4b6b81ba515ad63781b3c55e
Instruction Fuzzy Hash: 7A712662614BC085DB209F26E84435BA7A0F3957E8F14C21BEE9D43BA4EB7CC5C4D709

Uniqueness

Uniqueness Score: -1.00%

Function 00405A2B Relevance: 11.0, Strings: 8, Instructions: 1040COMMON

Download Yara Rule

Strings

combase.dll, xrefs: 00405BE1
`async fn` resumed after completion, xrefs: 0040600B, 0040601E, 00406062, 00406083
[L@, xrefs: 00406AE0
log_type, xrefs: 0040A6FC
Failed to allocate security descriptorthis should never fail, xrefs: 00405CFF
8zJ, xrefs: 00405A2F
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 00405B6D
msg, xrefs: 0040A76F

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: 8zJ$Failed to allocate security descriptorthis should never fail$[L@$`async fn` resumed after completion$combase.dll$log_type$msg$pipe_nameexecuteEhfeYJEicXvOOqC
API String ID: 0-2785384733
Opcode ID: f07f855762758ada22336ef9930abd24a6c353f1b30ac70cdc2b8e47cf2b71af
Instruction ID: bbceb007dc196dce14560fd8731d8139b0bad1c59058324a1d91f7fb3361c32d
Opcode Fuzzy Hash: f07f855762758ada22336ef9930abd24a6c353f1b30ac70cdc2b8e47cf2b71af
Instruction Fuzzy Hash: C2B26632608BC485EB21DF26E4443EA73A4F798B88F45822ADF8D57B99DF38C195C714

Uniqueness

Uniqueness Score: -1.00%

Function 004084D4 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 247COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00408749

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 1890195054-2153574380
Opcode ID: 9234dc470fdee6aef3ebbfda8c1943d451153276e507b85ec5e30c7f4e94282a
Instruction ID: 26279a8787bba287d2cc8c32d53bc1a6fdf06d6fccbb7944b0222aeca7f1e130
Opcode Fuzzy Hash: 9234dc470fdee6aef3ebbfda8c1943d451153276e507b85ec5e30c7f4e94282a
Instruction Fuzzy Hash: C5C19D32608BC592E7259F22E9413EEB3A4F795788F40822AEBC817B59DF7CC195C744

Uniqueness

Uniqueness Score: -1.00%

Function 00408531 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 244nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 004894A0: RtlCaptureContext.KERNEL32 ref: 00489525
Part of subcall function 004894A0: RtlUnwindEx.KERNEL32 ref: 00489543
Part of subcall function 004894A0: abort.MSVCRT ref: 00489549
Part of subcall function 004894A0: abort.MSVCRT ref: 00489560

Part of subcall function 0043BACE: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043BB03

Part of subcall function 0047E1D6: memset.NTDLL ref: 0047E26C

GlobalMemoryStatusEx.KERNEL32 ref: 00408749
K32GetPerformanceInfo.KERNEL32 ref: 0040879D
PdhOpenQueryA.PDH ref: 00408832
PdhCollectQueryData.PDH ref: 00408A56
NtQuerySystemInformation.NTDLL ref: 00408BEB

Part of subcall function 0047A108: memcpy.NTDLL ref: 0047A17C

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Query$abortmemcpy$CaptureCollectContextDataGlobalInfoInformationMemoryOpenPerformanceStatusSystemUnwindmemset
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 3142878841-2153574380
Opcode ID: c88968f6800bbefae9ed7fe7614994091aaf570964a3b1bc79031ec9175e44ee
Instruction ID: dc43559bfaec0981f9a46a07b524b3d593fab1db2a7dde770e72cac3fa4b0e38
Opcode Fuzzy Hash: c88968f6800bbefae9ed7fe7614994091aaf570964a3b1bc79031ec9175e44ee
Instruction Fuzzy Hash: 17C18D32608BC492E7259F22E9413EAB3A4F795788F40922AEB8817B59DF7CC195C744

Uniqueness

Uniqueness Score: -1.00%

Function 00408543 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 238nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0043BACE: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043BB03

Part of subcall function 0047E1D6: memset.NTDLL ref: 0047E26C

GlobalMemoryStatusEx.KERNEL32 ref: 00408749
K32GetPerformanceInfo.KERNEL32 ref: 0040879D
PdhOpenQueryA.PDH ref: 00408832
PdhCollectQueryData.PDH ref: 00408A56
NtQuerySystemInformation.NTDLL ref: 00408BEB

Part of subcall function 0047A108: memcpy.NTDLL ref: 0047A17C

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Query$memcpy$CollectDataGlobalInfoInformationMemoryOpenPerformanceStatusSystemmemset
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 539917485-2153574380
Opcode ID: 5f3f2d71f00a3e0ea9dafd8aaa1c4634a445abb242b8038d99fa91fd29a4f026
Instruction ID: ef0ea50663a86cba3bb849bceddebc52b881401e56ed3fc7ca72e7b24c8e84c7
Opcode Fuzzy Hash: 5f3f2d71f00a3e0ea9dafd8aaa1c4634a445abb242b8038d99fa91fd29a4f026
Instruction Fuzzy Hash: 27C1AF32608BC492E7359F22E9413EAB3A4F794788F40922AEBC817B59DF7CC195C744

Uniqueness

Uniqueness Score: -1.00%

Function 0040852D Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 238nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0043BACE: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043BB03

Part of subcall function 0047E1D6: memset.NTDLL ref: 0047E26C

GlobalMemoryStatusEx.KERNEL32 ref: 00408749
K32GetPerformanceInfo.KERNEL32 ref: 0040879D
PdhOpenQueryA.PDH ref: 00408832
PdhCollectQueryData.PDH ref: 00408A56
NtQuerySystemInformation.NTDLL ref: 00408BEB

Part of subcall function 0047A108: memcpy.NTDLL ref: 0047A17C

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Query$memcpy$CollectDataGlobalInfoInformationMemoryOpenPerformanceStatusSystemmemset
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 539917485-2153574380
Opcode ID: 2b06c006df3ae58201a58db0c3ce261306c72a48083e7486120eac3941eb25f9
Instruction ID: ef0ea50663a86cba3bb849bceddebc52b881401e56ed3fc7ca72e7b24c8e84c7
Opcode Fuzzy Hash: 2b06c006df3ae58201a58db0c3ce261306c72a48083e7486120eac3941eb25f9
Instruction Fuzzy Hash: 27C1AF32608BC492E7359F22E9413EAB3A4F794788F40922AEBC817B59DF7CC195C744

Uniqueness

Uniqueness Score: -1.00%

Function 0040852F Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 238nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0043BACE: memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043BB03

Part of subcall function 0047E1D6: memset.NTDLL ref: 0047E26C

GlobalMemoryStatusEx.KERNEL32 ref: 00408749
K32GetPerformanceInfo.KERNEL32 ref: 0040879D
PdhOpenQueryA.PDH ref: 00408832
PdhCollectQueryData.PDH ref: 00408A56
NtQuerySystemInformation.NTDLL ref: 00408BEB

Part of subcall function 0047A108: memcpy.NTDLL ref: 0047A17C

Strings

Total CP, xrefs: 00408674
task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 004085B1
pipe_nameexecuteEhfeYJEicXvOOqC, xrefs: 004085E1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Query$memcpy$CollectDataGlobalInfoInformationMemoryOpenPerformanceStatusSystemmemset
String ID: Total CP$pipe_nameexecuteEhfeYJEicXvOOqC$task_idx86386amd64usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 539917485-2153574380
Opcode ID: 7058c7034581ca28802e0d8b6293b72b1eb729dffda87f9cf81c61a599ad45ed
Instruction ID: ef0ea50663a86cba3bb849bceddebc52b881401e56ed3fc7ca72e7b24c8e84c7
Opcode Fuzzy Hash: 7058c7034581ca28802e0d8b6293b72b1eb729dffda87f9cf81c61a599ad45ed
Instruction Fuzzy Hash: 27C1AF32608BC492E7359F22E9413EAB3A4F794788F40922AEBC817B59DF7CC195C744

Uniqueness

Uniqueness Score: -1.00%

Function 00414EF0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 004150C7

Strings

assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 004171D3
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 004171B9
assertion failed: d.mant > 0, xrefs: 00417175
attempt to divide by zero, xrefs: 004176A6
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0, xrefs: 0041723C
XqI, xrefs: 004150EA, 004150FD, 00415113, 004163CE, 004163E1, 004163F7, 00416418, 00416439, 0041668B, 0041710B, 00417125, 00417149, 0041715F, 004171F4, 00417210, 00417226, 00417243, 00417289, 0041728B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: XqI$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0$attempt to divide by zero
API String ID: 3510742995-1079322299
Opcode ID: a0726b72fd42acb2be6a32c910a510b4a5ee74d9cbc6d5abf2390729f42da190
Instruction ID: b5fd0c239dffc6f4c024912a3827d6d02de55439221ade1548b15558f9b13649
Opcode Fuzzy Hash: a0726b72fd42acb2be6a32c910a510b4a5ee74d9cbc6d5abf2390729f42da190
Instruction Fuzzy Hash: DC51347271198482EA21CF49E4067EAAB60FBD9798F845222EE4A13714EB3DC4C7C748

Uniqueness

Uniqueness Score: -1.00%

Function 0042B09E Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 411pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32 ref: 0042B2B2

Part of subcall function 0042918B: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00429663), ref: 0042918F

CreateIoCompletionPort.KERNEL32 ref: 0042B6F0

Strings

I/O source already registered with a `Registry`, xrefs: 0042B5F7
A Tokio 1.x context was found, but it is being shutdown.tokio-1.35.1rtTaMgdSrvBWaTqavuZBjiePuQNNjlR, xrefs: 0042B413

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Create$CompletionErrorLastNamedPipePort
String ID: A Tokio 1.x context was found, but it is being shutdown.tokio-1.35.1rtTaMgdSrvBWaTqavuZBjiePuQNNjlR$I/O source already registered with a `Registry`
API String ID: 3291731705-964732226
Opcode ID: 7d63d7f8508027f4270501665bc37301e3cb085897d23f77740b4ed7f005ae39
Instruction ID: 10f273c2621d6e923e38f933d997dccbab1db8d3ed61a391ee324368608da8bf
Opcode Fuzzy Hash: 7d63d7f8508027f4270501665bc37301e3cb085897d23f77740b4ed7f005ae39
Instruction Fuzzy Hash: 3602BC72708BE082D6219B12F9457AEB364F788BD8F85811AEF8807B59DF7CD196C344

Uniqueness

Uniqueness Score: -1.00%

Function 0047EC69 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 400COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0047ECA6
memcpy.NTDLL ref: 0047EEFB
memcpy.NTDLL ref: 0047F03B

Strings

@cJ, xrefs: 0047EFF3
unknownassertion failed: successwhoami-1.4.1rpUTXVNtgMtVRvf, xrefs: 0047F012

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy$InfoSystem
String ID: @cJ$unknownassertion failed: successwhoami-1.4.1rpUTXVNtgMtVRvf
API String ID: 1915069931-758613265
Opcode ID: cfad1fe49c0a25114a1725378b2895204149031213f1e83c154316982008ed72
Instruction ID: 69c8291c33510151f9bb9e59486e2f087185aa7b81f05055e32edd3704916ce9
Opcode Fuzzy Hash: cfad1fe49c0a25114a1725378b2895204149031213f1e83c154316982008ed72
Instruction Fuzzy Hash: D2F16A72219BC082EA65DB16E4403EEB3A1F789BD4F54822ADE8D57B59DF3CC486C704

Uniqueness

Uniqueness Score: -1.00%

Function 004354CA Relevance: 9.0, Strings: 7, Instructions: 282COMMON

Download Yara Rule

Strings

33333333, xrefs: 0043565F
UUUUUUUU, xrefs: 0043556A
TUUUUUUU, xrefs: 0043578D
UUUUUUUU, xrefs: 0043577D
33333333, xrefs: 0043575B
33333333, xrefs: 0043554F
UUUUUUUU, xrefs: 0043567D

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: 33333333$33333333$33333333$TUUUUUUU$UUUUUUUU$UUUUUUUU$UUUUUUUU
API String ID: 0-2965141230
Opcode ID: 1e44499c212fb8fbee31e1e7a531388030ce6e2981c0f14be80162a3e244dd93
Instruction ID: b5c0bf08b0b0d5317c3eb6119ec9fe64faaa4ec9fa950206d0996386c78151bc
Opcode Fuzzy Hash: 1e44499c212fb8fbee31e1e7a531388030ce6e2981c0f14be80162a3e244dd93
Instruction Fuzzy Hash: 02814693721B5842ED04DB03A4263AA5B62F789FF4749E436DE6E57B88DD3CE106C301

Uniqueness

Uniqueness Score: -1.00%

Function 0047BD62 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 0047BDB5

Part of subcall function 00488B6F: GetLastError.KERNEL32 ref: 00488B73

Strings

0eJ, xrefs: 0047BF9A
combase.dll, xrefs: 0047BFC3
qeJ, xrefs: 0047BFAC

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLastOpenProcessToken
String ID: 0eJ$combase.dll$qeJ
API String ID: 2961703104-2598768502
Opcode ID: a3920525b52a742c3562ae5cc86934abfc3b3934d5b7048ec3ac606ad3727cad
Instruction ID: 2d9247164c9308ca73f0933d2b0a5b8e40990735d9783685a64ec0d20f1f9775
Opcode Fuzzy Hash: a3920525b52a742c3562ae5cc86934abfc3b3934d5b7048ec3ac606ad3727cad
Instruction Fuzzy Hash: 4851CB6270470082DB18EB2298453EE6360FB86F98F98C52BEE4D977A5DF3DC4858749

