Edit tour

Windows Analysis Report
kGZyUV1upG.exe

Overview

General Information

Sample name:	kGZyUV1upG.exe renamed because original name is a hash value
Original sample name:	6c93fc68e2f01c20fb81af24470b790c.exe
Analysis ID:	1431451
MD5:	6c93fc68e2f01c20fb81af24470b790c
SHA1:	d5927b38a32e30afcf5a658612a8266476fc4ad8
SHA256:	64a71b664d76641b35dac312161cb356b3b3b5f0b45c9d88c8afa547b4902580
Tags:	32exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found evasive API chain (may stop execution after checking mutex)

Found potential dummy code loops (likely to delay analysis)

Found stalling execution ending in API Sleep call

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

kGZyUV1upG.exe (PID: 6896 cmdline: "C:\Users\user\Desktop\kGZyUV1upG.exe" MD5: 6C93FC68E2F01C20FB81AF24470B790C)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: kGZyUV1upG.exe	Virustotal: Detection: 33%			Perma Link
Source: kGZyUV1upG.exe	ReversingLabs: Detection: 26%

Source: kGZyUV1upG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kGZyUV1upG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: M:\DATA\Projects\BitClipper2017\Release\BitClipper2017.pdb source: kGZyUV1upG.exe

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Code function: 0_2_008B2590 CreateMutexA,GetLastError,ExitProcess,OpenClipboard,GetClipboardData,GlobalFix,EmptyClipboard,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,GlobalFree,CloseClipboard,Sleep,

0_2_008B2590

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

0_2_008B2590

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

0_2_008B2590

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00907830	0_2_00907830
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00909063	0_2_00909063
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_0090A988	0_2_0090A988
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_0090B29C	0_2_0090B29C
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_008B1A40	0_2_008B1A40
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00912BD5	0_2_00912BD5
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_0090BB06	0_2_0090BB06
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00905C20	0_2_00905C20
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_008B5500	0_2_008B5500
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_0090AE84	0_2_0090AE84
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_0090B6D1	0_2_0090B6D1
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00913759	0_2_00913759

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: String function: 00909E8D appears 31 times
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: String function: 00908810 appears 32 times

Source: kGZyUV1upG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Mutant created: \Sessions\1\BaseNamedObjects\8dddf1vvvv

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Command line argument: 8dddf1vvvv	0_2_008B2590
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Command line argument: 8dddf1vvvv	0_2_008B2590
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Command line argument: f1vvvv	0_2_008B2590
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Command line argument: 8dddf1vvvv	0_2_008B2590

Source: kGZyUV1upG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kGZyUV1upG.exe	Virustotal: Detection: 33%
Source: kGZyUV1upG.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Section loaded: apphelp.dll

Jump to behavior

Source: kGZyUV1upG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: kGZyUV1upG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: kGZyUV1upG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: kGZyUV1upG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: kGZyUV1upG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: kGZyUV1upG.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: kGZyUV1upG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: kGZyUV1upG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: M:\DATA\Projects\BitClipper2017\Release\BitClipper2017.pdb source: kGZyUV1upG.exe

Source: kGZyUV1upG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: kGZyUV1upG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: kGZyUV1upG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: kGZyUV1upG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: kGZyUV1upG.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Code function: 0_2_008B89F0 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_008B89F0

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00908856 push ecx; ret		0_2_00908869
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_0090834B push ecx; ret		0_2_0090835E

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

0_2_008B89F0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-18504

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-18511

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Window / User API: threadDelayed 875			Jump to behavior
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Window / User API: threadDelayed 9124			Jump to behavior

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

API coverage: 5.6 %

Source: C:\Users\user\Desktop\kGZyUV1upG.exe TID: 6924	Thread sleep count: 875 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kGZyUV1upG.exe TID: 6924	Thread sleep time: -622125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kGZyUV1upG.exe TID: 6924	Thread sleep count: 9124 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kGZyUV1upG.exe TID: 6924	Thread sleep time: -6487164s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

API call chain: ExitProcess graph end node

graph_0-18506

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Code function: 0_2_0090CC07 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0090CC07

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

0_2_008B89F0

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Code function: 0_2_0090E8F6 mov eax, dword ptr fs:[00000030h]

0_2_0090E8F6

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Code function: 0_2_00912404 GetProcessHeap,

0_2_00912404

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_0090CC07 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0090CC07
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00907C28 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00907C28
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00908609 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00908609
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_00908757 SetUnhandledExceptionFilter,	0_2_00908757

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Code function: 0_2_0090886B cpuid

0_2_0090886B

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: GetLocaleInfoW,	0_2_00917A1C
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: GetLocaleInfoW,	0_2_00911A67
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_009173E1
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00917B45
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: GetLocaleInfoW,	0_2_00917C4C
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00917D19
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: EnumSystemLocalesW,	0_2_009176A4
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: EnumSystemLocalesW,	0_2_009116C2
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: EnumSystemLocalesW,	0_2_00917659
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_009177CC
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: EnumSystemLocalesW,	0_2_0091773F

Source: C:\Users\user\Desktop\kGZyUV1upG.exe

Code function: 0_2_009084F8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_009084F8

Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_008B1390 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		0_2_008B1390
Source: C:\Users\user\Desktop\kGZyUV1upG.exe	Code function: 0_2_008B2D60 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		0_2_008B2D60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	111 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	3 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kGZyUV1upG.exe	34%	Virustotal		Browse
kGZyUV1upG.exe	26%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431451
Start date and time:	2024-04-25 06:42:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kGZyUV1upG.exe renamed because original name is a hash value
Original Sample Name:	6c93fc68e2f01c20fb81af24470b790c.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
06:43:21	API Interceptor	9152152x Sleep call for process: kGZyUV1upG.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.384805269039956
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kGZyUV1upG.exe
File size:	545'792 bytes
MD5:	6c93fc68e2f01c20fb81af24470b790c
SHA1:	d5927b38a32e30afcf5a658612a8266476fc4ad8
SHA256:	64a71b664d76641b35dac312161cb356b3b3b5f0b45c9d88c8afa547b4902580
SHA512:	355e9677121ef17cf8c398f0c17399776d206c62014080a2c62682e1152ea0729dcc6e233358dcd6bae009b07e3db936d4b18eb37d6e7ebc2fe9cf8d827c4ade
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
TLSH:	44C48301EDC28C6ED34242B1962BA570B479E7A456741FE3338743395D60EADCECFA89
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i.........

File Icon


Icon Hash:	336dceb2b2b39269

Static PE Info

General

Entrypoint:	0x4580b6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66297682 [Wed Apr 24 21:15:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	38ce7b26599ed49d54eb76ec8adae923

Entrypoint Preview

Instruction
call 00007FE4AD6B0812h
jmp 00007FE4AD6B0263h
push ebp
mov ebp, esp
mov eax, dword ptr [0047B06Ch]
and eax, 1Fh
push 00000020h
pop ecx
sub ecx, eax
mov eax, dword ptr [ebp+08h]
ror eax, cl
xor eax, dword ptr [0047B06Ch]
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FE4AD6B03EBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FE4AD6B03DCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FE4AD6B03DEh
add edx, 28h
cmp edx, esi
jne 00007FE4AD6B03BCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FE4AD6B03CBh
call 00007FE4AD6B0CB4h
test eax, eax
jne 00007FE4AD6B03D5h
xor al, al
ret
mov eax, dword ptr fs:[00000018h]
push esi
mov esi, 0047C1F8h
mov edx, dword ptr [eax+04h]
jmp 00007FE4AD6B03D6h
cmp edx, eax
je 00007FE4AD6B03E2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FE4AD6B03C2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FE4AD6B03D9h
mov byte ptr [0047C214h], 00000001h
call 00007FE4AD6B0AD5h
call 00007FE4AD6B467Bh
test al, al
jne 00007FE4AD6B03D6h
xor al, al
pop ebp
ret
call 00007FE4AD6B83B5h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x79c50	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x2840	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x82000	0x806c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x780b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x78120	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6c000	0x11c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6af31	0x6b000	ccd6aeec0d5e0d6ebfc156f82d1938d6	False	0.32714615581191586	data	6.2444460279315415	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6c000	0xe2aa	0xe400	00cfecdbc8308037b8d1a20ac45296c4	False	0.4690069901315789	OpenPGP Secret Key Version 7	5.52021741550539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7b000	0x2040	0xe00	4861c5046ed1ea6db5e6c00122e31574	False	0.21261160714285715	DOS executable (block device driver ght (c)	3.0793309770055424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x7e000	0x1f8	0x200	50a88cfe362da8efc53c3e174f910587	False	0.603515625	data	3.721476685742967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7f000	0x2840	0x2a00	78ad2c262b42a30ed5bbbb7c147db8ea	False	0.24609375	data	4.08904084486743	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x82000	0x806c	0x8200	c4f7440ee8c5449e04c7a86e889d0fa4	False	0.7306189903846154	data	6.803125964632598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7f100	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.2371369294605809
RT_GROUP_ICON	0x816a8	0x14	data	English	United States	1.15
RT_MANIFEST	0x816c0	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

LoadLibraryA, GetProcAddress, WriteConsoleW, FlushFileBuffers, MultiByteToWideChar, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, GetCPInfo, CompareStringW, LCMapStringW, GetLocaleInfoW, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetStringTypeW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, GetLastError, FreeLibrary, LoadLibraryExW, HeapAlloc, HeapFree, HeapReAlloc, GetStdHandle, WriteFile, GetModuleFileNameA, ExitProcess, GetModuleHandleExW, GetACP, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetProcessHeap, GetFileType, CloseHandle, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, HeapSize, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:42:49
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\kGZyUV1upG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kGZyUV1upG.exe"
Imagebase:	0x8b0000
File size:	545'792 bytes
MD5 hash:	6C93FC68E2F01C20FB81AF24470B790C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.2%
Total number of Nodes:	692
Total number of Limit Nodes:	14

Executed Functions

Function 008B89F0 Relevance: 125.0, APIs: 19, Strings: 41, Instructions: 20001
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,LoadLibraryA), ref: 008BBFAF
GetProcAddress.KERNEL32(00000000), ref: 008BBFB6
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 008BBFC6
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 008BDB2A
GetProcAddress.KERNEL32(?,GlobalUnlock), ref: 008BF69F

Part of subcall function 00907D4B: ___report_securityfailure.LIBCMT ref: 00907D50

GetProcAddress.KERNEL32(?,GlobalLock), ref: 008C1212
GetProcAddress.KERNEL32(?,GlobalAlloc), ref: 008C2D85
GetProcAddress.KERNEL32(?,GlobalFree), ref: 008C48F8
GetProcAddress.KERNEL32(?,CreateMutexA), ref: 008C646B
GetProcAddress.KERNEL32(?,ReleaseMutex), ref: 008C7FDE
GetProcAddress.KERNEL32(?,ExitProcess), ref: 008C9B51
GetProcAddress.KERNEL32(?,0092CF7C), ref: 008CB6C4
LoadLibraryA.KERNELBASE(User32.dll), ref: 008CD233
GetProcAddress.KERNEL32(?,OpenClipboard), ref: 008CEDA6
GetProcAddress.KERNEL32(?,GetClipboardData), ref: 008D0919
GetProcAddress.KERNEL32(?,EmptyClipboard), ref: 008D248C
GetProcAddress.KERNEL32(?,SetClipboardData), ref: 008D3FFF
GetProcAddress.KERNEL32(?,0092CF64), ref: 008D5B72
GetProcAddress.KERNEL32(?,GetModuleFileName), ref: 008D76E5
GetProcAddress.KERNEL32(?,MoveFileA), ref: 008D9258
GetProcAddress.KERNEL32(?,Sleep), ref: 008DADCB
GetProcAddress.KERNEL32(?,CloseHandle), ref: 008DC93E
GetProcAddress.KERNEL32(?,CreateDirectoryA), ref: 008DE4B1
GetProcAddress.KERNEL32(?,WaitForSingleObject), ref: 008E0024
GetProcAddress.KERNEL32(?,0092D000), ref: 008E1B97
LoadLibraryA.KERNELBASE(msvcrt.dll), ref: 008E3706
GetProcAddress.KERNEL32(?,memcpy), ref: 008E527F
LoadLibraryA.KERNELBASE(Advapi32.dll), ref: 008E6DEE
GetProcAddress.KERNEL32(?,RegSetValueExA), ref: 008E8961
GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 008EA4D4
GetProcAddress.KERNEL32(?,RegCloseKey), ref: 008EC047
GetProcAddress.KERNEL32(?,RegCreateKeyExA), ref: 008EDBBA
GetProcAddress.KERNEL32(?,RegQueryValueExA), ref: 008EF72D
LoadLibraryA.KERNELBASE(Shell32.dll), ref: 008F129C
GetProcAddress.KERNEL32(?,ShellExecuteEx), ref: 008F2E15
GetProcAddress.KERNEL32(?,SHGetFolderPathA), ref: 008F498B
LoadLibraryA.KERNELBASE(ws2_32.dll), ref: 008F64FA
GetProcAddress.KERNEL32(008B25AA,WSAStartup), ref: 008F806D
GetProcAddress.KERNEL32(008B25AA,socket), ref: 008F9BE0
GetProcAddress.KERNEL32(008B25AA,gethostbyname), ref: 008FB753
GetProcAddress.KERNEL32(008B25AA,htons), ref: 008FD2C6
GetProcAddress.KERNEL32(008B25AA,connect), ref: 008FEE39
GetProcAddress.KERNEL32(008B25AA,0092CF74), ref: 009009AC
GetProcAddress.KERNEL32(008B25AA,recv), ref: 0090251F
GetProcAddress.KERNEL32(008B25AA,closesocket), ref: 00904092
GetProcAddress.KERNEL32(008B25AA,WSACleanup), ref: 00905C05