Uniqueness

Uniqueness Score: -1.00%

Function 0048F830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0048F847
GetProcAddress.KERNEL32 ref: 0048F864
FreeLibrary.KERNEL32 ref: 0048F87D

Strings

AddVectoredExceptionHandler, xrefs: 0048F85A
kernel32.dll, xrefs: 0048F840

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: AddVectoredExceptionHandler$kernel32.dll
API String ID: 145871493-3472422323
Opcode ID: ab37f468bea37ba46b4a664bc76add9a2c6e4178b501be442a672e524db67aac
Instruction ID: 0eea77c9171ebbfe8c08dfcea84eb41c8a8d21199cbd13515ecbc40085fc2254
Opcode Fuzzy Hash: ab37f468bea37ba46b4a664bc76add9a2c6e4178b501be442a672e524db67aac
Instruction Fuzzy Hash: 66F0ED94702A1291EF19BB53BC547276294BB5DBCDF84582A8D2E07350EF3CE559C309

Uniqueness

Uniqueness Score: -1.00%

Function 00441000 Relevance: 8.2, Strings: 6, Instructions: 744COMMON

Download Yara Rule

Strings

.llvm./OiMaDBRllUmmrxLJPqTGLaglesdVyVFFgSaayyPGbI, xrefs: 0044102A
__ZN, xrefs: 00441463
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 00441B48
Y#J, xrefs: 00441AC9
Y#J, xrefs: 00441ADA
Y#J, xrefs: 00441AF5

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcmp
String ID: .llvm./OiMaDBRllUmmrxLJPqTGLaglesdVyVFFgSaayyPGbI$Y#J$Y#J$Y#J$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 1475443563-657663821
Opcode ID: a9fbf98e65a0da690d528a7e7cef880fdab51d7bf43ce19cd081426010f3b092
Instruction ID: 84714ee40e54b8e11084452afd1c5b8bb096dfd15543b4d1b85f2fcfee379188
Opcode Fuzzy Hash: a9fbf98e65a0da690d528a7e7cef880fdab51d7bf43ce19cd081426010f3b092
Instruction Fuzzy Hash: 3A426A63619AE081FB258B15A4143AABB61F3867E0F454213EEAA077F4DB7CC9C5C709

Uniqueness

Uniqueness Score: -1.00%

Function 0041B810 Relevance: 8.0, Strings: 6, Instructions: 478COMMON

Download Yara Rule

Strings

0, xrefs: 0041B91D
attempt to divide by zero, xrefs: 0041BE77
XdI, xrefs: 0041B8A5
0, xrefs: 0041C03E
'jI, xrefs: 0041BE7E
00000000, xrefs: 0041B90E

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: 'jI$0$0$00000000$XdI$attempt to divide by zero
API String ID: 0-3811247818
Opcode ID: d49143d972736a046fde8eab027f74fdcffa779296a7720396c4f371e3f1df56
Instruction ID: c88297406210c34f85b7c38ee61fad107e0b4f879bc99359aaeb265eacd88112
Opcode Fuzzy Hash: d49143d972736a046fde8eab027f74fdcffa779296a7720396c4f371e3f1df56
Instruction Fuzzy Hash: 6302F072718B8082DB21CB15F4403DAB7A6F795390F548227EE8947FA8DB7CC586C789

Uniqueness

Uniqueness Score: -1.00%

Function 00430FB4 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 00430554: memcpy.NTDLL ref: 0043058C

memcpy.NTDLL ref: 00431229

Strings

setybdet, xrefs: 0043107F
uespemos, xrefs: 00431049
modnarod, xrefs: 0043106D
arenegyl, xrefs: 0043105B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 3510742995-66988881
Opcode ID: d6a961b00d81f5459af3c09f95c94ab5543153d716f2545fabc39b2ee1db5838
Instruction ID: 86a60e7317e0fb74e0ed9b0f614f15c1a1cd60536e454e189f311c5492e6ad96
Opcode Fuzzy Hash: d6a961b00d81f5459af3c09f95c94ab5543153d716f2545fabc39b2ee1db5838
Instruction Fuzzy Hash: 2E519172709BC481EAA1CB29B9553EAB3A5F7887D8F409226DECC47B59DF38C195C700

Uniqueness

Uniqueness Score: -1.00%

Function 0048E400 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0048E445
GetCurrentProcessId.KERNEL32 ref: 0048E450
GetCurrentThreadId.KERNEL32 ref: 0048E459
GetTickCount.KERNEL32 ref: 0048E461
QueryPerformanceCounter.KERNEL32 ref: 0048E46E

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 61f4a9df2537ea37a6e3898f23504ad59bfee1fa9fc981564dd512a909282612
Instruction ID: dc8478db8f4840bae8e2509db5a9fd150e89d561178b5d4015606a2eec34f6ac
Opcode Fuzzy Hash: 61f4a9df2537ea37a6e3898f23504ad59bfee1fa9fc981564dd512a909282612
Instruction Fuzzy Hash: E9119EA6711A1086FB606B25FC0831A73A0B748BB4F480B75DE9C437A4DF3CD886C308

Uniqueness

Uniqueness Score: -1.00%

Function 00441BF0 Relevance: 7.0, Strings: 5, Instructions: 767COMMON

Download Yara Rule

Strings

called `Option::unwrap()` on a `None` value, xrefs: 0044268C
,(><&*@, xrefs: 0044226B
called `Result::unwrap()` on an `Err` value, xrefs: 004426F9
::_$, xrefs: 00441EE3, 00441F8A
)Unknown (, xrefs: 0044240C

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: )Unknown ($,(><&*@$::_$$called `Option::unwrap()` on a `None` value$called `Result::unwrap()` on an `Err` value
API String ID: 0-4065487196
Opcode ID: ae1fbbd06b84d83adae7b4527875302d652ac62faa9584a3f976ec999ffd1f91
Instruction ID: d289d34936cf44d9f71101c7ea7d750c372a470426191d9084b260b0739150fe
Opcode Fuzzy Hash: ae1fbbd06b84d83adae7b4527875302d652ac62faa9584a3f976ec999ffd1f91
Instruction Fuzzy Hash: 6042AAB63246A041FB388B21EA4476B6B52F3467D4F844207EE5A07BB4DB7CC586D709

Uniqueness

Uniqueness Score: -1.00%

Function 0043883F Relevance: 6.9, APIs: 5, Instructions: 615COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00438DC1
memset.NTDLL ref: 00438E42
memcpy.NTDLL ref: 0043918B
memcpy.NTDLL ref: 004391A6
memcpy.NTDLL ref: 00439319

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 3cbf7954c7ac19cd872a36c18ecd42f4e006e4b3d351482e5bacb20065a5abe3
Instruction ID: ecbd55fc89aae40571085766d48310d3a66aa81d59db8928474ced0804f6ef96
Opcode Fuzzy Hash: 3cbf7954c7ac19cd872a36c18ecd42f4e006e4b3d351482e5bacb20065a5abe3
Instruction Fuzzy Hash: 8E32A7B2A14FC541E712AB36A4037EAE310EBDA7C4F409316EEC577A5ADB6CD2469304

Uniqueness

Uniqueness Score: -1.00%

Function 0043132E Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 321threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 0043158D
SwitchToThread.KERNEL32 ref: 004315D8

Strings

, xrefs: 0043166B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-3916222277
Opcode ID: 80c3090f468f8ab63ea3e105ee428b631cf45ff8f7dcd9be1069169cde2a23fb
Instruction ID: d43db5c1f59473ec999592a8865e8f4c4d07295c1afe12a09e4f7b6d4ba668bf
Opcode Fuzzy Hash: 80c3090f468f8ab63ea3e105ee428b631cf45ff8f7dcd9be1069169cde2a23fb
Instruction Fuzzy Hash: 01C1D172305B8082DA15DB12E5553AB63A1F78DBD8F48A12BEE9E4B764DF3CC481C708

Uniqueness

Uniqueness Score: -1.00%

Function 00424D7E Relevance: 5.5, APIs: 4, Instructions: 533COMMON

Download Yara Rule

APIs

memset.NTDLL(?,488945008941CB87,00000001,00000000,00000000,?,0040290E,00000000,004243FA), ref: 00424DB7
memset.NTDLL(?,488945008941CB87,00000001,00000000,00000000,?,0040290E,00000000,004243FA), ref: 00424DCC
memset.NTDLL(?,488945008941CB87,00000001,00000000,00000000,?,0040290E,00000000,004243FA), ref: 00424F07
memset.NTDLL(?,488945008941CB87,00000001,00000000,00000000,?,0040290E,00000000,004243FA), ref: 00424F9D

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 7f335c9250b97e908343c838c2965154c49730e8cab2f3ac42cdfbf4906a71ff
Instruction ID: 8dbbe1f63cc60688237407ca9bc22ba41a0d747ca664d9effe832745c8639f13
Opcode Fuzzy Hash: 7f335c9250b97e908343c838c2965154c49730e8cab2f3ac42cdfbf4906a71ff
Instruction Fuzzy Hash: EB1241B2B25AB0D2DB25DB54F4047BA6321F784788FD48623DB0A53798EB7CC582C709

Uniqueness

Uniqueness Score: -1.00%

Function 00417AE0 Relevance: 5.3, Strings: 4, Instructions: 315COMMON

Download Yara Rule

Strings

assertion failed: d.mant > 0, xrefs: 00417F68
attempt to divide by zero, xrefs: 00417DE6
XqI, xrefs: 00417AE9
assertion failed: d.mant < (1 << 61), xrefs: 00417F82

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: XqI$assertion failed: d.mant < (1 << 61)$assertion failed: d.mant > 0$attempt to divide by zero
API String ID: 0-2920975873
Opcode ID: f6e213385f5e3645ed938b50a3447a75cc577c76f55e3499e78f3aad169f463d
Instruction ID: fdf9b0d7b5122ac96ed0384b7d8086ea3dbe294d1807775ab3b2d0de94ff3748
Opcode Fuzzy Hash: f6e213385f5e3645ed938b50a3447a75cc577c76f55e3499e78f3aad169f463d
Instruction Fuzzy Hash: 83A14476718B9483DF198B15F9513BA6362F784BC4F94802AEE4E07B54EB3CCA86C744

Uniqueness

Uniqueness Score: -1.00%

Function 0048327F Relevance: 5.3, Strings: 4, Instructions: 297COMMON

Download Yara Rule

Strings

A Tokio 1.x context was found, but IO is disabled. Call `enable_io` on the runtime builder to enable IO.A Tokio 1.x context was found, but timers are disabled. Call `enable_time` on the runtime builder to enable timers.Oh no! We never placed the Core back, thi, xrefs: 00483294
combase.dll, xrefs: 004833D2
+tJ, xrefs: 004836E7
KtJ, xrefs: 004836B7

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: +tJ$A Tokio 1.x context was found, but IO is disabled. Call `enable_io` on the runtime builder to enable IO.A Tokio 1.x context was found, but timers are disabled. Call `enable_time` on the runtime builder to enable timers.Oh no! We never placed the Core back, thi$KtJ$combase.dll
API String ID: 0-1648023280
Opcode ID: 97889389801c0df76fad06953a0a00721124a2401b0a08f572f5dc885e1c142c
Instruction ID: b8207f63cdcad3b28ff04baf28de24f4cc073345f2791ca60a6afbde284357e6
Opcode Fuzzy Hash: 97889389801c0df76fad06953a0a00721124a2401b0a08f572f5dc885e1c142c
Instruction Fuzzy Hash: 22C1CC72605B8082DB21EF15E8403AEB3A5F798B98F94862ADF8D47754DF3DC696C304

Uniqueness

Uniqueness Score: -1.00%

Function 004397A4 Relevance: 5.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000,00000007,?,?,?,?,?,?,004396D2), ref: 0043987E
memset.NTDLL(?,?,?,?,00000000,00000007,?,?,?,?,?,?,004396D2), ref: 00439900
memcpy.NTDLL(?,?,?,?,00000000,00000007,?,?,?,?,?,?,004396D2), ref: 004399D6
memcpy.NTDLL(?,?,?,?,00000000,00000007,?,?,?,?,?,?,004396D2), ref: 00439B15

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: e65aad6c6b8abc5ab80afe002dfa2931fafb2928917169ddaa4ddde3890c33a2
Instruction ID: 4f0a2f0dda179fc26cf5308adbcc2f687903c0ccfbf48921750c1c6dedf49876
Opcode Fuzzy Hash: e65aad6c6b8abc5ab80afe002dfa2931fafb2928917169ddaa4ddde3890c33a2
Instruction Fuzzy Hash: B091F262318B8081DE04DF2AA81526AA710F78ABF4F54571AEFBE177D8DB7CC406C304

Uniqueness

Uniqueness Score: -1.00%

Function 004242F5 Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 646COMMON