Strings

GetModuleFileName, xrefs: 008D5BB1, 008D5BEE, 008D5C29, 008D5C67, 008D5CA5, 008D5CE3, 008D5D1F, 008D5D5D, 008D5D9B, 008D5DD9, 008D5E15, 008D5E53, 008D5E8F, 008D5ECD, 008D5F09, 008D5F47, 008D5F85, 008D5FC3, 008D5FFF, 008D603D, 008D6079, 008D60B7, 008D60F3, 008D6131, 008D616D, 008D61AB, 008D61E7, 008D6225, 008D6261, 008D629F, 008D62DB, 008D6319, 008D6357, 008D6395, 008D63D1, 008D640F, 008D644B, 008D6489, 008D64C5, 008D6503, 008D653F, 008D657D, 008D65B9, 008D65F7, 008D6633, 008D6671, 008D66AD, 008D66EB, 008D6727, 008D6765, 008D67A1, 008D67DF, 008D681B, 008D6859, 008D6895, 008D68D3, 008D690F, 008D694D, 008D6989, 008D69C7, 008D6A03, 008D6A41, 008D6A7D, 008D6ABB, 008D6AF5, 008D6B1B, 008D6B49, 008D6B77, 008D6BA5, 008D6BD3, 008D6C01, 008D6C2F, 008D6C5D, 008D6C8B, 008D6CB9, 008D6CE7, 008D6D15, 008D6D43, 008D6D71, 008D6D9F, 008D6DCD, 008D6DFB, 008D6E29, 008D6E57, 008D6E85, 008D6EB3, 008D6EE1, 008D6F0F, 008D6F3D, 008D6F6B, 008D6F99, 008D6FC7, 008D6FF5, 008D7023, 008D7051, 008D707F, 008D70AD, 008D70DB, 008D7109, 008D7137, 008D7165, 008D7193, 008D71C1, 008D71EF, 008D721D, 008D724B, 008D7279, 008D72A7, 008D72D5, 008D7303, 008D7331, 008D735F, 008D738D, 008D73BB, 008D73E9, 008D7417, 008D7445, 008D7473, 008D74A1, 008D74CF, 008D74FD, 008D752B, 008D7559, 008D7587, 008D75B5, 008D75E3, 008D7611, 008D763F, 008D766C, 008D7696, 008D76C4, 008D76D2, 008D76DC
WSAStartup, xrefs: 008F6539, 008F6576, 008F65B1, 008F65EF, 008F662D, 008F666B, 008F66A7, 008F66E5, 008F6723, 008F6761, 008F679D, 008F67DB, 008F6817, 008F6855, 008F6891, 008F68CF, 008F690D, 008F694B, 008F6987, 008F69C5, 008F6A01, 008F6A3F, 008F6A7B, 008F6AB9, 008F6AF5, 008F6B33, 008F6B6F, 008F6BAD, 008F6BE9, 008F6C27, 008F6C63, 008F6CA1, 008F6CDF, 008F6D1D, 008F6D59, 008F6D97, 008F6DD3, 008F6E11, 008F6E4D, 008F6E8B, 008F6EC7, 008F6F05, 008F6F41, 008F6F7F, 008F6FBB, 008F6FF9, 008F7035, 008F7073, 008F70AF, 008F70ED, 008F7129, 008F7167, 008F71A3, 008F71E1, 008F721D, 008F725B, 008F7297, 008F72D5, 008F7311, 008F734F, 008F738B, 008F73C9, 008F7405, 008F7443, 008F747D, 008F74A3, 008F74D1, 008F74FF, 008F752D, 008F755B, 008F7589, 008F75B7, 008F75E5, 008F7613, 008F7641, 008F766F, 008F769D, 008F76CB, 008F76F9, 008F7727, 008F7755, 008F7783, 008F77B1, 008F77DF, 008F780D, 008F783B, 008F7869, 008F7897, 008F78C5, 008F78F3, 008F7921, 008F794F, 008F797D, 008F79AB, 008F79D9, 008F7A07, 008F7A35, 008F7A63, 008F7A91, 008F7ABF, 008F7AED, 008F7B1B, 008F7B49, 008F7B77, 008F7BA5, 008F7BD3, 008F7C01, 008F7C2F, 008F7C5D, 008F7C8B, 008F7CB9, 008F7CE7, 008F7D15, 008F7D43, 008F7D71, 008F7D9F, 008F7DCD, 008F7DFB, 008F7E29, 008F7E57, 008F7E85, 008F7EB3, 008F7EE1, 008F7F0F, 008F7F3D, 008F7F6B, 008F7F99, 008F7FC7, 008F7FF4, 008F801E, 008F804C, 008F805A, 008F8064
GetProcAddress, xrefs: 008BC005, 008BC043, 008BC07D, 008BC0B9, 008BC0F6, 008BC132, 008BC170, 008BC1AC, 008BC1E9, 008BC225, 008BC263, 008BC29F, 008BC2DD, 008BC319, 008BC357, 008BC393, 008BC3D0, 008BC40C, 008BC44A, 008BC486, 008BC4C4, 008BC500, 008BC53E, 008BC57A, 008BC5B8, 008BC5F4, 008BC632, 008BC66E, 008BC6AC, 008BC6E8, 008BC726, 008BC762, 008BC79F, 008BC7DB, 008BC819, 008BC855, 008BC893, 008BC8CF, 008BC90D, 008BC949, 008BC987, 008BC9C3, 008BCA01, 008BCA3D, 008BCA7B, 008BCAB7, 008BCAF5, 008BCB31, 008BCB6F, 008BCBAB, 008BCBE9, 008BCC25, 008BCC63, 008BCC9F, 008BCCDD, 008BCD19, 008BCD57, 008BCD93, 008BCDD1, 008BCE0D, 008BCE4B, 008BCE87, 008BCEC5, 008BCF01, 008BCF3A, 008BCF60, 008BCF8E, 008BCFBC, 008BCFEA, 008BD018, 008BD046, 008BD074, 008BD0A2, 008BD0D0, 008BD0FE, 008BD12C, 008BD15A, 008BD188, 008BD1B6, 008BD1E4, 008BD212, 008BD240, 008BD26E, 008BD29C, 008BD2CA, 008BD2F8, 008BD326, 008BD354, 008BD382, 008BD3B0, 008BD3DE, 008BD40C, 008BD43A, 008BD468, 008BD496, 008BD4C4, 008BD4F2, 008BD520, 008BD54E, 008BD57C, 008BD5AA, 008BD5D8, 008BD606, 008BD634, 008BD662, 008BD690, 008BD6BE, 008BD6EC, 008BD71A, 008BD748, 008BD776, 008BD7A4, 008BD7D2, 008BD800, 008BD82E, 008BD85C, 008BD88A, 008BD8B8, 008BD8E6, 008BD914, 008BD942, 008BD970, 008BD99E, 008BD9CC, 008BD9FA, 008BDA28, 008BDA56, 008BDA84, 008BDAB1, 008BDADB, 008BDB09, 008BDB17, 008BDB21
GetClipboardData, xrefs: 008CEDE5, 008CEE22, 008CEE5D, 008CEE9B, 008CEED9, 008CEF17, 008CEF53, 008CEF91, 008CEFCF, 008CF00D, 008CF049, 008CF087, 008CF0C3, 008CF101, 008CF13D, 008CF17B, 008CF1B9, 008CF1F7, 008CF233, 008CF271, 008CF2AD, 008CF2EB, 008CF327, 008CF365, 008CF3A1, 008CF3DF, 008CF41B, 008CF459, 008CF495, 008CF4D3, 008CF50F, 008CF54D, 008CF58B, 008CF5C9, 008CF605, 008CF643, 008CF67F, 008CF6BD, 008CF6F9, 008CF737, 008CF773, 008CF7B1, 008CF7ED, 008CF82B, 008CF867, 008CF8A5, 008CF8E1, 008CF91F, 008CF95B, 008CF999, 008CF9D5, 008CFA13, 008CFA4F, 008CFA8D, 008CFAC9, 008CFB07, 008CFB43, 008CFB81, 008CFBBD, 008CFBFB, 008CFC37, 008CFC75, 008CFCB1, 008CFCEF, 008CFD29, 008CFD4F, 008CFD7D, 008CFDAB, 008CFDD9, 008CFE07, 008CFE35, 008CFE63, 008CFE91, 008CFEBF, 008CFEED, 008CFF1B, 008CFF49, 008CFF77, 008CFFA5, 008CFFD3, 008D0001, 008D002F, 008D005D, 008D008B, 008D00B9, 008D00E7, 008D0115, 008D0143, 008D0171, 008D019F, 008D01CD, 008D01FB, 008D0229, 008D0257, 008D0285, 008D02B3, 008D02E1, 008D030F, 008D033D, 008D036B, 008D0399, 008D03C7, 008D03F5, 008D0423, 008D0451, 008D047F, 008D04AD, 008D04DB, 008D0509, 008D0537, 008D0565, 008D0593, 008D05C1, 008D05EF, 008D061D, 008D064B, 008D0679, 008D06A7, 008D06D5, 008D0703, 008D0731, 008D075F, 008D078D, 008D07BB, 008D07E9, 008D0817, 008D0845, 008D0873, 008D08A0, 008D08CA, 008D08F8, 008D0906, 008D0910
User32.dll, xrefs: 008CB703, 008CB740, 008CB77B, 008CB7B9, 008CB7F7, 008CB835, 008CB871, 008CB8AF, 008CB8ED, 008CB92B, 008CB967, 008CB9A5, 008CB9E1, 008CBA1F, 008CBA5B, 008CBA99, 008CBAD7, 008CBB15, 008CBB51, 008CBB8F, 008CBBCB, 008CBC09, 008CBC45, 008CBC83, 008CBCBF, 008CBCFD, 008CBD39, 008CBD77, 008CBDB3, 008CBDF1, 008CBE2D, 008CBE6B, 008CBEA9, 008CBEE7, 008CBF23, 008CBF61, 008CBF9D, 008CBFDB, 008CC017, 008CC055, 008CC091, 008CC0CF, 008CC10B, 008CC149, 008CC185, 008CC1C3, 008CC1FF, 008CC23D, 008CC279, 008CC2B7, 008CC2F3, 008CC331, 008CC36D, 008CC3AB, 008CC3E7, 008CC425, 008CC461, 008CC49F, 008CC4DB, 008CC519, 008CC555, 008CC593, 008CC5CF, 008CC60D, 008CC647, 008CC66D, 008CC69B, 008CC6C9, 008CC6F7, 008CC725, 008CC753, 008CC781, 008CC7AF, 008CC7DD, 008CC80B, 008CC839, 008CC867, 008CC895, 008CC8C3, 008CC8F1, 008CC91F, 008CC94D, 008CC97B, 008CC9A9, 008CC9D7, 008CCA05, 008CCA33, 008CCA61, 008CCA8F, 008CCABD, 008CCAEB, 008CCB19, 008CCB47, 008CCB75, 008CCBA3, 008CCBD1, 008CCBFF, 008CCC2D, 008CCC5B, 008CCC89, 008CCCB7, 008CCCE5, 008CCD13, 008CCD41, 008CCD6F, 008CCD9D, 008CCDCB, 008CCDF9, 008CCE27, 008CCE55, 008CCE83, 008CCEB1, 008CCEDF, 008CCF0D, 008CCF3B, 008CCF69, 008CCF97, 008CCFC5, 008CCFF3, 008CD021, 008CD04F, 008CD07D, 008CD0AB, 008CD0D9, 008CD107, 008CD135, 008CD163, 008CD191, 008CD1BE, 008CD1E8, 008CD216, 008CD224, 008CD22E