Download Yara Rule

Strings

assertion failed: code < MAX_HUFF_SYMBOLS_2, xrefs: 00424D26

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memset
String ID: assertion failed: code < MAX_HUFF_SYMBOLS_2
API String ID: 2221118986-707042715
Opcode ID: c2a41aa19f471dff5bec8b6854dc63d54ff3a806762e3a80ddfef0376051333c
Instruction ID: 938964da60f64e2201080b3ac2ffbc6a3d42b755ef6072566c2dc2608b6df070
Opcode Fuzzy Hash: c2a41aa19f471dff5bec8b6854dc63d54ff3a806762e3a80ddfef0376051333c
Instruction Fuzzy Hash: A532E4623046B482EB20DF56F8407AA6B61F7C5BC8FC54127EE8A07B99DB7CC546C748

Uniqueness

Uniqueness Score: -1.00%

Function 004334BF Relevance: 5.1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

Strings

arenegyl, xrefs: 004334E2
setybdet, xrefs: 004334EF
modnarod, xrefs: 004334D5
uespemos, xrefs: 004334C8

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 0-66988881
Opcode ID: 0e2e4ac79e97f4a3adb0fa019166014f788f7ad65e4934c0cf2dd50860d5408c
Instruction ID: 41aa8c295c9d3c80d8bfa506ce5fdd371d0d6f6239b88f5e3a96f88b802e9a7c
Opcode Fuzzy Hash: 0e2e4ac79e97f4a3adb0fa019166014f788f7ad65e4934c0cf2dd50860d5408c
Instruction Fuzzy Hash: 8E31E7A2704B8043FBA4DBA9B62536BE276FB553C4F50E521CFC953A09DF2CD2928344

Uniqueness

Uniqueness Score: -1.00%

Function 0047CA4A Relevance: 4.7, APIs: 3, Instructions: 214timeCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32 ref: 0047CAF1

Part of subcall function 00488B6F: GetLastError.KERNEL32 ref: 00488B73

GetProcessIoCounters.KERNEL32 ref: 0047CC4E
GetProcessMemoryInfo.PSAPI ref: 0047CCC4

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Process$CountersErrorInfoLastMemorySystemTimes
String ID:
API String ID: 2944460643-0
Opcode ID: 1518e3484bd2782c95c5f1060e862f7446bf5b54fef01aa152661e13e76017be
Instruction ID: 469ddaf8d0f9ae7ffedd3d88bc831b08b2eb7d791459289ab88da7a15403c85e
Opcode Fuzzy Hash: 1518e3484bd2782c95c5f1060e862f7446bf5b54fef01aa152661e13e76017be
Instruction Fuzzy Hash: 6C811562714BC492EB298B36D5813EAA761FB98794F04C61AEF9C17795EF3CD0A1C304

Uniqueness

Uniqueness Score: -1.00%

Function 00417280 Relevance: 4.1, Strings: 3, Instructions: 367COMMON

Download Yara Rule

Strings

+NaNinf0e0assertion failed: buf.len() >= maxlen, xrefs: 00417280
attempt to divide by zero, xrefs: 004176A6
XqI, xrefs: 00417289, 0041728B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: +NaNinf0e0assertion failed: buf.len() >= maxlen$XqI$attempt to divide by zero
API String ID: 0-3571489180
Opcode ID: 99ab7d2fa5adb3354e88939740edd84786617a36738e07e8046a0fdbe6726dba
Instruction ID: a5bd7c9ebf0f8c8daad028e18f8b83ebb7356ecb52877ef5e97b1c7c49d29918
Opcode Fuzzy Hash: 99ab7d2fa5adb3354e88939740edd84786617a36738e07e8046a0fdbe6726dba
Instruction Fuzzy Hash: 74C16972718B9883DA18CF65B400BDAB761F388BD0F449226EE9D57B58DB3CC586C704

Uniqueness

Uniqueness Score: -1.00%

Function 00479CA0 Relevance: 4.0, Strings: 3, Instructions: 291COMMON

Download Yara Rule

Strings

GenuineI, xrefs: 0047A086
HygonGen, xrefs: 0047A055
Authenti, xrefs: 0047A039

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: Authenti$GenuineI$HygonGen
API String ID: 0-696657513
Opcode ID: 97c82de521e095cda28841b519dad7209233ccad7926698d449bf0ed4b5ca1da
Instruction ID: 7883b45e56d60f5975dde5311b82e783ca3e9b75b4eef9dd272f95bae8a0762f
Opcode Fuzzy Hash: 97c82de521e095cda28841b519dad7209233ccad7926698d449bf0ed4b5ca1da
Instruction Fuzzy Hash: B3818CA3731A9003FB198A56BD11BEA4C42A358BD4F19B139ED5FABB85D47CCE11C341

Uniqueness

Uniqueness Score: -1.00%

Function 00410F6F Relevance: 4.0, Strings: 3, Instructions: 262COMMON

Download Yara Rule

Strings

UUUUUUUU, xrefs: 00411128
33333333, xrefs: 0041118E
33333333, xrefs: 0041120D

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: 33333333$33333333$UUUUUUUU
API String ID: 0-629463729
Opcode ID: f95bc4fc9f0fe95432c6fe7fe7d6f0f3dc957c626e02b524f7a61251949a2eb6
Instruction ID: 296b82eaeb26396f230522c18e05055e28d795045825ba71ecc54f5a15c33345
Opcode Fuzzy Hash: f95bc4fc9f0fe95432c6fe7fe7d6f0f3dc957c626e02b524f7a61251949a2eb6
Instruction Fuzzy Hash: 6391B0A1314B4486F6509B62F924BD76250F389BE4F48903BEF9E17F69DE3CC586C209

Uniqueness

Uniqueness Score: -1.00%

Function 00467C10 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 368COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00467C2F

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 00467BAC

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CommandLine
String ID: internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 3253501508-2307832163
Opcode ID: b12c18f3697bb5783e188227ebd4835d18fbdf670b0375a1598087101644dc8a
Instruction ID: 7728f8c7623ab2bfbf8561457c2605a714337b3a24afc8f2ca6b95453b9998a4
Opcode Fuzzy Hash: b12c18f3697bb5783e188227ebd4835d18fbdf670b0375a1598087101644dc8a
Instruction Fuzzy Hash: 62E1C262628B8482DB248B16E0403BBB761F79978CF545606FF8A07B59EF7CC585CB09

Uniqueness

Uniqueness Score: -1.00%

Function 0047BFDF Relevance: 3.6, APIs: 2, Instructions: 607nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 0047C087
NtQueryInformationProcess.NTDLL ref: 0047C1E0

Part of subcall function 0047CE66: wcslen.NTDLL ref: 0047CEC0
Part of subcall function 0047CE66: LocalFree.KERNEL32 ref: 0047CEE7

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: InformationProcessQuery$FreeLocalwcslen
String ID:
API String ID: 414701844-0
Opcode ID: 1813fb307c56ac4eedddedeb7be9ec27132141ba5c3f6a8ca23b1bf87d9edf69
Instruction ID: f21afbf0180f204848dbedbbbb1efcb07f3ee5cbf003c94b0d259d6c981466b1
Opcode Fuzzy Hash: 1813fb307c56ac4eedddedeb7be9ec27132141ba5c3f6a8ca23b1bf87d9edf69
Instruction Fuzzy Hash: AB428162618BC082DA24DB22A4843EFA761F786B88F44C11BEF8D57B55DF7CC189D748

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8C Relevance: 3.5, Strings: 2, Instructions: 963COMMON

Download Yara Rule

Strings

33333333, xrefs: 00412598
UUUUUUUU, xrefs: 00412536

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: 33333333$UUUUUUUU
API String ID: 0-3483174168
Opcode ID: 46baf53646f265fab371f7c6721777ed7f915a8f7d45b7802b79bd0ac064ac85
Instruction ID: 0a071b0de3450c231dd36477c2ccc71a6c974c4b361aaac83125896d4256ecdd
Opcode Fuzzy Hash: 46baf53646f265fab371f7c6721777ed7f915a8f7d45b7802b79bd0ac064ac85
Instruction Fuzzy Hash: 596226633197D446EA14CFA679606EBAB51F769BC0F44A02ADF8C97B06CE3CD656C300

Uniqueness

Uniqueness Score: -1.00%

Function 0043CE50 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 415COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0043CE79

Strings

punycode{-0, xrefs: 0043D3B1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memset
String ID: punycode{-0
API String ID: 2221118986-3751456247
Opcode ID: 321d999fd51e26f805c0f6eebe461a3935c0d7732bc3d87b501a4a94798b45d8
Instruction ID: 373d71ff763a2bc482054e578264f89d67005aeecf05f95f7bcf4563638b293d
Opcode Fuzzy Hash: 321d999fd51e26f805c0f6eebe461a3935c0d7732bc3d87b501a4a94798b45d8
Instruction Fuzzy Hash: 03D12662B1868486EF24CB16F4447ABA752F39DBD4F44A123DE8D03B98DB3CD956C708

Uniqueness

Uniqueness Score: -1.00%

Function 0047CF27 Relevance: 3.1, APIs: 2, Instructions: 91nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 0047CF53
NtQueryInformationProcess.NTDLL ref: 0047CFFC

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: eb016d4c8b7d49d121b62bf2653c45d848ef442e869e947b6cd84e45a8a07002
Instruction ID: 1d9733a0bfb62f1a90f19336173681d77bc11c300ab6289356b32fbc266be765
Opcode Fuzzy Hash: eb016d4c8b7d49d121b62bf2653c45d848ef442e869e947b6cd84e45a8a07002
Instruction Fuzzy Hash: 3831AE22315A8082DA14DE12EA4479EB362FB85BC8F58D02AEF8D47B58EF3CC581C704

Uniqueness

Uniqueness Score: -1.00%

Function 0042FF42 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(?,?,?,?,?,?,?,?,004354AE), ref: 0042FF87
SystemFunction036.ADVAPI32(?,?,?,?,?,?,?,?,004354AE), ref: 0042FF9B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 2a83835d96c2ce5615055b01b708d90b6e19b4c6f58fdbcccf5eb59f6d80664e
Instruction ID: 5d4319fcb26b7caf40f679439ac2a15c3c0bd8e5db73560caefb519d723246d2
Opcode Fuzzy Hash: 2a83835d96c2ce5615055b01b708d90b6e19b4c6f58fdbcccf5eb59f6d80664e
Instruction Fuzzy Hash: 1E01685230007009FE29666B7E04B6A84912B4ABF4F9A42375E2C4BBD4E43CC8C7830C

Uniqueness

Uniqueness Score: -1.00%

Function 00434C66 Relevance: 2.9, APIs: 2, Instructions: 361COMMON

Download Yara Rule

APIs

Part of subcall function 004341BD: memcpy.NTDLL ref: 00434204

memcpy.NTDLL ref: 00435132
memcpy.NTDLL ref: 00435190

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: a8704fd37a76cc091c24c8854490feac14f23b842586395b0ded2e87eed1d57f
Instruction ID: aca80dab6b6330e5454cd33ed11f5ba701ca210a19d8cf6061e4de21c9cb235e
Opcode Fuzzy Hash: a8704fd37a76cc091c24c8854490feac14f23b842586395b0ded2e87eed1d57f
Instruction Fuzzy Hash: 6B027212918BC481E7724B2DA4063FAE360FFDD798F186712DEC426B65EB79D2868704

Uniqueness

Uniqueness Score: -1.00%

Function 0041C330 Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

combase.dll, xrefs: 0041C43B, 0041C4DA, 0041C7CD, 0041C86D
+NaNinf0e0assertion failed: buf.len() >= maxlen, xrefs: 0041C434, 0041C7D8

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: +NaNinf0e0assertion failed: buf.len() >= maxlen$combase.dll
API String ID: 0-3096168635
Opcode ID: a25525432983313e2b03e1f02b0358e67586244f16374f506d16d19cb98aaabd
Instruction ID: 98495fc73ff1b633c01a5af0d874ff6689883ad44bfa7cecc7b0cf0957c563e6
Opcode Fuzzy Hash: a25525432983313e2b03e1f02b0358e67586244f16374f506d16d19cb98aaabd
Instruction Fuzzy Hash: 08E1067225CBC4C2E7118B10F8917DBB3A5F780394F605226EB9947BA8DB7CC589CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1E8 Relevance: 2.8, Strings: 2, Instructions: 297COMMON

Download Yara Rule

Strings

|uI, xrefs: 0041E093
|uI, xrefs: 0041E1D2

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: |uI$|uI
API String ID: 0-2539331249
Opcode ID: 4a74d6ba880f4baad3fddda17758c6d3cdeba3b63305db97016a5eeb5187ccf0
Instruction ID: 5d3cc2d7525a1b14c1948cebe5183563213d0357e8a30d8a12567628934b752c
Opcode Fuzzy Hash: 4a74d6ba880f4baad3fddda17758c6d3cdeba3b63305db97016a5eeb5187ccf0
Instruction Fuzzy Hash: B9D10976208AC491D6229B6AA4053EAB761FBC9788F459312FFC427715EF3CD396C704

Uniqueness

Uniqueness Score: -1.00%

Function 00484F78 Relevance: 2.8, APIs: 2, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00485059
memset.NTDLL ref: 00485112

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 0796273fd509337b02a22acf0bc0a663c555b96bdaeb5f519eb9da7bd3260f57
Instruction ID: f4865dc44598e4b7b0c1bd817c2d3f75665b6bad09eea33450fff2615611eb24
Opcode Fuzzy Hash: 0796273fd509337b02a22acf0bc0a663c555b96bdaeb5f519eb9da7bd3260f57
Instruction Fuzzy Hash: 97A11F62715F8482CE05DF2A940416EAB61F78ABF4B444B26EFBA177D9EB7CC106C304