RegCreateKeyExA, xrefs: 008EC086, 008EC0C3, 008EC0FE, 008EC13C, 008EC17A, 008EC1B8, 008EC1F4, 008EC232, 008EC270, 008EC2AE, 008EC2EA, 008EC328, 008EC364, 008EC3A2, 008EC3DE, 008EC41C, 008EC45A, 008EC498, 008EC4D4, 008EC512, 008EC54E, 008EC58C, 008EC5C8, 008EC606, 008EC642, 008EC680, 008EC6BC, 008EC6FA, 008EC736, 008EC774, 008EC7B0, 008EC7EE, 008EC82C, 008EC86A, 008EC8A6, 008EC8E4, 008EC920, 008EC95E, 008EC99A, 008EC9D8, 008ECA14, 008ECA52, 008ECA8E, 008ECACC, 008ECB08, 008ECB46, 008ECB82, 008ECBC0, 008ECBFC, 008ECC3A, 008ECC76, 008ECCB4, 008ECCF0, 008ECD2E, 008ECD6A, 008ECDA8, 008ECDE4, 008ECE22, 008ECE5E, 008ECE9C, 008ECED8, 008ECF16, 008ECF52, 008ECF90, 008ECFCA, 008ECFF0, 008ED01E, 008ED04C, 008ED07A, 008ED0A8, 008ED0D6, 008ED104, 008ED132, 008ED160, 008ED18E, 008ED1BC, 008ED1EA, 008ED218, 008ED246, 008ED274, 008ED2A2, 008ED2D0, 008ED2FE, 008ED32C, 008ED35A, 008ED388, 008ED3B6, 008ED3E4, 008ED412, 008ED440, 008ED46E, 008ED49C, 008ED4CA, 008ED4F8, 008ED526, 008ED554, 008ED582, 008ED5B0, 008ED5DE, 008ED60C, 008ED63A, 008ED668, 008ED696, 008ED6C4, 008ED6F2, 008ED720, 008ED74E, 008ED77C, 008ED7AA, 008ED7D8, 008ED806, 008ED834, 008ED862, 008ED890, 008ED8BE, 008ED8EC, 008ED91A, 008ED948, 008ED976, 008ED9A4, 008ED9D2, 008EDA00, 008EDA2E, 008EDA5C, 008EDA8A, 008EDAB8, 008EDAE6, 008EDB14, 008EDB41, 008EDB6B, 008EDB99, 008EDBA7, 008EDBB1
Sleep, xrefs: 008D9297, 008D92D4, 008D930F, 008D934D, 008D938B, 008D93C9, 008D9405, 008D9443, 008D9481, 008D94BF, 008D94FB, 008D9539, 008D9575, 008D95B3, 008D95EF, 008D962D, 008D966B, 008D96A9, 008D96E5, 008D9723, 008D975F, 008D979D, 008D97D9, 008D9817, 008D9853, 008D9891, 008D98CD, 008D990B, 008D9947, 008D9985, 008D99C1, 008D99FF, 008D9A3D, 008D9A7B, 008D9AB7, 008D9AF5, 008D9B31, 008D9B6F, 008D9BAB, 008D9BE9, 008D9C25, 008D9C63, 008D9C9F, 008D9CDD, 008D9D19, 008D9D57, 008D9D93, 008D9DD1, 008D9E0D, 008D9E4B, 008D9E87, 008D9EC5, 008D9F01, 008D9F3F, 008D9F7B, 008D9FB9, 008D9FF5, 008DA033, 008DA06F, 008DA0AD, 008DA0E9, 008DA127, 008DA163, 008DA1A1, 008DA1DB, 008DA201, 008DA22F, 008DA25D, 008DA28B, 008DA2B9, 008DA2E7, 008DA315, 008DA343, 008DA371, 008DA39F, 008DA3CD, 008DA3FB, 008DA429, 008DA457, 008DA485, 008DA4B3, 008DA4E1, 008DA50F, 008DA53D, 008DA56B, 008DA599, 008DA5C7, 008DA5F5, 008DA623, 008DA651, 008DA67F, 008DA6AD, 008DA6DB, 008DA709, 008DA737, 008DA765, 008DA793, 008DA7C1, 008DA7EF, 008DA81D, 008DA84B, 008DA879, 008DA8A7, 008DA8D5, 008DA903, 008DA931, 008DA95F, 008DA98D, 008DA9BB, 008DA9E9, 008DAA17, 008DAA45, 008DAA73, 008DAAA1, 008DAACF, 008DAAFD, 008DAB2B, 008DAB59, 008DAB87, 008DABB5, 008DABE3, 008DAC11, 008DAC3F, 008DAC6D, 008DAC9B, 008DACC9, 008DACF7, 008DAD25, 008DAD52, 008DAD7C, 008DADAA, 008DADB8, 008DADC2
ws2_32.dll, xrefs: 008F49CA, 008F4A07, 008F4A42, 008F4A80, 008F4ABE, 008F4AFC, 008F4B38, 008F4B76, 008F4BB4, 008F4BF2, 008F4C2E, 008F4C6C, 008F4CA8, 008F4CE6, 008F4D22, 008F4D60, 008F4D9E, 008F4DDC, 008F4E18, 008F4E56, 008F4E92, 008F4ED0, 008F4F0C, 008F4F4A, 008F4F86, 008F4FC4, 008F5000, 008F503E, 008F507A, 008F50B8, 008F50F4, 008F5132, 008F5170, 008F51AE, 008F51EA, 008F5228, 008F5264, 008F52A2, 008F52DE, 008F531C, 008F5358, 008F5396, 008F53D2, 008F5410, 008F544C, 008F548A, 008F54C6, 008F5504, 008F5540, 008F557E, 008F55BA, 008F55F8, 008F5634, 008F5672, 008F56AE, 008F56EC, 008F5728, 008F5766, 008F57A2, 008F57E0, 008F581C, 008F585A, 008F5896, 008F58D4, 008F590E, 008F5934, 008F5962, 008F5990, 008F59BE, 008F59EC, 008F5A1A, 008F5A48, 008F5A76, 008F5AA4, 008F5AD2, 008F5B00, 008F5B2E, 008F5B5C, 008F5B8A, 008F5BB8, 008F5BE6, 008F5C14, 008F5C42, 008F5C70, 008F5C9E, 008F5CCC, 008F5CFA, 008F5D28, 008F5D56, 008F5D84, 008F5DB2, 008F5DE0, 008F5E0E, 008F5E3C, 008F5E6A, 008F5E98, 008F5EC6, 008F5EF4, 008F5F22, 008F5F50, 008F5F7E, 008F5FAC, 008F5FDA, 008F6008, 008F6036, 008F6064, 008F6092, 008F60C0, 008F60EE, 008F611C, 008F614A, 008F6178, 008F61A6, 008F61D4, 008F6202, 008F6230, 008F625E, 008F628C, 008F62BA, 008F62E8, 008F6316, 008F6344, 008F6372, 008F63A0, 008F63CE, 008F63FC, 008F642A, 008F6458, 008F6485, 008F64AF, 008F64DD, 008F64EB, 008F64F5
GlobalAlloc, xrefs: 008C1251, 008C128E, 008C12C9, 008C1307, 008C1345, 008C1383, 008C13BF, 008C13FD, 008C143B, 008C1479, 008C14B5, 008C14F3, 008C152F, 008C156D, 008C15A9, 008C15E7, 008C1625, 008C1663, 008C169F, 008C16DD, 008C1719, 008C1757, 008C1793, 008C17D1, 008C180D, 008C184B, 008C1887, 008C18C5, 008C1901, 008C193F, 008C197B, 008C19B9, 008C19F7, 008C1A35, 008C1A71, 008C1AAF, 008C1AEB, 008C1B29, 008C1B65, 008C1BA3, 008C1BDF, 008C1C1D, 008C1C59, 008C1C97, 008C1CD3, 008C1D11, 008C1D4D, 008C1D8B, 008C1DC7, 008C1E05, 008C1E41, 008C1E7F, 008C1EBB, 008C1EF9, 008C1F35, 008C1F73, 008C1FAF, 008C1FED, 008C2029, 008C2067, 008C20A3, 008C20E1, 008C211D, 008C215B, 008C2195, 008C21BB, 008C21E9, 008C2217, 008C2245, 008C2273, 008C22A1, 008C22CF, 008C22FD, 008C232B, 008C2359, 008C2387, 008C23B5, 008C23E3, 008C2411, 008C243F, 008C246D, 008C249B, 008C24C9, 008C24F7, 008C2525, 008C2553, 008C2581, 008C25AF, 008C25DD, 008C260B, 008C2639, 008C2667, 008C2695, 008C26C3, 008C26F1, 008C271F, 008C274D, 008C277B, 008C27A9, 008C27D7, 008C2805, 008C2833, 008C2861, 008C288F, 008C28BD, 008C28EB, 008C2919, 008C2947, 008C2975, 008C29A3, 008C29D1, 008C29FF, 008C2A2D, 008C2A5B, 008C2A89, 008C2AB7, 008C2AE5, 008C2B13, 008C2B41, 008C2B6F, 008C2B9D, 008C2BCB, 008C2BF9, 008C2C27, 008C2C55, 008C2C83, 008C2CB1, 008C2CDF, 008C2D0C, 008C2D36, 008C2D64, 008C2D72, 008C2D7C
ReleaseMutex, xrefs: 008C64AA, 008C64E7, 008C6522, 008C6560, 008C659E, 008C65DC, 008C6618, 008C6656, 008C6694, 008C66D2, 008C670E, 008C674C, 008C6788, 008C67C6, 008C6802, 008C6840, 008C687E, 008C68BC, 008C68F8, 008C6936, 008C6972, 008C69B0, 008C69EC, 008C6A2A, 008C6A66, 008C6AA4, 008C6AE0, 008C6B1E, 008C6B5A, 008C6B98, 008C6BD4, 008C6C12, 008C6C50, 008C6C8E, 008C6CCA, 008C6D08, 008C6D44, 008C6D82, 008C6DBE, 008C6DFC, 008C6E38, 008C6E76, 008C6EB2, 008C6EF0, 008C6F2C, 008C6F6A, 008C6FA6, 008C6FE4, 008C7020, 008C705E, 008C709A, 008C70D8, 008C7114, 008C7152, 008C718E, 008C71CC, 008C7208, 008C7246, 008C7282, 008C72C0, 008C72FC, 008C733A, 008C7376, 008C73B4, 008C73EE, 008C7414, 008C7442, 008C7470, 008C749E, 008C74CC, 008C74FA, 008C7528, 008C7556, 008C7584, 008C75B2, 008C75E0, 008C760E, 008C763C, 008C766A, 008C7698, 008C76C6, 008C76F4, 008C7722, 008C7750, 008C777E, 008C77AC, 008C77DA, 008C7808, 008C7836, 008C7864, 008C7892, 008C78C0, 008C78EE, 008C791C, 008C794A, 008C7978, 008C79A6, 008C79D4, 008C7A02, 008C7A30, 008C7A5E, 008C7A8C, 008C7ABA, 008C7AE8, 008C7B16, 008C7B44, 008C7B72, 008C7BA0, 008C7BCE, 008C7BFC, 008C7C2A, 008C7C58, 008C7C86, 008C7CB4, 008C7CE2, 008C7D10, 008C7D3E, 008C7D6C, 008C7D9A, 008C7DC8, 008C7DF6, 008C7E24, 008C7E52, 008C7E80, 008C7EAE, 008C7EDC, 008C7F0A, 008C7F38, 008C7F65, 008C7F8F, 008C7FBD, 008C7FCB, 008C7FD5
msvcrt.dll, xrefs: 008E1BD6, 008E1C13, 008E1C4E, 008E1C8C, 008E1CCA, 008E1D08, 008E1D44, 008E1D82, 008E1DC0, 008E1DFE, 008E1E3A, 008E1E78, 008E1EB4, 008E1EF2, 008E1F2E, 008E1F6C, 008E1FAA, 008E1FE8, 008E2024, 008E2062, 008E209E, 008E20DC, 008E2118, 008E2156, 008E2192, 008E21D0, 008E220C, 008E224A, 008E2286, 008E22C4, 008E2300, 008E233E, 008E237C, 008E23BA, 008E23F6, 008E2434, 008E2470, 008E24AE, 008E24EA, 008E2528, 008E2564, 008E25A2, 008E25DE, 008E261C, 008E2658, 008E2696, 008E26D2, 008E2710, 008E274C, 008E278A, 008E27C6, 008E2804, 008E2840, 008E287E, 008E28BA, 008E28F8, 008E2934, 008E2972, 008E29AE, 008E29EC, 008E2A28, 008E2A66, 008E2AA2, 008E2AE0, 008E2B1A, 008E2B40, 008E2B6E, 008E2B9C, 008E2BCA, 008E2BF8, 008E2C26, 008E2C54, 008E2C82, 008E2CB0, 008E2CDE, 008E2D0C, 008E2D3A, 008E2D68, 008E2D96, 008E2DC4, 008E2DF2, 008E2E20, 008E2E4E, 008E2E7C, 008E2EAA, 008E2ED8, 008E2F06, 008E2F34, 008E2F62, 008E2F90, 008E2FBE, 008E2FEC, 008E301A, 008E3048, 008E3076, 008E30A4, 008E30D2, 008E3100, 008E312E, 008E315C, 008E318A, 008E31B8, 008E31E6, 008E3214, 008E3242, 008E3270, 008E329E, 008E32CC, 008E32FA, 008E3328, 008E3356, 008E3384, 008E33B2, 008E33E0, 008E340E, 008E343C, 008E346A, 008E3498, 008E34C6, 008E34F4, 008E3522, 008E3550, 008E357E, 008E35AC, 008E35DA, 008E3608, 008E3636, 008E3664, 008E3691, 008E36BB, 008E36E9, 008E36F7, 008E3701
memcpy, xrefs: 008E3748, 008E3785, 008E37C0, 008E37FE, 008E383C, 008E387A, 008E38B6, 008E38F4, 008E3932, 008E3970, 008E39AC, 008E39EA, 008E3A26, 008E3A64, 008E3AA0, 008E3ADE, 008E3B1C, 008E3B5A, 008E3B96, 008E3BD4, 008E3C10, 008E3C4E, 008E3C8A, 008E3CC8, 008E3D04, 008E3D42, 008E3D7E, 008E3DBC, 008E3DF8, 008E3E36, 008E3E72, 008E3EB0, 008E3EEE, 008E3F2C, 008E3F68, 008E3FA6, 008E3FE2, 008E4020, 008E405C, 008E409A, 008E40D6, 008E4114, 008E4150, 008E418E, 008E41CA, 008E4208, 008E4244, 008E4282, 008E42BE, 008E42FC, 008E4338, 008E4376, 008E43B2, 008E43F0, 008E442C, 008E446A, 008E44A6, 008E44E4, 008E4520, 008E455E, 008E459A, 008E45D8, 008E4614, 008E4652, 008E468C, 008E46B2, 008E46E0, 008E470E, 008E473C, 008E476A, 008E4798, 008E47C6, 008E47F4, 008E4822, 008E4850, 008E487E, 008E48AC, 008E48DA, 008E4908, 008E4936, 008E4964, 008E4992, 008E49C0, 008E49EE, 008E4A1C, 008E4A4A, 008E4A78, 008E4AA6, 008E4AD4, 008E4B02, 008E4B30, 008E4B5E, 008E4B8C, 008E4BBA, 008E4BE8, 008E4C16, 008E4C44, 008E4C72, 008E4CA0, 008E4CCE, 008E4CFC, 008E4D2A, 008E4D58, 008E4D86, 008E4DB4, 008E4DE2, 008E4E10, 008E4E3E, 008E4E6C, 008E4E9A, 008E4EC8, 008E4EF6, 008E4F24, 008E4F52, 008E4F80, 008E4FAE, 008E4FDC, 008E500A, 008E5038, 008E5066, 008E5094, 008E50C2, 008E50F0, 008E511E, 008E514C, 008E517A, 008E51A8, 008E51D6, 008E5203, 008E522D, 008E525B, 008E5269, 008E5273
LoadLibraryA, xrefs: 008B8A33, 008B8A71, 008B8AAB, 008B8AE7, 008B8B24, 008B8B60, 008B8B9E, 008B8BDA, 008B8C17, 008B8C53, 008B8C91, 008B8CCD, 008B8D0B, 008B8D47, 008B8D85, 008B8DC1, 008B8DFE, 008B8E3A, 008B8E78, 008B8EB4, 008B8EF2, 008B8F2E, 008B8F6C, 008B8FA8, 008B8FE6, 008B9022, 008B9060, 008B909C, 008B90DA, 008B9116, 008B9154, 008B9190, 008B91CD, 008B9209, 008B9247, 008B9283, 008B92C1, 008B92FD, 008B933B, 008B9377, 008B93B5, 008B93F1, 008B942F, 008B946B, 008B94A9, 008B94E5, 008B9523, 008B955F, 008B959D, 008B95D9, 008B9617, 008B9653, 008B9691, 008B96CD, 008B970B, 008B9747, 008B9785, 008B97C1, 008B97FF, 008B983B, 008B9879, 008B98B5, 008B98F3, 008B992F, 008B9968, 008B9988, 008B99AD, 008B99D2, 008B99F7, 008B9A1C, 008B9A41, 008B9A66, 008B9A8B, 008B9AB0, 008B9AD5, 008B9AFA, 008B9B1F, 008B9B44, 008B9B69, 008B9B8E, 008B9BB3, 008B9BD8, 008B9BFD, 008B9C22, 008B9C47, 008B9C6C, 008B9C91, 008B9CB6, 008B9CDB, 008B9D00, 008B9D25, 008B9D4A, 008B9D6F, 008B9D9A, 008B9DC8, 008B9DF6, 008B9E24, 008B9E52, 008B9E80, 008B9EAE, 008B9EDC, 008B9F0A, 008B9F38, 008B9F66, 008B9F94, 008B9FC2, 008B9FF0, 008BA01E, 008BA04C, 008BA07A, 008BA0A8, 008BA0D6, 008BA104, 008BA132, 008BA160, 008BA18E, 008BA1BC, 008BA1EA, 008BA218, 008BA246, 008BA274, 008BA2A2, 008BA2D0, 008BA2FE, 008BA32C, 008BA35A, 008BA388, 008BA3B6, 008BA3E3, 008BA40D, 008BA43B, 008BA449, 008BBFA5
RegCloseKey, xrefs: 008EA513, 008EA550, 008EA58B, 008EA5C9, 008EA607, 008EA645, 008EA681, 008EA6BF, 008EA6FD, 008EA73B, 008EA777, 008EA7B5, 008EA7F1, 008EA82F, 008EA86B, 008EA8A9, 008EA8E7, 008EA925, 008EA961, 008EA99F, 008EA9DB, 008EAA19, 008EAA55, 008EAA93, 008EAACF, 008EAB0D, 008EAB49, 008EAB87, 008EABC3, 008EAC01, 008EAC3D, 008EAC7B, 008EACB9, 008EACF7, 008EAD33, 008EAD71, 008EADAD, 008EADEB, 008EAE27, 008EAE65, 008EAEA1, 008EAEDF, 008EAF1B, 008EAF59, 008EAF95, 008EAFD3, 008EB00F, 008EB04D, 008EB089, 008EB0C7, 008EB103, 008EB141, 008EB17D, 008EB1BB, 008EB1F7, 008EB235, 008EB271, 008EB2AF, 008EB2EB, 008EB329, 008EB365, 008EB3A3, 008EB3DF, 008EB41D, 008EB457, 008EB47D, 008EB4AB, 008EB4D9, 008EB507, 008EB535, 008EB563, 008EB591, 008EB5BF, 008EB5ED, 008EB61B, 008EB649, 008EB677, 008EB6A5, 008EB6D3, 008EB701, 008EB72F, 008EB75D, 008EB78B, 008EB7B9, 008EB7E7, 008EB815, 008EB843, 008EB871, 008EB89F, 008EB8CD, 008EB8FB, 008EB929, 008EB957, 008EB985, 008EB9B3, 008EB9E1, 008EBA0F, 008EBA3D, 008EBA6B, 008EBA99, 008EBAC7, 008EBAF5, 008EBB23, 008EBB51, 008EBB7F, 008EBBAD, 008EBBDB, 008EBC09, 008EBC37, 008EBC65, 008EBC93, 008EBCC1, 008EBCEF, 008EBD1D, 008EBD4B, 008EBD79, 008EBDA7, 008EBDD5, 008EBE03, 008EBE31, 008EBE5F, 008EBE8D, 008EBEBB, 008EBEE9, 008EBF17, 008EBF45, 008EBF73, 008EBFA1, 008EBFCE, 008EBFF8, 008EC026, 008EC034, 008EC03E