Uniqueness

Uniqueness Score: -1.00%

Function 00405648 Relevance: 2.8, APIs: 2, Instructions: 255COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,?,?,?,00000000,?,?,?,?,0040AB85), ref: 0040571F
memset.NTDLL(?,?,?,?,?,?,?,00000000,?,?,?,?,0040AB85), ref: 004057A1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: b1cffbda3cc682d5c61455498491f7106ce7cc6e596ce974e40f1efd59b454ed
Instruction ID: 744bdec38eec7501d0a056eb8be0230a274f7bdb5b5a9b29879647fd88a032fa
Opcode Fuzzy Hash: b1cffbda3cc682d5c61455498491f7106ce7cc6e596ce974e40f1efd59b454ed
Instruction Fuzzy Hash: D691F363318FC482DE118B2AA41526AAB20F786BF4F545726DFBA277D5DB3CC146C704

Uniqueness

Uniqueness Score: -1.00%

Function 0043383B Relevance: 2.8, APIs: 2, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00433915
memset.NTDLL ref: 00433997

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 9144139289ad084ece2a2e4e15c6ba198a9db4af7ebe0fb3cad4ab72cd2bf1b6
Instruction ID: 04e146458e0c40501f6fe62b5f8e926ac3d9b255dfe4764ec8682bbf3bf96ae5
Opcode Fuzzy Hash: 9144139289ad084ece2a2e4e15c6ba198a9db4af7ebe0fb3cad4ab72cd2bf1b6
Instruction Fuzzy Hash: FE912663318B8081DE05CF2AA85526EA720F789BE4F54671AEFBA177D5DB7CC246C304

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD25 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

"""""""", xrefs: 0042CD47
DDDDDDDD, xrefs: 0042CD57

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: """"""""$DDDDDDDD
API String ID: 0-1621327129
Opcode ID: e82bda6f77797387f822c23a123a4d45afcc240e430fc15d0925737bf1b43ce4
Instruction ID: 7d545accb59bb8ef9028e34b5d35b128c64b04f00126e5b02df9422cb1df69b2
Opcode Fuzzy Hash: e82bda6f77797387f822c23a123a4d45afcc240e430fc15d0925737bf1b43ce4
Instruction Fuzzy Hash: 7A115283321175092A3D9EA33E375A3C84D2689FDCA0CF9376D895BBE4D4BED4419145

Uniqueness

Uniqueness Score: -1.00%

Function 0042F4F7 Relevance: 1.7, Strings: 1, Instructions: 458COMMON

Download Yara Rule

Strings

called `Option::unwrap()` on a `None` value, xrefs: 0042F50B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: called `Option::unwrap()` on a `None` value
API String ID: 0-836832528
Opcode ID: 3b4aa7f99d166d688e99fa6bf71025cbedce4b4750aa03c505783a8b834dc229
Instruction ID: 8905fb6942577cf926717702aa1b863b84c5e6f59d5e28081b16a133ea3d40ff
Opcode Fuzzy Hash: 3b4aa7f99d166d688e99fa6bf71025cbedce4b4750aa03c505783a8b834dc229
Instruction Fuzzy Hash: 1A129366E29FC556F313573964032B6E318AFFB2C9F50E316FED071923EB6482829644

Uniqueness

Uniqueness Score: -1.00%

Function 0041B160 Relevance: 1.6, APIs: 1, Instructions: 348COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 0041B1D0

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a9c13f44090e9e6954c15afa12610d26ec8e390c726443b1afb3d8ed8bf43764
Instruction ID: de4b80d2d3058092cbfcdd218bf8d46c832f1ee48023979450bee98350ead737
Opcode Fuzzy Hash: a9c13f44090e9e6954c15afa12610d26ec8e390c726443b1afb3d8ed8bf43764
Instruction Fuzzy Hash: 0DB1A9723296F882EB15CF229914FEB6612F315BD4F848612DE5E43B80DB3CD596C348

Uniqueness

Uniqueness Score: -1.00%

Function 0044C090 Relevance: 1.6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

combase.dll, xrefs: 0044C3C0

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: combase.dll
API String ID: 0-3462769975
Opcode ID: 17c47dc7772a5b4ef613d6374551eb836a716ee6884e7006e4a4bac9be78403b
Instruction ID: aec7ecb54b2d372bf45fca51d9d8fc494405bcee77636e52a2f1c4af03153ccf
Opcode Fuzzy Hash: 17c47dc7772a5b4ef613d6374551eb836a716ee6884e7006e4a4bac9be78403b
Instruction Fuzzy Hash: ECB19A9290B7E448FBA28EB495D077B7A41A302765F5C9323CE7A133D1D6BC4D829348

Uniqueness

Uniqueness Score: -1.00%

Function 00423938 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

assertion failed: d.params.flush_remaining == 0, xrefs: 00423E89

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: assertion failed: d.params.flush_remaining == 0
API String ID: 0-1590815299
Opcode ID: a5c3c6e170c71936f0b8e1769233d6f9af4e14e6bf963f45648a81ec27f10da8
Instruction ID: 9ee4a2cf212c744f2f934138f3b6947dd4faed62d2361ea9c07c5273678cd6a4
Opcode Fuzzy Hash: a5c3c6e170c71936f0b8e1769233d6f9af4e14e6bf963f45648a81ec27f10da8
Instruction Fuzzy Hash: 5BD1CC733146A483DB25CF26F4407AAB761F789B84F84402AEBDA47751CBBCD285CB08

Uniqueness

Uniqueness Score: -1.00%

Function 004711E0 Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

combase.dll, xrefs: 0047161B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: combase.dll
API String ID: 0-3462769975
Opcode ID: 5043724ec6dc7f03036f92ebdf5373eeb92e17295d77b8d046798ad5fd60fd33
Instruction ID: e07bd22124b8dfe67defe62ac28f6fd9fa923babb317181663821ade7cde92e6
Opcode Fuzzy Hash: 5043724ec6dc7f03036f92ebdf5373eeb92e17295d77b8d046798ad5fd60fd33
Instruction Fuzzy Hash: B9B125A2628A5082DB298B29E5003BFA761F7957D4F14D623DE9F47BB1EB7CC541C308

Uniqueness

Uniqueness Score: -1.00%

Function 0042BAEE Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

attempted to use a condition variable with more than one mutexparking_lot-0.12.1qFdlRSHPsunnjmE, xrefs: 0042BEF9

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: FrequencyPerformanceQuery
String ID: attempted to use a condition variable with more than one mutexparking_lot-0.12.1qFdlRSHPsunnjmE
API String ID: 4204123506-2751842173
Opcode ID: 6ba42684f77495271f1616431677e3f2eb87a90f045571af1c12e780512e1eec
Instruction ID: a1a28783271356bf9f3de577a6926835c465777c756402698192dc9c1620d9c6
Opcode Fuzzy Hash: 6ba42684f77495271f1616431677e3f2eb87a90f045571af1c12e780512e1eec
Instruction Fuzzy Hash: 94A1E122311B2082DA29DB27B4117AA6790FB85BD8FD5842BDF5E47B44DF3CC5528388

Uniqueness

Uniqueness Score: -1.00%

Function 0043E7A0 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

called `Option::unwrap()` on a `None` value, xrefs: 0043E91B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcmp
String ID: called `Option::unwrap()` on a `None` value
API String ID: 1475443563-836832528
Opcode ID: 2e58d57143b04be2ce3c76ffef4ada802adac15d07861d973fd09cec4f3b8796
Instruction ID: 173f504738b1bd8ca981ec7127ab88526dbd0ea4d2ed7c1900fc025c806411c8
Opcode Fuzzy Hash: 2e58d57143b04be2ce3c76ffef4ada802adac15d07861d973fd09cec4f3b8796
Instruction Fuzzy Hash: 67913562B1A29486EB35DB16B4007ABAB51F78D7D4F146122EE8B17BD4DB3CC582C708

Uniqueness

Uniqueness Score: -1.00%

Function 0048794D Relevance: 1.5, APIs: 1, Instructions: 262COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00487C3A

Part of subcall function 004289DB: memcpy.NTDLL(?,?,?,00000000,?,?,00000000,0042C9A2,?,?,?,?,00000002,?,?,?), ref: 00428A34

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 75b2ed69c57ce6a5f69bb3bb863d769e93eb4fe23fbcdd3f2c8fb395f5c15513
Instruction ID: bb9e7c2b0a6cb943c96c697273cb3cacd995e725e55e5809d36f8240d52b69b2
Opcode Fuzzy Hash: 75b2ed69c57ce6a5f69bb3bb863d769e93eb4fe23fbcdd3f2c8fb395f5c15513
Instruction Fuzzy Hash: 3BB12322618BC082E725AB26E4503AFB7A1FB95788F24961ADFD907751EF3CD4D5C304

Uniqueness

Uniqueness Score: -1.00%

Function 0047D854 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0047D85C

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f426774c392260af1b7f8fda7648da0c6b791c0766dbf910027d42f07e2f73e6
Instruction ID: 581b9c653aa62ac51f094554a4a7e6ec829c93198f32bef309c9d5905b5aacb4
Opcode Fuzzy Hash: f426774c392260af1b7f8fda7648da0c6b791c0766dbf910027d42f07e2f73e6
Instruction Fuzzy Hash: C6E0E5A2F1065182E728EBB6B4903BA61A09F587B0F50C73597BA5BBC0DA6D95D38304

Uniqueness

Uniqueness Score: -1.00%

Function 00422850 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1075ebe371b76b33bb26d3309c677d132020f4325056ec399139dfa53e378657
Instruction ID: 7f87f4f748df8a5f19086b20a75ac36d7a71c9b80ff66459d0622079e90b8427
Opcode Fuzzy Hash: 1075ebe371b76b33bb26d3309c677d132020f4325056ec399139dfa53e378657
Instruction Fuzzy Hash: 3122F6BBBB956003D71C8B1ADC5279A6193B7D4398B9DF13C9D4AC3F08E93DD6024A44

Uniqueness

Uniqueness Score: -1.00%

Function 00411ACC Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8bd889c62f85ac2c482896e9e4ea4ee0587881fadd2f4eb09831d29235ba27
Instruction ID: 07266571967091d3f2c42e052c2f097964bfd40f906ad868ffd32a915348593e
Opcode Fuzzy Hash: 2b8bd889c62f85ac2c482896e9e4ea4ee0587881fadd2f4eb09831d29235ba27
Instruction Fuzzy Hash: 2F22F6B3719B9441FA50DFA2BC60BE7A691F799BC0F44A026DE8D93B19CE3CC6419704

Uniqueness

Uniqueness Score: -1.00%

Function 00426473 Relevance: .5, Instructions: 530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e3e90418b820e115bf51de40a188c82a7cddf6452ecb5809a1e89d9a6e40a5
Instruction ID: 6e5e8b17e610c1451c3a6f58ca0935ad187bebecc16bd62c178ba516432e7f0a
Opcode Fuzzy Hash: 12e3e90418b820e115bf51de40a188c82a7cddf6452ecb5809a1e89d9a6e40a5
Instruction Fuzzy Hash: F122CD763186A087D724CF19F4817AFB7A0F385794F90512BEE9A83B58DA3CD485CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00413E20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4030dbe660ae13c20b22a860f7fb6e88b6815587588acdf08c7c5f55e59f70fb
Instruction ID: dff84c7358b44f52e3339f83a49e36b2912828378b631676df0a4c3da37fd90f
Opcode Fuzzy Hash: 4030dbe660ae13c20b22a860f7fb6e88b6815587588acdf08c7c5f55e59f70fb
Instruction Fuzzy Hash: AE819AA6F39BA101EA17873D19027E54600AFA3BE0F45D717EDB571BE0E72D96C38208

Uniqueness

Uniqueness Score: -1.00%

Function 0041141C Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca402bfd1018907c76a88ea70f2170d258e215d81cdd780eabfe2e7dc937523
Instruction ID: b734b0a1cc21e3ebfd206ca87b1ab130e9561f3f919b8e921f59e28f6b6fd6a3
Opcode Fuzzy Hash: eca402bfd1018907c76a88ea70f2170d258e215d81cdd780eabfe2e7dc937523
Instruction Fuzzy Hash: 628191A2714BA441FA10CFF1A920BD7A762F3897D8F14A026EF9D57F58DA3CC592C604

Uniqueness

Uniqueness Score: -1.00%

Function 0043F830 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f3b7cc4f17fe95880d4d35af53ea3ecb0c73a1e177befa7b76899b75539604
Instruction ID: a294a3cb9d2ba0b74b792eb9f23925c68b1d407b402e8900b309755f704c3a94
Opcode Fuzzy Hash: 14f3b7cc4f17fe95880d4d35af53ea3ecb0c73a1e177befa7b76899b75539604
Instruction Fuzzy Hash: 7B81CDE6F29BA101EA27833D69027F54A105FA37A4F45D727FC7570BE0E729D6835208

Uniqueness

Uniqueness Score: -1.00%

Function 00427712 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d8c390e470457bf7e02226dcc6fc421f15d5cf2b71e5b6b8d84b3a5c73121e
Instruction ID: c70582ee95a4a8dcf593a3b0f8d277d129299f29610cd3fac5ed20c450250c2c
Opcode Fuzzy Hash: 29d8c390e470457bf7e02226dcc6fc421f15d5cf2b71e5b6b8d84b3a5c73121e
Instruction Fuzzy Hash: 938146B27186A093E71A8B14F5297FB6361FB90355FD08123EB4343390EB3D9692D748