ExitProcess, xrefs: 008C801D, 008C805A, 008C8095, 008C80D3, 008C8111, 008C814F, 008C818B, 008C81C9, 008C8207, 008C8245, 008C8281, 008C82BF, 008C82FB, 008C8339, 008C8375, 008C83B3, 008C83F1, 008C842F, 008C846B, 008C84A9, 008C84E5, 008C8523, 008C855F, 008C859D, 008C85D9, 008C8617, 008C8653, 008C8691, 008C86CD, 008C870B, 008C8747, 008C8785, 008C87C3, 008C8801, 008C883D, 008C887B, 008C88B7, 008C88F5, 008C8931, 008C896F, 008C89AB, 008C89E9, 008C8A25, 008C8A63, 008C8A9F, 008C8ADD, 008C8B19, 008C8B57, 008C8B93, 008C8BD1, 008C8C0D, 008C8C4B, 008C8C87, 008C8CC5, 008C8D01, 008C8D3F, 008C8D7B, 008C8DB9, 008C8DF5, 008C8E33, 008C8E6F, 008C8EAD, 008C8EE9, 008C8F27, 008C8F61, 008C8F87, 008C8FB5, 008C8FE3, 008C9011, 008C903F, 008C906D, 008C909B, 008C90C9, 008C90F7, 008C9125, 008C9153, 008C9181, 008C91AF, 008C91DD, 008C920B, 008C9239, 008C9267, 008C9295, 008C92C3, 008C92F1, 008C931F, 008C934D, 008C937B, 008C93A9, 008C93D7, 008C9405, 008C9433, 008C9461, 008C948F, 008C94BD, 008C94EB, 008C9519, 008C9547, 008C9575, 008C95A3, 008C95D1, 008C95FF, 008C962D, 008C965B, 008C9689, 008C96B7, 008C96E5, 008C9713, 008C9741, 008C976F, 008C979D, 008C97CB, 008C97F9, 008C9827, 008C9855, 008C9883, 008C98B1, 008C98DF, 008C990D, 008C993B, 008C9969, 008C9997, 008C99C5, 008C99F3, 008C9A21, 008C9A4F, 008C9A7D, 008C9AAB, 008C9AD8, 008C9B02, 008C9B30, 008C9B3E, 008C9B48
SHGetFolderPathA, xrefs: 008F2E54, 008F2E91, 008F2ECC, 008F2F0A, 008F2F48, 008F2F86, 008F2FC2, 008F3000, 008F303E, 008F307C, 008F30B8, 008F30F6, 008F3132, 008F3170, 008F31AC, 008F31EA, 008F3228, 008F3266, 008F32A2, 008F32E0, 008F331C, 008F335A, 008F3396, 008F33D4, 008F3410, 008F344E, 008F348A, 008F34C8, 008F3504, 008F3542, 008F357E, 008F35BC, 008F35FA, 008F3638, 008F3674, 008F36B2, 008F36EE, 008F372C, 008F3768, 008F37A6, 008F37E2, 008F3820, 008F385C, 008F389A, 008F38D6, 008F3914, 008F3950, 008F398E, 008F39CA, 008F3A08, 008F3A44, 008F3A82, 008F3ABE, 008F3AFC, 008F3B38, 008F3B76, 008F3BB2, 008F3BF0, 008F3C2C, 008F3C6A, 008F3CA6, 008F3CE4, 008F3D20, 008F3D5E, 008F3D98, 008F3DBE, 008F3DEC, 008F3E1A, 008F3E48, 008F3E76, 008F3EA4, 008F3ED2, 008F3F00, 008F3F2E, 008F3F5C, 008F3F8A, 008F3FB8, 008F3FE6, 008F4014, 008F4042, 008F4070, 008F409E, 008F40CC, 008F40FA, 008F4128, 008F4156, 008F4184, 008F41B2, 008F41E0, 008F420E, 008F423C, 008F426A, 008F4298, 008F42C6, 008F42F4, 008F4322, 008F4350, 008F437E, 008F43AC, 008F43DA, 008F4408, 008F4436, 008F4464, 008F4492, 008F44C0, 008F44EE, 008F451C, 008F454A, 008F4578, 008F45A6, 008F45D4, 008F4602, 008F4630, 008F465E, 008F468C, 008F46BA, 008F46E8, 008F4716, 008F4744, 008F4772, 008F47A0, 008F47CE, 008F47FC, 008F482A, 008F4858, 008F4886, 008F48B4, 008F48E2, 008F490F, 008F4939, 008F4967, 008F4975, 008F497F
RegQueryValueExA, xrefs: 008EDBF9, 008EDC36, 008EDC71, 008EDCAF, 008EDCED, 008EDD2B, 008EDD67, 008EDDA5, 008EDDE3, 008EDE21, 008EDE5D, 008EDE9B, 008EDED7, 008EDF15, 008EDF51, 008EDF8F, 008EDFCD, 008EE00B, 008EE047, 008EE085, 008EE0C1, 008EE0FF, 008EE13B, 008EE179, 008EE1B5, 008EE1F3, 008EE22F, 008EE26D, 008EE2A9, 008EE2E7, 008EE323, 008EE361, 008EE39F, 008EE3DD, 008EE419, 008EE457, 008EE493, 008EE4D1, 008EE50D, 008EE54B, 008EE587, 008EE5C5, 008EE601, 008EE63F, 008EE67B, 008EE6B9, 008EE6F5, 008EE733, 008EE76F, 008EE7AD, 008EE7E9, 008EE827, 008EE863, 008EE8A1, 008EE8DD, 008EE91B, 008EE957, 008EE995, 008EE9D1, 008EEA0F, 008EEA4B, 008EEA89, 008EEAC5, 008EEB03, 008EEB3D, 008EEB63, 008EEB91, 008EEBBF, 008EEBED, 008EEC1B, 008EEC49, 008EEC77, 008EECA5, 008EECD3, 008EED01, 008EED2F, 008EED5D, 008EED8B, 008EEDB9, 008EEDE7, 008EEE15, 008EEE43, 008EEE71, 008EEE9F, 008EEECD, 008EEEFB, 008EEF29, 008EEF57, 008EEF85, 008EEFB3, 008EEFE1, 008EF00F, 008EF03D, 008EF06B, 008EF099, 008EF0C7, 008EF0F5, 008EF123, 008EF151, 008EF17F, 008EF1AD, 008EF1DB, 008EF209, 008EF237, 008EF265, 008EF293, 008EF2C1, 008EF2EF, 008EF31D, 008EF34B, 008EF379, 008EF3A7, 008EF3D5, 008EF403, 008EF431, 008EF45F, 008EF48D, 008EF4BB, 008EF4E9, 008EF517, 008EF545, 008EF573, 008EF5A1, 008EF5CF, 008EF5FD, 008EF62B, 008EF659, 008EF687, 008EF6B4, 008EF6DE, 008EF70C, 008EF71A, 008EF724
WaitForSingleObject, xrefs: 008DE4F0, 008DE52D, 008DE568, 008DE5A6, 008DE5E4, 008DE622, 008DE65E, 008DE69C, 008DE6DA, 008DE718, 008DE754, 008DE792, 008DE7CE, 008DE80C, 008DE848, 008DE886, 008DE8C4, 008DE902, 008DE93E, 008DE97C, 008DE9B8, 008DE9F6, 008DEA32, 008DEA70, 008DEAAC, 008DEAEA, 008DEB26, 008DEB64, 008DEBA0, 008DEBDE, 008DEC1A, 008DEC58, 008DEC96, 008DECD4, 008DED10, 008DED4E, 008DED8A, 008DEDC8, 008DEE04, 008DEE42, 008DEE7E, 008DEEBC, 008DEEF8, 008DEF36, 008DEF72, 008DEFB0, 008DEFEC, 008DF02A, 008DF066, 008DF0A4, 008DF0E0, 008DF11E, 008DF15A, 008DF198, 008DF1D4, 008DF212, 008DF24E, 008DF28C, 008DF2C8, 008DF306, 008DF342, 008DF380, 008DF3BC, 008DF3FA, 008DF434, 008DF45A, 008DF488, 008DF4B6, 008DF4E4, 008DF512, 008DF540, 008DF56E, 008DF59C, 008DF5CA, 008DF5F8, 008DF626, 008DF654, 008DF682, 008DF6B0, 008DF6DE, 008DF70C, 008DF73A, 008DF768, 008DF796, 008DF7C4, 008DF7F2, 008DF820, 008DF84E, 008DF87C, 008DF8AA, 008DF8D8, 008DF906, 008DF934, 008DF962, 008DF990, 008DF9BE, 008DF9EC, 008DFA1A, 008DFA48, 008DFA76, 008DFAA4, 008DFAD2, 008DFB00, 008DFB2E, 008DFB5C, 008DFB8A, 008DFBB8, 008DFBE6, 008DFC14, 008DFC42, 008DFC70, 008DFC9E, 008DFCCC, 008DFCFA, 008DFD28, 008DFD56, 008DFD84, 008DFDB2, 008DFDE0, 008DFE0E, 008DFE3C, 008DFE6A, 008DFE98, 008DFEC6, 008DFEF4, 008DFF22, 008DFF50, 008DFF7E, 008DFFAB, 008DFFD5, 008E0003, 008E0011, 008E001B
CreateDirectoryA, xrefs: 008DC97D, 008DC9BA, 008DC9F5, 008DCA33, 008DCA71, 008DCAAF, 008DCAEB, 008DCB29, 008DCB67, 008DCBA5, 008DCBE1, 008DCC1F, 008DCC5B, 008DCC99, 008DCCD5, 008DCD13, 008DCD51, 008DCD8F, 008DCDCB, 008DCE09, 008DCE45, 008DCE83, 008DCEBF, 008DCEFD, 008DCF39, 008DCF77, 008DCFB3, 008DCFF1, 008DD02D, 008DD06B, 008DD0A7, 008DD0E5, 008DD123, 008DD161, 008DD19D, 008DD1DB, 008DD217, 008DD255, 008DD291, 008DD2CF, 008DD30B, 008DD349, 008DD385, 008DD3C3, 008DD3FF, 008DD43D, 008DD479, 008DD4B7, 008DD4F3, 008DD531, 008DD56D, 008DD5AB, 008DD5E7, 008DD625, 008DD661, 008DD69F, 008DD6DB, 008DD719, 008DD755, 008DD793, 008DD7CF, 008DD80D, 008DD849, 008DD887, 008DD8C1, 008DD8E7, 008DD915, 008DD943, 008DD971, 008DD99F, 008DD9CD, 008DD9FB, 008DDA29, 008DDA57, 008DDA85, 008DDAB3, 008DDAE1, 008DDB0F, 008DDB3D, 008DDB6B, 008DDB99, 008DDBC7, 008DDBF5, 008DDC23, 008DDC51, 008DDC7F, 008DDCAD, 008DDCDB, 008DDD09, 008DDD37, 008DDD65, 008DDD93, 008DDDC1, 008DDDEF, 008DDE1D, 008DDE4B, 008DDE79, 008DDEA7, 008DDED5, 008DDF03, 008DDF31, 008DDF5F, 008DDF8D, 008DDFBB, 008DDFE9, 008DE017, 008DE045, 008DE073, 008DE0A1, 008DE0CF, 008DE0FD, 008DE12B, 008DE159, 008DE187, 008DE1B5, 008DE1E3, 008DE211, 008DE23F, 008DE26D, 008DE29B, 008DE2C9, 008DE2F7, 008DE325, 008DE353, 008DE381, 008DE3AF, 008DE3DD, 008DE40B, 008DE438, 008DE462, 008DE490, 008DE49E, 008DE4A8
SetClipboardData, xrefs: 008D24CB, 008D2508, 008D2543, 008D2581, 008D25BF, 008D25FD, 008D2639, 008D2677, 008D26B5, 008D26F3, 008D272F, 008D276D, 008D27A9, 008D27E7, 008D2823, 008D2861, 008D289F, 008D28DD, 008D2919, 008D2957, 008D2993, 008D29D1, 008D2A0D, 008D2A4B, 008D2A87, 008D2AC5, 008D2B01, 008D2B3F, 008D2B7B, 008D2BB9, 008D2BF5, 008D2C33, 008D2C71, 008D2CAF, 008D2CEB, 008D2D29, 008D2D65, 008D2DA3, 008D2DDF, 008D2E1D, 008D2E59, 008D2E97, 008D2ED3, 008D2F11, 008D2F4D, 008D2F8B, 008D2FC7, 008D3005, 008D3041, 008D307F, 008D30BB, 008D30F9, 008D3135, 008D3173, 008D31AF, 008D31ED, 008D3229, 008D3267, 008D32A3, 008D32E1, 008D331D, 008D335B, 008D3397, 008D33D5, 008D340F, 008D3435, 008D3463, 008D3491, 008D34BF, 008D34ED, 008D351B, 008D3549, 008D3577, 008D35A5, 008D35D3, 008D3601, 008D362F, 008D365D, 008D368B, 008D36B9, 008D36E7, 008D3715, 008D3743, 008D3771, 008D379F, 008D37CD, 008D37FB, 008D3829, 008D3857, 008D3885, 008D38B3, 008D38E1, 008D390F, 008D393D, 008D396B, 008D3999, 008D39C7, 008D39F5, 008D3A23, 008D3A51, 008D3A7F, 008D3AAD, 008D3ADB, 008D3B09, 008D3B37, 008D3B65, 008D3B93, 008D3BC1, 008D3BEF, 008D3C1D, 008D3C4B, 008D3C79, 008D3CA7, 008D3CD5, 008D3D03, 008D3D31, 008D3D5F, 008D3D8D, 008D3DBB, 008D3DE9, 008D3E17, 008D3E45, 008D3E73, 008D3EA1, 008D3ECF, 008D3EFD, 008D3F2B, 008D3F59, 008D3F86, 008D3FB0, 008D3FDE, 008D3FEC, 008D3FF6
Kernel32.dll, xrefs: 008BA489, 008BA4C7, 008BA501, 008BA53D, 008BA57A, 008BA5B6, 008BA5F4, 008BA630, 008BA66D, 008BA6A9, 008BA6E7, 008BA723, 008BA761, 008BA79D, 008BA7DB, 008BA817, 008BA854, 008BA890, 008BA8CE, 008BA90A, 008BA948, 008BA984, 008BA9C2, 008BA9FE, 008BAA3C, 008BAA78, 008BAAB6, 008BAAF2, 008BAB30, 008BAB6C, 008BABAA, 008BABE6, 008BAC23, 008BAC5F, 008BAC9D, 008BACD9, 008BAD17, 008BAD53, 008BAD91, 008BADCD, 008BAE0B, 008BAE47, 008BAE85, 008BAEC1, 008BAEFF, 008BAF3B, 008BAF79, 008BAFB5, 008BAFF3, 008BB02F, 008BB06D, 008BB0A9, 008BB0E7, 008BB123, 008BB161, 008BB19D, 008BB1DB, 008BB217, 008BB255, 008BB291, 008BB2CF, 008BB30B, 008BB349, 008BB385, 008BB3BE, 008BB3E4, 008BB412, 008BB440, 008BB46E, 008BB49C, 008BB4CA, 008BB4F8, 008BB526, 008BB554, 008BB582, 008BB5B0, 008BB5DE, 008BB60C, 008BB63A, 008BB668, 008BB696, 008BB6C4, 008BB6F2, 008BB720, 008BB74E, 008BB77C, 008BB7AA, 008BB7D8, 008BB806, 008BB834, 008BB862, 008BB890, 008BB8BE, 008BB8EC, 008BB91A, 008BB948, 008BB976, 008BB9A4, 008BB9D2, 008BBA00, 008BBA2E, 008BBA5C, 008BBA8A, 008BBAB8, 008BBAE6, 008BBB14, 008BBB42, 008BBB70, 008BBB9E, 008BBBCC, 008BBBFA, 008BBC28, 008BBC56, 008BBC84, 008BBCB2, 008BBCE0, 008BBD0E, 008BBD3C, 008BBD6A, 008BBD98, 008BBDC6, 008BBDF4, 008BBE22, 008BBE50, 008BBE7E, 008BBEAC, 008BBEDA, 008BBF08, 008BBF35, 008BBF5F, 008BBF8D, 008BBF9B, 008BBFAA, 008BBFC1
socket, xrefs: 008F80AC, 008F80E9, 008F8124, 008F8162, 008F81A0, 008F81DE, 008F821A, 008F8258, 008F8296, 008F82D4, 008F8310, 008F834E, 008F838A, 008F83C8, 008F8404, 008F8442, 008F8480, 008F84BE, 008F84FA, 008F8538, 008F8574, 008F85B2, 008F85EE, 008F862C, 008F8668, 008F86A6, 008F86E2, 008F8720, 008F875C, 008F879A, 008F87D6, 008F8814, 008F8852, 008F8890, 008F88CC, 008F890A, 008F8946, 008F8984, 008F89C0, 008F89FE, 008F8A3A, 008F8A78, 008F8AB4, 008F8AF2, 008F8B2E, 008F8B6C, 008F8BA8, 008F8BE6, 008F8C22, 008F8C60, 008F8C9C, 008F8CDA, 008F8D16, 008F8D54, 008F8D90, 008F8DCE, 008F8E0A, 008F8E48, 008F8E84, 008F8EC2, 008F8EFE, 008F8F3C, 008F8F78, 008F8FB6, 008F8FF0, 008F9016, 008F9044, 008F9072, 008F90A0, 008F90CE, 008F90FC, 008F912A, 008F9158, 008F9186, 008F91B4, 008F91E2, 008F9210, 008F923E, 008F926C, 008F929A, 008F92C8, 008F92F6, 008F9324, 008F9352, 008F9380, 008F93AE, 008F93DC, 008F940A, 008F9438, 008F9466, 008F9494, 008F94C2, 008F94F0, 008F951E, 008F954C, 008F957A, 008F95A8, 008F95D6, 008F9604, 008F9632, 008F9660, 008F968E, 008F96BC, 008F96EA, 008F9718, 008F9746, 008F9774, 008F97A2, 008F97D0, 008F97FE, 008F982C, 008F985A, 008F9888, 008F98B6, 008F98E4, 008F9912, 008F9940, 008F996E, 008F999C, 008F99CA, 008F99F8, 008F9A26, 008F9A54, 008F9A82, 008F9AB0, 008F9ADE, 008F9B0C, 008F9B3A, 008F9B67, 008F9B91, 008F9BBF, 008F9BCD, 008F9BD7
MoveFileA, xrefs: 008D7724, 008D7761, 008D779C, 008D77DA, 008D7818, 008D7856, 008D7892, 008D78D0, 008D790E, 008D794C, 008D7988, 008D79C6, 008D7A02, 008D7A40, 008D7A7C, 008D7ABA, 008D7AF8, 008D7B36, 008D7B72, 008D7BB0, 008D7BEC, 008D7C2A, 008D7C66, 008D7CA4, 008D7CE0, 008D7D1E, 008D7D5A, 008D7D98, 008D7DD4, 008D7E12, 008D7E4E, 008D7E8C, 008D7ECA, 008D7F08, 008D7F44, 008D7F82, 008D7FBE, 008D7FFC, 008D8038, 008D8076, 008D80B2, 008D80F0, 008D812C, 008D816A, 008D81A6, 008D81E4, 008D8220, 008D825E, 008D829A, 008D82D8, 008D8314, 008D8352, 008D838E, 008D83CC, 008D8408, 008D8446, 008D8482, 008D84C0, 008D84FC, 008D853A, 008D8576, 008D85B4, 008D85F0, 008D862E, 008D8668, 008D868E, 008D86BC, 008D86EA, 008D8718, 008D8746, 008D8774, 008D87A2, 008D87D0, 008D87FE, 008D882C, 008D885A, 008D8888, 008D88B6, 008D88E4, 008D8912, 008D8940, 008D896E, 008D899C, 008D89CA, 008D89F8, 008D8A26, 008D8A54, 008D8A82, 008D8AB0, 008D8ADE, 008D8B0C, 008D8B3A, 008D8B68, 008D8B96, 008D8BC4, 008D8BF2, 008D8C20, 008D8C4E, 008D8C7C, 008D8CAA, 008D8CD8, 008D8D06, 008D8D34, 008D8D62, 008D8D90, 008D8DBE, 008D8DEC, 008D8E1A, 008D8E48, 008D8E76, 008D8EA4, 008D8ED2, 008D8F00, 008D8F2E, 008D8F5C, 008D8F8A, 008D8FB8, 008D8FE6, 008D9014, 008D9042, 008D9070, 008D909E, 008D90CC, 008D90FA, 008D9128, 008D9156, 008D9184, 008D91B2, 008D91DF, 008D9209, 008D9237, 008D9245, 008D924F
ShellExecuteEx, xrefs: 008F12DE, 008F131B, 008F1356, 008F1394, 008F13D2, 008F1410, 008F144C, 008F148A, 008F14C8, 008F1506, 008F1542, 008F1580, 008F15BC, 008F15FA, 008F1636, 008F1674, 008F16B2, 008F16F0, 008F172C, 008F176A, 008F17A6, 008F17E4, 008F1820, 008F185E, 008F189A, 008F18D8, 008F1914, 008F1952, 008F198E, 008F19CC, 008F1A08, 008F1A46, 008F1A84, 008F1AC2, 008F1AFE, 008F1B3C, 008F1B78, 008F1BB6, 008F1BF2, 008F1C30, 008F1C6C, 008F1CAA, 008F1CE6, 008F1D24, 008F1D60, 008F1D9E, 008F1DDA, 008F1E18, 008F1E54, 008F1E92, 008F1ECE, 008F1F0C, 008F1F48, 008F1F86, 008F1FC2, 008F2000, 008F203C, 008F207A, 008F20B6, 008F20F4, 008F2130, 008F216E, 008F21AA, 008F21E8, 008F2222, 008F2248, 008F2276, 008F22A4, 008F22D2, 008F2300, 008F232E, 008F235C, 008F238A, 008F23B8, 008F23E6, 008F2414, 008F2442, 008F2470, 008F249E, 008F24CC, 008F24FA, 008F2528, 008F2556, 008F2584, 008F25B2, 008F25E0, 008F260E, 008F263C, 008F266A, 008F2698, 008F26C6, 008F26F4, 008F2722, 008F2750, 008F277E, 008F27AC, 008F27DA, 008F2808, 008F2836, 008F2864, 008F2892, 008F28C0, 008F28EE, 008F291C, 008F294A, 008F2978, 008F29A6, 008F29D4, 008F2A02, 008F2A30, 008F2A5E, 008F2A8C, 008F2ABA, 008F2AE8, 008F2B16, 008F2B44, 008F2B72, 008F2BA0, 008F2BCE, 008F2BFC, 008F2C2A, 008F2C58, 008F2C86, 008F2CB4, 008F2CE2, 008F2D10, 008F2D3E, 008F2D6C, 008F2D99, 008F2DC3, 008F2DF1, 008F2DFF, 008F2E09