Uniqueness

Uniqueness Score: -1.00%

Function 0047BAA8 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf5531ac3a95f666b4b12f90854ffd933ed9107490e9deaf61f6adabbd6006a
Instruction ID: 676d2aea85f6447aa79c6c7ac2f4b269e503a6fc0bbe72e2e0beef09170d9d6c
Opcode Fuzzy Hash: caf5531ac3a95f666b4b12f90854ffd933ed9107490e9deaf61f6adabbd6006a
Instruction Fuzzy Hash: 98415D137196814AEB219629D5013EB6B40F3597ECF44D227FE8E0B789CB2CC591D385

Uniqueness

Uniqueness Score: -1.00%

Function 00437BA5 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920d8386a230a8c84484f83d3fdfa02ba8a46dba23d60a80b8b69712ce0703e8
Instruction ID: 676467b68f19a8efded34dbaaab8217d1ae6747736a090a12cc106f48ae5c27b
Opcode Fuzzy Hash: 920d8386a230a8c84484f83d3fdfa02ba8a46dba23d60a80b8b69712ce0703e8
Instruction Fuzzy Hash: C51198E5B44A8043FE94E7AD77250AA9223EA153D4F90F431CF49A790EDE1DD1938284

Uniqueness

Uniqueness Score: -1.00%

Function 0042CE47 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb517ad18f2d65eca0f2234db22ed7aa1acbfa689edd96805bb303a2af21e944
Instruction ID: 44d0d03b7a397381b3b844002aaeb1e015a09327c153d625171a7593bccaed49
Opcode Fuzzy Hash: cb517ad18f2d65eca0f2234db22ed7aa1acbfa689edd96805bb303a2af21e944
Instruction Fuzzy Hash: E9213A99C2AFAA42E703A73D6803356E3005EFB94D550E747FDF039AA4F34265D23225

Uniqueness

Uniqueness Score: -1.00%

Function 00445932 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510721d10e423bff97681af66037e79e14685f3b84e305f23f7642f0534ab758
Instruction ID: 559fe6c4071f72103e1213253803107ac0a374565760a17e229d32d8776c3bba
Opcode Fuzzy Hash: 510721d10e423bff97681af66037e79e14685f3b84e305f23f7642f0534ab758
Instruction Fuzzy Hash: A2F0B4E1B91AB443A1C09F757910C869620B544FC4B52F022DF4C77749C639CD43C244

Uniqueness

Uniqueness Score: -1.00%

Function 004B8A18 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2887fb67f18c433f74088a7ae75e69382aeaa2a545cd63b3f8ff4c471fad8961
Instruction ID: d357293fa05583796a359cf260b41ee469a878c3ac3e079506a1453b1f80d6a9
Opcode Fuzzy Hash: 2887fb67f18c433f74088a7ae75e69382aeaa2a545cd63b3f8ff4c471fad8961
Instruction Fuzzy Hash: 9AC002CBB6EED4959A76A9540CBD1892A8694BAA2934D804F8F4017392AD4A2C089275

Uniqueness

Uniqueness Score: -1.00%

Function 0042C2EF Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NtCreateKeyedEvent, xrefs: 0042C3F9
WakeByAddressSingle, xrefs: 0042C3C3
NtWaitForKeyedEvent, xrefs: 0042C42F
NtReleaseKeyedEvent, xrefs: 0042C414
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0042C398
ntdll.dll, xrefs: 0042C3E1
WaitOnAddress, xrefs: 0042C3AC
parking_lot requires either NT Keyed Events (WinXP+) or WaitOnAddress/WakeByAddress (Win8+)parking_lot_core-0.9.9vBdcyMJtwpgTFAaDDgHsexSbELRdLNUlc, xrefs: 0042C4BD

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AcquireLockShared
String ID: NtCreateKeyedEvent$NtReleaseKeyedEvent$NtWaitForKeyedEvent$WaitOnAddress$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0.dll$ntdll.dll$parking_lot requires either NT Keyed Events (WinXP+) or WaitOnAddress/WakeByAddress (Win8+)parking_lot_core-0.9.9vBdcyMJtwpgTFAaDDgHsexSbELRdLNUlc
API String ID: 3339848070-2994817840
Opcode ID: 8b81545620d476c9c3cc121a478b0f3a4811194f4514c240673f70518528c69c
Instruction ID: 9e835cadab2cfb9817a6b41617763368529196ded35e139a40528c92a050e05c
Opcode Fuzzy Hash: 8b81545620d476c9c3cc121a478b0f3a4811194f4514c240673f70518528c69c
Instruction Fuzzy Hash: 4A911662701A6091EB15EB16F9803AE3360F798BD8F99852BDE1D47394DF3CC596C348

Uniqueness

Uniqueness Score: -1.00%

Function 0042C37A Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000002,00000000,?,00000000,?,0042C652,?,00000000,?,0042CC1B), ref: 0042C39F
GetProcAddress.KERNEL32(00000002,00000001,?,?,?,00000000), ref: 0042C3B6
GetProcAddress.KERNEL32(00000002,00000001,?,?,?,00000000), ref: 0042C3CD
GetModuleHandleA.KERNEL32(00000002,00000000,?,00000000,?,0042C652,?,00000000,?,0042CC1B), ref: 0042C3E8
GetProcAddress.KERNEL32(00000002,00000001,?,?,?,00000000), ref: 0042C403
GetProcAddress.KERNEL32(00000002,00000001,?,?,?,00000000), ref: 0042C41E
GetProcAddress.KERNEL32(00000002,00000001,?,?,?,00000000), ref: 0042C439
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0042C2ED), ref: 0042C494

Strings

NtCreateKeyedEvent, xrefs: 0042C3F9
WakeByAddressSingle, xrefs: 0042C3C3
NtWaitForKeyedEvent, xrefs: 0042C42F
NtReleaseKeyedEvent, xrefs: 0042C414
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0042C398
ntdll.dll, xrefs: 0042C3E1
WaitOnAddress, xrefs: 0042C3AC
parking_lot requires either NT Keyed Events (WinXP+) or WaitOnAddress/WakeByAddress (Win8+)parking_lot_core-0.9.9vBdcyMJtwpgTFAaDDgHsexSbELRdLNUlc, xrefs: 0042C4BD

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AddressProc$Handle$Module$Close
String ID: NtCreateKeyedEvent$NtReleaseKeyedEvent$NtWaitForKeyedEvent$WaitOnAddress$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0.dll$ntdll.dll$parking_lot requires either NT Keyed Events (WinXP+) or WaitOnAddress/WakeByAddress (Win8+)parking_lot_core-0.9.9vBdcyMJtwpgTFAaDDgHsexSbELRdLNUlc
API String ID: 3875313662-2994817840
Opcode ID: 33280ba422780f1ef0248bb5d7f2dbba16320121734e77568f69e465c8d6a8ad
Instruction ID: d582f6c185047462d2ac521702e50daba40bca3450a6fa3a4a3c46fdeb18d6af
Opcode Fuzzy Hash: 33280ba422780f1ef0248bb5d7f2dbba16320121734e77568f69e465c8d6a8ad
Instruction Fuzzy Hash: 7D31416130262090EE15FB12F9A177F6791AB98BD4F88883B9E1D87759EF3CC545C348

Uniqueness

Uniqueness Score: -1.00%

Function 00448A40 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 265
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL ref: 00448A6D
GetStdHandle.KERNEL32(?,?,?,?,?,00000669,00000000,?,00000651,00000661,004488EA), ref: 00448ABE
GetLastError.KERNEL32(?,?,?,?,?,00000669,00000000,?,00000651,00000661,004488EA), ref: 00448AD1
WaitForSingleObject.KERNEL32 ref: 00448BE8
RtlNtStatusToDosError.NTDLL ref: 00448C80
CloseHandle.KERNEL32 ref: 00448E9C

Strings

RJ, xrefs: 00448D82
combase.dll, xrefs: 00448D9A
DRJ, xrefs: 00448C72, 00448CC4, 00448D6A
QJ, xrefs: 00448E79
QJ, xrefs: 00448E2E
QJ, xrefs: 00448E3F
QJ, xrefs: 00448DB4
QJ, xrefs: 00448E5F

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorHandle$CloseLastObjectSingleStatusWaitmemcpy
String ID: QJ$ QJ$ QJ$ QJ$ QJ$DRJ$combase.dll$RJ
API String ID: 2941158195-1545324714
Opcode ID: b13a209da27f0e33313615338ce8ab1f7dd9e77d647d5be16ee395b462c1ff4c
Instruction ID: 06a231cec023785752a07ef018d67b4d34acbd3983d8b7afc4136fb87ba8f7c8
Opcode Fuzzy Hash: b13a209da27f0e33313615338ce8ab1f7dd9e77d647d5be16ee395b462c1ff4c
Instruction Fuzzy Hash: 00B1F372209BC085EB10DB25F5803AEB7A1E396794F54812BEBC9477A5EFBCC185C709

Uniqueness

Uniqueness Score: -1.00%

Function 0048FA40 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 99
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0048FA62
GetProcAddress.KERNEL32(00000000,00000000,?,?,0048F9C7), ref: 0048FA85
GetProcAddress.KERNEL32(?,?,0048F9C7), ref: 0048FA9D
GetProcAddress.KERNEL32(?,?,0048F9C7), ref: 0048FAB5
GetProcAddress.KERNEL32(?,?,0048F9C7), ref: 0048FACD
GetProcAddress.KERNEL32(?,?,0048F9C7), ref: 0048FAE5
CloseHandle.KERNEL32 ref: 0048FB7B
FreeLibrary.KERNEL32 ref: 0048FB84

Strings

VirtualProtect, xrefs: 0048FA93
WaitForSingleObject, xrefs: 0048FADB
VirtualAlloc, xrefs: 0048FA7B
CreateThread, xrefs: 0048FAC3
kernel32.dll, xrefs: 0048FA5B
VirtualFree, xrefs: 0048FAAB

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AddressProc$Library$CloseFreeHandleLoad
String ID: CreateThread$VirtualAlloc$VirtualFree$VirtualProtect$WaitForSingleObject$kernel32.dll
API String ID: 1915872250-1073278962
Opcode ID: f7a2e09320502cc6764114e5cdc32444337b3ff7ef38ec52d5eab04326b7639b
Instruction ID: 3bf93094e69b4e5fe9ca0cb198c9a2c0f0172e4bb2011ac94cd2d27fe874747a
Opcode Fuzzy Hash: f7a2e09320502cc6764114e5cdc32444337b3ff7ef38ec52d5eab04326b7639b
Instruction Fuzzy Hash: 5B316151702B4144EE26EB26FC6576A7691BF8ABD4F8888369E0D07794EE3CE509C30C

Uniqueness

Uniqueness Score: -1.00%

Function 00429293 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00428AB5: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,004292E9), ref: 00428AC4

RtlNtStatusToDosError.NTDLL ref: 0042948D

Strings

called `Option::unwrap()` on a `None` value, xrefs: 004299EA
I, xrefs: 004296E0
I, xrefs: 00429A06
I, xrefs: 0042973B
assertion failed: !self.is_polling.swap(true, Ordering::AcqRel), xrefs: 004299FF
I, xrefs: 00429370
I, xrefs: 004299DC
I, xrefs: 004292E9
@I, xrefs: 004299AC
Out of bounds access, xrefs: 0042992E, 0042993E
I, xrefs: 004299F1

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AcquireErrorExclusiveLockStatus
String ID: @I$Out of bounds access$assertion failed: !self.is_polling.swap(true, Ordering::AcqRel)$called `Option::unwrap()` on a `None` value$I$I$I$I$I$I$I
API String ID: 3225304674-2479530546
Opcode ID: 2c7621c8d5fd4b92a4459ccb0452da9b01c1d4467e9b62637855c38513585a93
Instruction ID: a792588a8a8c9363f5c171662967e8fced93ecb57ee21322706fd124a7922928
Opcode Fuzzy Hash: 2c7621c8d5fd4b92a4459ccb0452da9b01c1d4467e9b62637855c38513585a93
Instruction Fuzzy Hash: 211289B2305BA482DB20DF16F4543AE67A4F789B94F94412BDA8D47B59DF3CC886C708

Uniqueness

Uniqueness Score: -1.00%

Function 0044D030 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

combase.dll, xrefs: 0044D084
H;J, xrefs: 0044D04A
cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB, xrefs: 0044D056

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Value
String ID: H;J$cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB$combase.dll
API String ID: 3702945584-3784673160
Opcode ID: a3ac56d5277a00f3f7a9a3f051b11946422335dc4ce1b8ba44db95049e876e13
Instruction ID: 1fbc220b432b34d809cba8d77fc3c425c48552b3a4bb85378cbbfe4003294951
Opcode Fuzzy Hash: a3ac56d5277a00f3f7a9a3f051b11946422335dc4ce1b8ba44db95049e876e13
Instruction Fuzzy Hash: A6516D32608B8081E771AB56F4463ABB3A0FB85388F54451AEFC947B95DF7DC186CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00448EB0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32 ref: 00448F28
WriteConsoleW.KERNEL32 ref: 00448F64
WriteConsoleW.KERNEL32(h6J,00000000,00000000,00000651,00000000), ref: 00448FC2
GetLastError.KERNEL32(h6J,00000000,00000000,00000651,00000000), ref: 00448FCB
GetLastError.KERNEL32(h6J,00000000,00000000,00000651,00000000), ref: 0044905E

Strings

QJ, xrefs: 004490FA
h6J, xrefs: 00448EB6
combase.dll, xrefs: 004490BD
QJ, xrefs: 004490D1
QJ, xrefs: 004490E4
QJ, xrefs: 00449094

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID: QJ$ QJ$ QJ$ QJ$combase.dll$h6J
API String ID: 1956605914-253534728
Opcode ID: 2534b2df07a7f32f76d581879dce2811f69ab4068e9717982106ad2927d1de77
Instruction ID: f5705eee17f5e0a29a936c43798a79ff62a9c0cc3020369615153687cab4f46b
Opcode Fuzzy Hash: 2534b2df07a7f32f76d581879dce2811f69ab4068e9717982106ad2927d1de77
Instruction Fuzzy Hash: F951E47220475182FB209B11F8413ABA2A1F785394F64452BEBC947BA9EFBDC585D708

Uniqueness

Uniqueness Score: -1.00%

Function 00478F80 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 353COMMON

Download Yara Rule

APIs

ReleaseSRWLockShared.KERNEL32 ref: 0047964B

Part of subcall function 004493A0: TlsGetValue.KERNEL32 ref: 004493B5

AcquireSRWLockShared.KERNEL32 ref: 00479035
ReleaseSRWLockShared.KERNEL32 ref: 004791C0

Part of subcall function 004493A0: TlsGetValue.KERNEL32 ref: 004493E0
Part of subcall function 004493A0: TlsSetValue.KERNEL32(?,?,?,00478FC1), ref: 00449436

Strings

combase.dll, xrefs: 00479002, 0047944F, 0047952F
H;J, xrefs: 00478FC6, 004791F1, 00479318, 004793FF
=J, xrefs: 004792D9
cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB, xrefs: 00478FD2, 004791FD, 00479324, 0047940B
Box<dyn Any><unnamed>, xrefs: 0047934B

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: LockSharedValue$Release$Acquire
String ID: =J$Box<dyn Any><unnamed>$H;J$cannot access a Thread Local Storage value during or after destructionNtHgFDtekXONzqhlFlQwLwBSoWxHXrIjNcystVojTfNFroAqTbGPwlPIbUHSugSQZpuLwvTbziGpjRB$combase.dll
API String ID: 2478294547-174063075
Opcode ID: 5ceefa75caf545e7aab8b13c8c637dcc4ecd0043651bba3110ea6ad22e390818
Instruction ID: d389d45bb3ac3cf536ee4734554b013d36cbd48259a556b86e72a77259940f93
Opcode Fuzzy Hash: 5ceefa75caf545e7aab8b13c8c637dcc4ecd0043651bba3110ea6ad22e390818
Instruction Fuzzy Hash: DFF1B072209B8095EB21DB11E4503EEB7A4F796784F94811BEB8D03B65EF3CC845C74A

Uniqueness

Uniqueness Score: -1.00%

Function 0048EA00 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(004B7210,00007FFE2167ADA0,?,?,?,00000001,0040124C), ref: 0048EB2D

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0048ECAE
Unknown pseudo relocation bit size %d., xrefs: 0048EC9A

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 96c9089a14bb66e4021cb1132f525d51e742bf655e89da867390b65311ef7ed2
Instruction ID: e20c51f4b70e3fb97da2573c46fedd7d42da29c36f175e13867b56e916a5de29
Opcode Fuzzy Hash: 96c9089a14bb66e4021cb1132f525d51e742bf655e89da867390b65311ef7ed2
Instruction Fuzzy Hash: 8E918971B1024286FF28BB6BD84035E2392B7857A8F648D2BCF1947795DA3DD886C30D

Uniqueness

Uniqueness Score: -1.00%

Function 004813B8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 004813D0
CloseHandle.KERNEL32 ref: 004813E1
GetLastError.KERNEL32 ref: 00481463
CloseHandle.KERNEL32 ref: 004814E8

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00481453, 004814BE
`hJ, xrefs: 004814C5
(TJ, xrefs: 00481480
`hJ, xrefs: 0048145A
XTJ, xrefs: 004814B0

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID: (TJ$XTJ$`hJ$`hJ$called `Option::unwrap()` on a `None` value
API String ID: 1454876536-986961748
Opcode ID: 1c57a604834006be7913aed3006da0b5a967bb00c973e9a90c91c75b8f435624
Instruction ID: 7a556dbd096d04418a05a7251fc9563e98a8b689e92685c6029f1bbe5d0d7d42
Opcode Fuzzy Hash: 1c57a604834006be7913aed3006da0b5a967bb00c973e9a90c91c75b8f435624
Instruction Fuzzy Hash: 7C318BB2301A4481DE14EF16E4513AD33A4F789BA8F94861BEA6D477A4DF3CC58BC345

Uniqueness

Uniqueness Score: -1.00%

Function 00473E50 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 192COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00473ECE
memcpy.NTDLL ref: 00473EEC
memcpy.NTDLL ref: 00473F1E
memcpy.NTDLL ref: 00473F3C
memcpy.NTDLL ref: 0047408C
memcpy.NTDLL ref: 004740AB

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 004740D4
assertion failed: old_right_len + count <= CAPACITY, xrefs: 004741A2
assertion failed: old_left_len >= count, xrefs: 004741BC

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: old_left_len >= count$assertion failed: old_right_len + count <= CAPACITY$internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 3510742995-635693322
Opcode ID: 1219f0722ca8f7a45bfefbc6510c46b524d3b550021135c0ebb18115ed4a138c
Instruction ID: 2368c6545e656cde80952b0d2fdbf77e35caed5c97838106c4a019067d41ac51
Opcode Fuzzy Hash: 1219f0722ca8f7a45bfefbc6510c46b524d3b550021135c0ebb18115ed4a138c
Instruction Fuzzy Hash: F691F262605BC482DA569F18F8013EAB364FBA9798F549317DF8D13721EF39D296C300

Uniqueness

Uniqueness Score: -1.00%

Function 0044B300 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 0044B3B9
GetCurrentDirectoryW.KERNEL32 ref: 0044B3C4
GetLastError.KERNEL32 ref: 0044B3CF
GetLastError.KERNEL32 ref: 0044B3E8
GetLastError.KERNEL32 ref: 0044B46A

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 0044B48A
<unknown>, xrefs: 0044B567

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory
String ID: <unknown>$internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 3993060814-3859713071
Opcode ID: 54a9db52770cc810f18219c2841c20e6882d46db6fc28afea9062cc1178399f5
Instruction ID: a6094730c37471181426901b21496af45b9547dbe90b25cc318b65b60d1f9b4a
Opcode Fuzzy Hash: 54a9db52770cc810f18219c2841c20e6882d46db6fc28afea9062cc1178399f5
Instruction Fuzzy Hash: 8EC12662718B8482FA10DB22E48136FA750F785BD4F44451BEE8E53B5ACF7CC586C789

Uniqueness

Uniqueness Score: -1.00%

Function 00472D10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 161threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00472DA7
SetThreadStackGuarantee.KERNEL32 ref: 00472E37
GetLastError.KERNEL32 ref: 00472E40

Strings

combase.dll, xrefs: 00472E96
`XJ, xrefs: 00472E81

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$GuaranteeStackThread
String ID: `XJ$combase.dll
API String ID: 3169470061-3099105406
Opcode ID: 05ac9ebbc23a6e67257447a06e142375bdb8c2ffce48dc5229e07a39d80bc033
Instruction ID: bf115d3623eb21a7871c87dea6f33891c2853caf970c1f7041d13eb390486463
Opcode Fuzzy Hash: 05ac9ebbc23a6e67257447a06e142375bdb8c2ffce48dc5229e07a39d80bc033
Instruction Fuzzy Hash: A2518E62304A4082DB25BB23E9553AE6361E789B98F84C42AEF8D47755DF7CC8C6C748

Uniqueness

Uniqueness Score: -1.00%

Function 004741F0 Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 231COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00474307
memcpy.NTDLL ref: 00474374
memcpy.NTDLL ref: 004743A3
memcpy.NTDLL ref: 004743D7
memcpy.NTDLL ref: 004743FD
memcpy.NTDLL ref: 00474506

Strings

assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 0047461A
assertion failed: new_left_len <= CAPACITY, xrefs: 00474634

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY
API String ID: 3510742995-2079967719
Opcode ID: 9db3ff5ca7a829b6958b241964cdd99ee108a7b9daaf2ee6820e42fecfdeb227
Instruction ID: 75a4c7753a734ba6d4f2d64a18c62a4689f4184cc1a4c83f205b56e2c070b718
Opcode Fuzzy Hash: 9db3ff5ca7a829b6958b241964cdd99ee108a7b9daaf2ee6820e42fecfdeb227
Instruction Fuzzy Hash: 35B18B76614B8482CB05CF19E4443EA77A8FB99B94F499326EF8D13764EF38C295C300

Uniqueness

Uniqueness Score: -1.00%

Function 00474650 Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 228COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 0047480E
memcpy.NTDLL ref: 00474823
memcpy.NTDLL ref: 0047483B
memcpy.NTDLL ref: 00474854
memcpy.NTDLL ref: 0047488E
memcpy.NTDLL ref: 004748A9

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 004749AA
assertion failed: old_left_len + count <= CAPACITY, xrefs: 00474A82

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: old_left_len + count <= CAPACITY$internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 3510742995-1776158219
Opcode ID: ff221e03208e67bc30b1fb8e60d0e92325c49556f774c30338aa84a47fce59c2
Instruction ID: 168a9c954a4ad45195da9e3b4a3d9e52c62e3cbfda78428a7f70bb2e1eb98027
Opcode Fuzzy Hash: ff221e03208e67bc30b1fb8e60d0e92325c49556f774c30338aa84a47fce59c2
Instruction Fuzzy Hash: 6DB1F2B3A04B8482DA568B18F4013FA7368FB99B98F159316DF8D13361EF39D296C304

Uniqueness

Uniqueness Score: -1.00%

Function 00474AD0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00474BB1
memcpy.NTDLL ref: 00474C13
memcpy.NTDLL ref: 00474C42
memcpy.NTDLL ref: 00474C79
memcpy.NTDLL ref: 00474C9F
memcpy.NTDLL ref: 00474DA9

Strings

assertion failed: new_left_len <= CAPACITY, xrefs: 00474E9D

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID: assertion failed: new_left_len <= CAPACITY
API String ID: 3510742995-3316943531
Opcode ID: 13a6a664e1a003f0802a095bcf076f02b1ddb778090c6596b334c7772b9b7617
Instruction ID: 2fb8c2c2842c9e4521218fb3c34accac81c538cfa1b52d501b2ff87a12a7d099
Opcode Fuzzy Hash: 13a6a664e1a003f0802a095bcf076f02b1ddb778090c6596b334c7772b9b7617
Instruction Fuzzy Hash: 76A1C132614BC882CA16CF09E4413EA77A8FB99B94F499326DF5817360EF39D2A5C304

Uniqueness

Uniqueness Score: -1.00%

Function 004662D0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 004663D9
GetEnvironmentVariableW.KERNEL32 ref: 004663E9
GetLastError.KERNEL32 ref: 004663F5
GetLastError.KERNEL32 ref: 0046640E
GetLastError.KERNEL32 ref: 00466486

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 00466512

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 2691138088-2307832163
Opcode ID: ab99b5570afcb7b8256acfe5b290359e358cfba651596f7d0cf3c7d3d0239a33
Instruction ID: e1cf3a79392ea98d5efb469dee9a97e07b3a200d367e3cf270afb68fc3a93cda
Opcode Fuzzy Hash: ab99b5570afcb7b8256acfe5b290359e358cfba651596f7d0cf3c7d3d0239a33
Instruction Fuzzy Hash: 37512912318BC091EA20AB26F5453ABA750F7D6798F54411BEECA03B55EF7CC4C6C74A

Uniqueness

Uniqueness Score: -1.00%

Function 0044A2D0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 0044A2FA
GetLastError.KERNEL32 ref: 0044A47C

Strings

combase.dll, xrefs: 0044A455
called `Result::unwrap()` on an `Err` value, xrefs: 0044A49A
overflow when subtracting durations, xrefs: 0044A4B9
attempt to divide by zero, xrefs: 0044A426

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: attempt to divide by zero$called `Result::unwrap()` on an `Err` value$combase.dll$overflow when subtracting durations
API String ID: 3362413890-3445815809
Opcode ID: d1126a1ab2869e882d8dafd99f86e2eef64959862409994caa5d59f33758ae7e
Instruction ID: 918db2be05d9fecead57a44184567a8696f9c9253550e959ebac91c520ffa577
Opcode Fuzzy Hash: d1126a1ab2869e882d8dafd99f86e2eef64959862409994caa5d59f33758ae7e
Instruction Fuzzy Hash: D75135663A4A4082EF18DF24D9443AE63A1E7947C4F549127E90F43B64EB3CCA56C30A

Uniqueness

Uniqueness Score: -1.00%

Function 0048E830 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0048E8DB
VirtualProtect.KERNEL32 ref: 0048E982
GetLastError.KERNEL32 ref: 0048E990

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0048E9D7
VirtualProtect failed with code 0x%x, xrefs: 0048E996
Address %p has no image-section, xrefs: 0048E9ED

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 637304234-2123141913
Opcode ID: f692a8806b1b26d46a2067508ec73fd10152bd258dfab308313f4e77cf2c6ec7
Instruction ID: e969eb645ea5ade8606ff0f9ed6800d3c4158f84b4ff79635f406f9e3ae39c66
Opcode Fuzzy Hash: f692a8806b1b26d46a2067508ec73fd10152bd258dfab308313f4e77cf2c6ec7
Instruction Fuzzy Hash: C051F0B370165086EB24AF27E84075E77A0F799BA4F448A26EF4953364DB3CC541C308

Uniqueness

Uniqueness Score: -1.00%

Function 00468680 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00468749
GetFinalPathNameByHandleW.KERNEL32 ref: 0046875C
GetLastError.KERNEL32 ref: 00468767
GetLastError.KERNEL32 ref: 00468780
GetLastError.KERNEL32 ref: 0046880C

Strings

internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value, xrefs: 0046882C

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$FinalHandleNamePath
String ID: internal error: entered unreachable codecalled `Option::unwrap()` on a `None` value
API String ID: 1636761289-2307832163
Opcode ID: edc4e51d3128602fd9ae894cc14c8c2bcf7bf6fcdc6eaf9045bfd2a035c0bb86
Instruction ID: 09dddfacaa4b75998feffdc118c9c3fba7de0da9b58e763448528e6b0ff95f6a
Opcode Fuzzy Hash: edc4e51d3128602fd9ae894cc14c8c2bcf7bf6fcdc6eaf9045bfd2a035c0bb86
Instruction Fuzzy Hash: 6E411A62318B8085DA10AB22E90436AA760F7957E4F64471FFE5D43B95EF7CC5C1C70A

Uniqueness

Uniqueness Score: -1.00%

Function 0044A130 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 0044A16F
GetLastError.KERNEL32 ref: 0044A21D
GetLastError.KERNEL32 ref: 0044A25A

Strings

pCJ, xrefs: 0044A20A
called `Result::unwrap()` on an `Err` value, xrefs: 0044A23B, 0044A278
attempt to divide by zero, xrefs: 0044A203

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: ErrorLast$FrequencyPerformanceQuery
String ID: attempt to divide by zero$called `Result::unwrap()` on an `Err` value$pCJ
API String ID: 1045536338-2307886941
Opcode ID: 0d126af691e6f874cf8258d94293a124a228aaa0781c4dc93ff3b71506b6f6e0
Instruction ID: 9c783f84375439ff8798dd01e756c973f8cf7e393809a48daa36364be95f69ba
Opcode Fuzzy Hash: 0d126af691e6f874cf8258d94293a124a228aaa0781c4dc93ff3b71506b6f6e0
Instruction Fuzzy Hash: 5531E2A1364B4482FB44EB52A8413EA7366F7C57C4F84902BEA4E07B59DF3CC556C34A

Uniqueness

Uniqueness Score: -1.00%

Function 004474B0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 212COMMON

Download Yara Rule

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyed, xrefs: 004477A7
combase.dll, xrefs: 0044776F, 004477D6
($J, xrefs: 00447783

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID:
String ID: ($J$combase.dll$use of std::thread::current() is not possible after the thread's local data has been destroyed
API String ID: 0-3492916167
Opcode ID: 9562bc8f1152436cc4c267010d0043d2c3143bb6ccec0208915db55bfeb55d9a
Instruction ID: 1decd85f04789827a4771bab53902f8bfc9e638f1558b8d9662429196b6b424c
Opcode Fuzzy Hash: 9562bc8f1152436cc4c267010d0043d2c3143bb6ccec0208915db55bfeb55d9a
Instruction Fuzzy Hash: 0281F43221DB4081FA259B15E44136B67A1F785798F54892BEB8D07BA5DF3CD883C308

Uniqueness

Uniqueness Score: -1.00%

Function 00448770 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00448785
TlsGetValue.KERNEL32 ref: 004487A5
TlsSetValue.KERNEL32 ref: 004487F3

Part of subcall function 00447A90: TlsAlloc.KERNEL32 ref: 00447AD2
Part of subcall function 00447A90: InitOnceComplete.KERNEL32 ref: 00447B0E

Part of subcall function 00448AA0: GetStdHandle.KERNEL32(?,?,?,?,?,00000669,00000000,?,00000651,00000661,004488EA), ref: 00448ABE
Part of subcall function 00448AA0: GetLastError.KERNEL32(?,?,?,?,?,00000669,00000000,?,00000651,00000661,004488EA), ref: 00448AD1

Strings

h6J, xrefs: 004489F3
(6J, xrefs: 004489E5

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Value$AllocCompleteErrorHandleInitLastOnce
String ID: (6J$h6J
API String ID: 784984758-3621754839
Opcode ID: 7d19ad3f77d57446cee49991d5bf82987105582fd12aaedf94f875ce68cdb561
Instruction ID: a3af73dd382c0ce2977f857dcbe9616a7d97d17a18a34674fc33320bdb948585
Opcode Fuzzy Hash: 7d19ad3f77d57446cee49991d5bf82987105582fd12aaedf94f875ce68cdb561
Instruction Fuzzy Hash: 4A5124A2704A8481FE29AB16E5453BFA351B745BC8F58482FEF4A07755EF7CC482C309

Uniqueness

Uniqueness Score: -1.00%

Function 00401550 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 126COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 004016F1

Part of subcall function 0048436F: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,004015B0), ref: 0048437A

Strings

combase.dll, xrefs: 004020D8
YFI, xrefs: 004020EA
HwJ, xrefs: 004020BE
failed to park thread, xrefs: 00402111
/,@, xrefs: 00402118

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AcquireExclusiveLockmemcpy
String ID: /,@$HwJ$YFI$combase.dll$failed to park thread
API String ID: 1311006694-3075031705
Opcode ID: b670f25a262e801e5387c2a5df4c8c689ab3603f499ed48da4ccbc4535dd423d
Instruction ID: 07f57ac6cf35a8efb967f4b212d4279e8a73e1b444c399bc15ead3e85e308208
Opcode Fuzzy Hash: b670f25a262e801e5387c2a5df4c8c689ab3603f499ed48da4ccbc4535dd423d
Instruction Fuzzy Hash: D3517A72209BC495EB329F19E4403DAB7A4FB89748F848126DB8C53765EF7DC18ACB04

Uniqueness

Uniqueness Score: -1.00%

Function 00448070 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00448086
TlsGetValue.KERNEL32 ref: 004480B4
TlsSetValue.KERNEL32(?,?,00000000,?,00447D9B), ref: 0044810E

Strings

combase.dll, xrefs: 004192C3
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000000000000000000000000000000000000000000000000000000000000, xrefs: 004191D0
UJ, xrefs: 00448205

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Value
String ID: UJ$00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000000000000000000000000000000000000000000000000000000000000$combase.dll
API String ID: 3702945584-1935050902
Opcode ID: 407be064bf772b445aa31f0cf87ec96f57eda334bd5938e9f082223c6ac8a9b8
Instruction ID: a39ffd7c37d441d0062b46f9d1bcb19dbe2325d4f6fdaf2f0ec18f81a02204fb
Opcode Fuzzy Hash: 407be064bf772b445aa31f0cf87ec96f57eda334bd5938e9f082223c6ac8a9b8
Instruction Fuzzy Hash: A721A471306A0186FB68AB16E95636F2261EB80784F44883FC74A57791DF3CC946D349

Uniqueness

Uniqueness Score: -1.00%

Function 004096CC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 201COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
Unknown: armv5armv6armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 00409722
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: Unknown: armv5armv6armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64$combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 2050909247-1727271318
Opcode ID: d482320e58b024831015a11798e330e10c9163bb73054276a1656c9a59d43b63
Instruction ID: 3d2a02c9621564347fa6ee0724f1e821eec9ad2aad262ed3cd1d00340cede865
Opcode Fuzzy Hash: d482320e58b024831015a11798e330e10c9163bb73054276a1656c9a59d43b63
Instruction Fuzzy Hash: 648190A2318AC191DA21EB12E5413EAA361FBC5BC4F809427DF4D17B8ADF3DC645C748

Uniqueness

Uniqueness Score: -1.00%

Function 004094F7 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
armv6armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 00409519
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: armv6armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64$combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 2050909247-1751261676
Opcode ID: f2eca58ccd6fe9c903b8c2a55dabff7e69a7b062c6b401d10c65b92c89e60f5b
Instruction ID: d383d139942eb6dca1e494431e00fcac640e3b10f64c7468bc30cc3faf8d13a4
Opcode Fuzzy Hash: f2eca58ccd6fe9c903b8c2a55dabff7e69a7b062c6b401d10c65b92c89e60f5b
Instruction Fuzzy Hash: 6071AFA2318AC191DA20EB12E5417EAA361FBC5BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 0040975B Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 00409785, 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: 2277505b80e15e87b7b4e7714684bd9701e61f61fcb0ceba24f662ddf1a405e5
Instruction ID: 28b6542472ebed851e65a69ac263a75086d0d39dcc5cc103591b927135ba10c2
Opcode Fuzzy Hash: 2277505b80e15e87b7b4e7714684bd9701e61f61fcb0ceba24f662ddf1a405e5
Instruction Fuzzy Hash: 1171A2A2318AC191DA20EB12E5413EAA361FBC5BC4F849427DF4D17B8ADF3DC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 00409797 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004097C1
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64$combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 2050909247-1488543349
Opcode ID: 6233123e3aae671ba2ae2b697faa42eaf134363c43986d9b028fbfda51a8c230
Instruction ID: 4ba44e253738e296176a89f0725b1c56658ef8ba19259e0855adcd7598c57211
Opcode Fuzzy Hash: 6233123e3aae671ba2ae2b697faa42eaf134363c43986d9b028fbfda51a8c230
Instruction Fuzzy Hash: C671A2A2318AC191DA21EB12E5413EAA361FBC5BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 004098DB Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004098DB
combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64$usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 2050909247-4243896386
Opcode ID: 651f6d791049cc1b3155b14524d02053d30e35535faef12eb4fc8727e62c8c7c
Instruction ID: c3a707151a22277549d41e09854bba7b28a32767a537cf166e3ae80906177315
Opcode Fuzzy Hash: 651f6d791049cc1b3155b14524d02053d30e35535faef12eb4fc8727e62c8c7c
Instruction Fuzzy Hash: A5719EA2318A8191DA20EB12E5413EAA361FB85BC4F849427DF4D17B9ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 004098E7 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
encrypt_key, xrefs: 00409C04
i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004098E7

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64$usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 2050909247-854136851
Opcode ID: fdd495792a70581d2a1f2411a101fd3d1eb415aa49341bc89a7f11078595cbed
Instruction ID: 52c2fc93fcaea71edfb74b3ff81b94ea345c6ee9099a0aebaa7d15fc58bf6e01
Opcode Fuzzy Hash: fdd495792a70581d2a1f2411a101fd3d1eb415aa49341bc89a7f11078595cbed
Instruction Fuzzy Hash: 07719FA2318A8191DA20EB12E5413EAA361FB85BC4F849427DF4D17B9ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 004098F3 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: 41c6789e82b1b8cb264b200c698e81344917cd75e09a4463971b850d69b5d9d9
Instruction ID: e2d8b875ef2b4728725e872357dcce6b87d83e511f50f735cf35c541b815de93
Opcode Fuzzy Hash: 41c6789e82b1b8cb264b200c698e81344917cd75e09a4463971b850d69b5d9d9
Instruction Fuzzy Hash: 60719EA2318A8191DA20EB12E5413EAA361FB85BC4F849427DF4D17B9ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 0040994D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: 649c50115be27756248a5330f4b46d85b178103384747d9b42295d9731fd35d1
Instruction ID: be030801d4242dfd3a16b65233c95e4df98ecfa76fc1a4c8065104e83dffcf8f
Opcode Fuzzy Hash: 649c50115be27756248a5330f4b46d85b178103384747d9b42295d9731fd35d1
Instruction Fuzzy Hash: 1A71AFA2318AC191DA20EB13E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 00409956 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: f8ab0e8e5d497bf7b8598ee3bf615ddde978d89ba48c81358a5d18cc0e0d7e24
Instruction ID: 21303537d3d91213f8819835f84349eb807d4b42c1cad507bfc52f5795a01061
Opcode Fuzzy Hash: f8ab0e8e5d497bf7b8598ee3bf615ddde978d89ba48c81358a5d18cc0e0d7e24
Instruction Fuzzy Hash: 1871AFA2318AC191DA20EB13E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 00409917 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: 3939bc474778c7656640d66074bddcf55914ff5de810effe24f1301f22feebb4
Instruction ID: 90ce33244f4350e0f7bc485ebfa540bfa58c966595c0a500b8ffd68e6201a9ec
Opcode Fuzzy Hash: 3939bc474778c7656640d66074bddcf55914ff5de810effe24f1301f22feebb4
Instruction Fuzzy Hash: C471AFA2318AC191DA20EB13E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 00409926 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: c4900d5fbf846d7299743e9c8ddaa2432bcb54c1e1be11a8b031945700d241a3
Instruction ID: cd7450ba13ae314e080e6292d6c8ff5b2cbe3c0bfac850ad48bdf6dbd0633d2a
Opcode Fuzzy Hash: c4900d5fbf846d7299743e9c8ddaa2432bcb54c1e1be11a8b031945700d241a3
Instruction Fuzzy Hash: BF71AFA2318AC191DA20EB13E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 0040992F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: 1e6d7ae35eb6db2b876005fd6bb547e7d511db83fd492e335707366891e8508d
Instruction ID: d3df1be475edcd4c80a656458d3802f5b273fa936c524cd98cec2c329255839c
Opcode Fuzzy Hash: 1e6d7ae35eb6db2b876005fd6bb547e7d511db83fd492e335707366891e8508d
Instruction Fuzzy Hash: 26719EA2318A8191DA20EB13E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 0040993E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: ad9b71e27994ac0e62ad57058886beb23d54a8ebd5bb0dc950abd2027ae33a14
Instruction ID: 16d3f207711beae2151bab374fe84b98a18fdf345b49448845213e3e9bd9f4c0
Opcode Fuzzy Hash: ad9b71e27994ac0e62ad57058886beb23d54a8ebd5bb0dc950abd2027ae33a14
Instruction Fuzzy Hash: 16719EA2318AC191DA20EB12E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 004098CF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
encrypt_key, xrefs: 00409C04
armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004098CF

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: armv7arm64i386i586i686x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64$combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch
API String ID: 2050909247-4218117482
Opcode ID: c7f33ec54e036c357fddddf517c5625a6a7987c099954a42c81882f09bdc40d1
Instruction ID: 5f8ce665772777b0c48edcda3f7dfdad5724c3a47dbc6d342bba8cb126d0027f
Opcode Fuzzy Hash: c7f33ec54e036c357fddddf517c5625a6a7987c099954a42c81882f09bdc40d1
Instruction Fuzzy Hash: 1E71AFA2318AC191DA20EB12E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 0040995F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: b3302d02946baf1ff969eeb3b010e95291ea374070706e0f22ae6b1da4c819b5
Instruction ID: fabcfd1224050118088fee7afb64674cba01d9fafaf93e59a444b00f7b45d160
Opcode Fuzzy Hash: b3302d02946baf1ff969eeb3b010e95291ea374070706e0f22ae6b1da4c819b5
Instruction Fuzzy Hash: 96719FA2318AC191DA20EB16E5413EAA361FB85BC4F849427DF4D17B9ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 00409968 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: 5d4b0fb8924e3f565d61ffc593985b9645121c9614853a5a4622a10fda47c348
Instruction ID: 264023c17e8c03c2d7cf281ae4c630f5273ef8060c697cf069b5dead581ec5ce
Opcode Fuzzy Hash: 5d4b0fb8924e3f565d61ffc593985b9645121c9614853a5a4622a10fda47c348
Instruction Fuzzy Hash: 6A719FA2318AC191DA20EB16E5413EAA361FB85BC4F849427DF4D17B9ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 00409971 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00409A6E

Strings

combase.dll, xrefs: 00409ADA
usernameprocess_nameexecutablepidparent_process_nameppidarch, xrefs: 00409B36
x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64, xrefs: 004099C5
encrypt_key, xrefs: 00409C04

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: CurrentProcess
String ID: combase.dll$encrypt_key$usernameprocess_nameexecutablepidparent_process_nameppidarch$x86_64mipsmipselmips64mips64elpowerpcpowerpc64powerpc64leriscv32riscv64s390xsparcsparc64wasm32wasm64
API String ID: 2050909247-596227008
Opcode ID: 74fa3941685297f70ace88943f215e3bf32a288af1eaea7bcedb3258df9b7f11
Instruction ID: 1ea11f3b61beea334b8484c282696e5a67a0a2b4e81eb77ae7db8c1bde00e48d
Opcode Fuzzy Hash: 74fa3941685297f70ace88943f215e3bf32a288af1eaea7bcedb3258df9b7f11
Instruction Fuzzy Hash: CC71AFA2318AC191DA20EB13E5413EAA361FB85BC4F849427DF4D17B8ADF3CC646C748

Uniqueness

Uniqueness Score: -1.00%

Function 00449980 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?,004659CE), ref: 00449B53
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,?,004659CE), ref: 00449B67

Strings

xNJ, xrefs: 00449A91
kernel32, xrefs: 00449B4C
SetThreadDescription, xrefs: 00449B5D

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32$xNJ
API String ID: 1646373207-231013144
Opcode ID: 19338f6f3c5fdb357c988e7d888f81a0bd47133a7b76a212ab88d5a7a508688c
Instruction ID: e6eca30781c4cceba728a897ae03043945364c7c6e49f1ec7459961332f604f9
Opcode Fuzzy Hash: 19338f6f3c5fdb357c988e7d888f81a0bd47133a7b76a212ab88d5a7a508688c
Instruction Fuzzy Hash: 40410262604B8082FB25AB05E4493AF73A0F7847D8F44852BEA8D037D4EBBCC8C5D709

Uniqueness

Uniqueness Score: -1.00%

Function 0048FBD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0048FBF5
LoadLibraryA.KERNEL32 ref: 0048FC01
GetProcAddress.KERNEL32 ref: 0048FC19

Strings

kernel32.dll, xrefs: 0048FBFA
VirtualFree, xrefs: 0048FC0F

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualFree$kernel32.dll
API String ID: 145871493-864021412
Opcode ID: 7180d367bbae0bb60fe8c266bbd8153e8e1dc34418ee9e501a497c092be2ea72
Instruction ID: dd7c71e77dcbd68ae20174b47063b1b51af620b4e0ce0ab1d5f2ffa35827ebf6
Opcode Fuzzy Hash: 7180d367bbae0bb60fe8c266bbd8153e8e1dc34418ee9e501a497c092be2ea72
Instruction Fuzzy Hash: D4018166712A0480EB15EB26F86036923A4FB8CFD8F584836CE1D47354EF3CD489C318

Uniqueness

Uniqueness Score: -1.00%

Function 00447A90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00447AD2
InitOnceComplete.KERNEL32 ref: 00447B0E

Strings

combase.dll, xrefs: 00447B95, 00447BD1
UJ, xrefs: 00447BA9

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AllocCompleteInitOnce
String ID: UJ$combase.dll
API String ID: 622421136-3317273432
Opcode ID: 5693e1a81dea9c89508625276da9af7dd200d636fa32bd8efa79d435eaa6da60
Instruction ID: 0c7f37b5a4fa61dc74f7f223b3fb5a1f6a6a36736a305343acc11c09f8def3a8
Opcode Fuzzy Hash: 5693e1a81dea9c89508625276da9af7dd200d636fa32bd8efa79d435eaa6da60
Instruction Fuzzy Hash: 8031E433628A4086E720EF25E84035F73A1F78535CF54922AE79A43B65EF3CD586CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00448340 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0044839C
GetProcAddress.KERNEL32 ref: 004483B0

Strings

NtReleaseKeyedEvent, xrefs: 004483A6
ntdll, xrefs: 00448395

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: b669de693e91e8035f0c3efbc9e39ae26a8d76159853555db6b7b3384fc08083
Instruction ID: 85282f263cde58473eee6c6e1d8d62b593f5d12a8f8c4afcfe5f37076a34335f
Opcode Fuzzy Hash: b669de693e91e8035f0c3efbc9e39ae26a8d76159853555db6b7b3384fc08083
Instruction Fuzzy Hash: C401BCA2305B4490EA14EF02B880799B7A4FB99BC4F84512EEE8D03B28EF3CC461C704

Uniqueness

Uniqueness Score: -1.00%

Function 00412D30 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,?,?,00402444), ref: 00412D86
HeapReAlloc.KERNEL32 ref: 00412F2A

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00412E23
MI, xrefs: 00412E2A

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AllocHeapmemcpy
String ID: called `Option::unwrap()` on a `None` value$MI
API String ID: 242294866-4111934126
Opcode ID: bfc4c43b9d2b9a64783e80ac5d49f0b41a501b55486b1567ac0c2c86c54b60aa
Instruction ID: c0802f47e93c3dac0b93daeee877d1125750ee938e5287c331bdf24b317447fa
Opcode Fuzzy Hash: bfc4c43b9d2b9a64783e80ac5d49f0b41a501b55486b1567ac0c2c86c54b60aa
Instruction Fuzzy Hash: C071A67230578442DA159F12EA403EA67A1F785BD4F188027EF8E87B59DBBCC5E38308

Uniqueness

Uniqueness Score: -1.00%

Function 004894A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00489525
RtlUnwindEx.KERNEL32 ref: 00489543
abort.MSVCRT ref: 00489549
abort.MSVCRT ref: 00489560

Part of subcall function 00489450: RaiseException.KERNEL32 ref: 00489480

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: abort$CaptureContextExceptionRaiseUnwind
String ID:
API String ID: 4122134289-0
Opcode ID: f7998fc03c1d81965a32b286e25d1523564382699c2f31294b0d80ee4dab9acb
Instruction ID: 1867441abff502beea3adc52dd614a8110d62dffd13ee90cabc799346d0ee8c8
Opcode Fuzzy Hash: f7998fc03c1d81965a32b286e25d1523564382699c2f31294b0d80ee4dab9acb
Instruction Fuzzy Hash: 6D112B72215B8485DB60AF56E4403AEB7A4F388BD8F54052AEB8D03B58CF78C555CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00421707 Relevance: 5.4, APIs: 4, Instructions: 359COMMON

Download Yara Rule

APIs

memcpy.NTDLL ref: 00421A09
memcpy.NTDLL ref: 00421A1C
memcpy.NTDLL ref: 00421AC4
memcpy.NTDLL ref: 00421C07
memcpy.NTDLL ref: 00421C8C
memcpy.NTDLL ref: 00421D2A
memcpy.NTDLL ref: 0042208F
memcpy.NTDLL ref: 00422105
memcpy.NTDLL ref: 0042220E

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: e08f1b083afc5e51faabc2af601c8151d99858a2b10705f5cacf2ad83f4b3262
Instruction ID: 0add38830c8173087b3bb49081eb8dcae5f1a686f3c1f1caaa8d8f12e460718b
Opcode Fuzzy Hash: e08f1b083afc5e51faabc2af601c8151d99858a2b10705f5cacf2ad83f4b3262
Instruction Fuzzy Hash: F0223932519FC480E6368B18E4453EAB3B4FFA8789F456216DFC913725EB39D296CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00429083 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00429663), ref: 0042909C

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00429171
I, xrefs: 00429165

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: called `Result::unwrap()` on an `Err` value$I
API String ID: 4021432409-1150075796
Opcode ID: b008d6daf4a8b1531643efaa558693785582329238bfca76963c0ce434211b51
Instruction ID: 316bb855acd62fa3dd3cd14cf2cf5872baa00832da3106855aac27f3075ad4a9
Opcode Fuzzy Hash: b008d6daf4a8b1531643efaa558693785582329238bfca76963c0ce434211b51
Instruction Fuzzy Hash: E021AFB2715A64A1EA00DB27E9543AE6321F744BD8F94841BDE0A03B14DF3ED9A7C309

Uniqueness

Uniqueness Score: -1.00%

Function 00401010 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00401070

Strings

@lK, xrefs: 0040103D
0rK, xrefs: 0040107A

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: __set_app_type
String ID: 0rK$@lK
API String ID: 1108511539-726316708
Opcode ID: 0935b04110ed02e6e096746e49978f4c5456667156d4d610ffd34295d06d863c
Instruction ID: df23da00df701f1420172c7f9c9c89d48c6ec591740481199025795e7db7e694
Opcode Fuzzy Hash: 0935b04110ed02e6e096746e49978f4c5456667156d4d610ffd34295d06d863c
Instruction Fuzzy Hash: F121BAB1700685C6EB54AF1AC8903AE37A1F786B40F85C427DB0A177B1CB7E88C5C70A

Uniqueness

Uniqueness Score: -1.00%

Function 004108B0 Relevance: 5.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 004108F8
HeapAlloc.KERNEL32 ref: 00410915
memcpy.NTDLL ref: 00410944
HeapFree.KERNEL32 ref: 00410956

Memory Dump Source

Source File: 00000000.00000002.1629261620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1629243950.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629309978.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.0000000000491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629327755.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629365667.00000000004B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1629382470.00000000004B9000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_doc-1.jbxd

Similarity

API ID: Heap$AllocFreeProcessmemcpy
String ID:
API String ID: 3455684755-0
Opcode ID: cec556d09c57f7eeb9699062616b9155d7618854b64edc0a9ced5fc5fb26312d
Instruction ID: 0f40c26e7bd1b90fca42de00878b67e58e3af02eda90d97df94aa468f626e80e
Opcode Fuzzy Hash: cec556d09c57f7eeb9699062616b9155d7618854b64edc0a9ced5fc5fb26312d
Instruction Fuzzy Hash: E711E5A271566441FE05EB57AA503BA26912B98BE4F494C3B9E0D07796EE3CC0D39308

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report doc-1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: doc-1.exePID: 6880, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: doc-1.exePID: 6880, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 00401180 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 189sleepstringCOMMON

Control-flow Graph

Function 004023D4 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 129COMMON

Control-flow Graph

Function 004470D0 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Control-flow Graph

Windows Analysis Report
doc-1.exe

Function 00401180 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 189
sleepstringCOMMON

Function 004023D4 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 129
COMMON

Function 004470D0 Relevance: 1.5, APIs: 1, Instructions: 36
threadCOMMON

Function 0040B011 Relevance: 84.7, APIs: 12, Strings: 44, Instructions: 661
COMMON

Function 004735D0 Relevance: 26.8, APIs: 13, Strings: 2, Instructions: 526
COMMON

Function 00401731 Relevance: 18.5, APIs: 1, Strings: 11, Instructions: 517
COMMON