WSACleanup, xrefs: 009040D1, 0090410E, 00904149, 00904187, 009041C5, 00904203, 0090423F, 0090427D, 009042BB, 009042F9, 00904335, 00904373, 009043AF, 009043ED, 00904429, 00904467, 009044A5, 009044E3, 0090451F, 0090455D, 00904599, 009045D7, 00904613, 00904651, 0090468D, 009046CB, 00904707, 00904745, 00904781, 009047BF, 009047FB, 00904839, 00904877, 009048B5, 009048F1, 0090492F, 0090496B, 009049A9, 009049E5, 00904A23, 00904A5F, 00904A9D, 00904AD9, 00904B17, 00904B53, 00904B91, 00904BCD, 00904C0B, 00904C47, 00904C85, 00904CC1, 00904CFF, 00904D3B, 00904D79, 00904DB5, 00904DF3, 00904E2F, 00904E6D, 00904EA9, 00904EE7, 00904F23, 00904F61, 00904F9D, 00904FDB, 00905015, 0090503B, 00905069, 00905097, 009050C5, 009050F3, 00905121, 0090514F, 0090517D, 009051AB, 009051D9, 00905207, 00905235, 00905263, 00905291, 009052BF, 009052ED, 0090531B, 00905349, 00905377, 009053A5, 009053D3, 00905401, 0090542F, 0090545D, 0090548B, 009054B9, 009054E7, 00905515, 00905543, 00905571, 0090559F, 009055CD, 009055FB, 00905629, 00905657, 00905685, 009056B3, 009056E1, 0090570F, 0090573D, 0090576B, 00905799, 009057C7, 009057F5, 00905823, 00905851, 0090587F, 009058AD, 009058DB, 00905909, 00905937, 00905965, 00905993, 009059C1, 009059EF, 00905A1D, 00905A4B, 00905A79, 00905AA7, 00905AD5, 00905B03, 00905B31, 00905B5F, 00905B8C, 00905BB6, 00905BE4, 00905BF2, 00905BFC
GlobalFree, xrefs: 008C2DC4, 008C2E01, 008C2E3C, 008C2E7A, 008C2EB8, 008C2EF6, 008C2F32, 008C2F70, 008C2FAE, 008C2FEC, 008C3028, 008C3066, 008C30A2, 008C30E0, 008C311C, 008C315A, 008C3198, 008C31D6, 008C3212, 008C3250, 008C328C, 008C32CA, 008C3306, 008C3344, 008C3380, 008C33BE, 008C33FA, 008C3438, 008C3474, 008C34B2, 008C34EE, 008C352C, 008C356A, 008C35A8, 008C35E4, 008C3622, 008C365E, 008C369C, 008C36D8, 008C3716, 008C3752, 008C3790, 008C37CC, 008C380A, 008C3846, 008C3884, 008C38C0, 008C38FE, 008C393A, 008C3978, 008C39B4, 008C39F2, 008C3A2E, 008C3A6C, 008C3AA8, 008C3AE6, 008C3B22, 008C3B60, 008C3B9C, 008C3BDA, 008C3C16, 008C3C54, 008C3C90, 008C3CCE, 008C3D08, 008C3D2E, 008C3D5C, 008C3D8A, 008C3DB8, 008C3DE6, 008C3E14, 008C3E42, 008C3E70, 008C3E9E, 008C3ECC, 008C3EFA, 008C3F28, 008C3F56, 008C3F84, 008C3FB2, 008C3FE0, 008C400E, 008C403C, 008C406A, 008C4098, 008C40C6, 008C40F4, 008C4122, 008C4150, 008C417E, 008C41AC, 008C41DA, 008C4208, 008C4236, 008C4264, 008C4292, 008C42C0, 008C42EE, 008C431C, 008C434A, 008C4378, 008C43A6, 008C43D4, 008C4402, 008C4430, 008C445E, 008C448C, 008C44BA, 008C44E8, 008C4516, 008C4544, 008C4572, 008C45A0, 008C45CE, 008C45FC, 008C462A, 008C4658, 008C4686, 008C46B4, 008C46E2, 008C4710, 008C473E, 008C476C, 008C479A, 008C47C8, 008C47F6, 008C4824, 008C4852, 008C487F, 008C48A9, 008C48D7, 008C48E5, 008C48EF
recv, xrefs: 009009EB, 00900A28, 00900A63, 00900AA1, 00900ADF, 00900B1D, 00900B59, 00900B97, 00900BD5, 00900C13, 00900C4F, 00900C8D, 00900CC9, 00900D07, 00900D43, 00900D81, 00900DBF, 00900DFD, 00900E39, 00900E77, 00900EB3, 00900EF1, 00900F2D, 00900F6B, 00900FA7, 00900FE5, 00901021, 0090105F, 0090109B, 009010D9, 00901115, 00901153, 00901191, 009011CF, 0090120B, 00901249, 00901285, 009012C3, 009012FF, 0090133D, 00901379, 009013B7, 009013F3, 00901431, 0090146D, 009014AB, 009014E7, 00901525, 00901561, 0090159F, 009015DB, 00901619, 00901655, 00901693, 009016CF, 0090170D, 00901749, 00901787, 009017C3, 00901801, 0090183D, 0090187B, 009018B7, 009018F5, 0090192F, 00901955, 00901983, 009019B1, 009019DF, 00901A0D, 00901A3B, 00901A69, 00901A97, 00901AC5, 00901AF3, 00901B21, 00901B4F, 00901B7D, 00901BAB, 00901BD9, 00901C07, 00901C35, 00901C63, 00901C91, 00901CBF, 00901CED, 00901D1B, 00901D49, 00901D77, 00901DA5, 00901DD3, 00901E01, 00901E2F, 00901E5D, 00901E8B, 00901EB9, 00901EE7, 00901F15, 00901F43, 00901F71, 00901F9F, 00901FCD, 00901FFB, 00902029, 00902057, 00902085, 009020B3, 009020E1, 0090210F, 0090213D, 0090216B, 00902199, 009021C7, 009021F5, 00902223, 00902251, 0090227F, 009022AD, 009022DB, 00902309, 00902337, 00902365, 00902393, 009023C1, 009023EF, 0090241D, 0090244B, 00902479, 009024A6, 009024D0, 009024FE, 0090250C, 00902516
RegOpenKeyExA, xrefs: 008E89A0, 008E89DD, 008E8A18, 008E8A56, 008E8A94, 008E8AD2, 008E8B0E, 008E8B4C, 008E8B8A, 008E8BC8, 008E8C04, 008E8C42, 008E8C7E, 008E8CBC, 008E8CF8, 008E8D36, 008E8D74, 008E8DB2, 008E8DEE, 008E8E2C, 008E8E68, 008E8EA6, 008E8EE2, 008E8F20, 008E8F5C, 008E8F9A, 008E8FD6, 008E9014, 008E9050, 008E908E, 008E90CA, 008E9108, 008E9146, 008E9184, 008E91C0, 008E91FE, 008E923A, 008E9278, 008E92B4, 008E92F2, 008E932E, 008E936C, 008E93A8, 008E93E6, 008E9422, 008E9460, 008E949C, 008E94DA, 008E9516, 008E9554, 008E9590, 008E95CE, 008E960A, 008E9648, 008E9684, 008E96C2, 008E96FE, 008E973C, 008E9778, 008E97B6, 008E97F2, 008E9830, 008E986C, 008E98AA, 008E98E4, 008E990A, 008E9938, 008E9966, 008E9994, 008E99C2, 008E99F0, 008E9A1E, 008E9A4C, 008E9A7A, 008E9AA8, 008E9AD6, 008E9B04, 008E9B32, 008E9B60, 008E9B8E, 008E9BBC, 008E9BEA, 008E9C18, 008E9C46, 008E9C74, 008E9CA2, 008E9CD0, 008E9CFE, 008E9D2C, 008E9D5A, 008E9D88, 008E9DB6, 008E9DE4, 008E9E12, 008E9E40, 008E9E6E, 008E9E9C, 008E9ECA, 008E9EF8, 008E9F26, 008E9F54, 008E9F82, 008E9FB0, 008E9FDE, 008EA00C, 008EA03A, 008EA068, 008EA096, 008EA0C4, 008EA0F2, 008EA120, 008EA14E, 008EA17C, 008EA1AA, 008EA1D8, 008EA206, 008EA234, 008EA262, 008EA290, 008EA2BE, 008EA2EC, 008EA31A, 008EA348, 008EA376, 008EA3A4, 008EA3D2, 008EA400, 008EA42E, 008EA45B, 008EA485, 008EA4B3, 008EA4C1, 008EA4CB
htons, xrefs: 008FB792, 008FB7CF, 008FB80A, 008FB848, 008FB886, 008FB8C4, 008FB900, 008FB93E, 008FB97C, 008FB9BA, 008FB9F6, 008FBA34, 008FBA70, 008FBAAE, 008FBAEA, 008FBB28, 008FBB66, 008FBBA4, 008FBBE0, 008FBC1E, 008FBC5A, 008FBC98, 008FBCD4, 008FBD12, 008FBD4E, 008FBD8C, 008FBDC8, 008FBE06, 008FBE42, 008FBE80, 008FBEBC, 008FBEFA, 008FBF38, 008FBF76, 008FBFB2, 008FBFF0, 008FC02C, 008FC06A, 008FC0A6, 008FC0E4, 008FC120, 008FC15E, 008FC19A, 008FC1D8, 008FC214, 008FC252, 008FC28E, 008FC2CC, 008FC308, 008FC346, 008FC382, 008FC3C0, 008FC3FC, 008FC43A, 008FC476, 008FC4B4, 008FC4F0, 008FC52E, 008FC56A, 008FC5A8, 008FC5E4, 008FC622, 008FC65E, 008FC69C, 008FC6D6, 008FC6FC, 008FC72A, 008FC758, 008FC786, 008FC7B4, 008FC7E2, 008FC810, 008FC83E, 008FC86C, 008FC89A, 008FC8C8, 008FC8F6, 008FC924, 008FC952, 008FC980, 008FC9AE, 008FC9DC, 008FCA0A, 008FCA38, 008FCA66, 008FCA94, 008FCAC2, 008FCAF0, 008FCB1E, 008FCB4C, 008FCB7A, 008FCBA8, 008FCBD6, 008FCC04, 008FCC32, 008FCC60, 008FCC8E, 008FCCBC, 008FCCEA, 008FCD18, 008FCD46, 008FCD74, 008FCDA2, 008FCDD0, 008FCDFE, 008FCE2C, 008FCE5A, 008FCE88, 008FCEB6, 008FCEE4, 008FCF12, 008FCF40, 008FCF6E, 008FCF9C, 008FCFCA, 008FCFF8, 008FD026, 008FD054, 008FD082, 008FD0B0, 008FD0DE, 008FD10C, 008FD13A, 008FD168, 008FD196, 008FD1C4, 008FD1F2, 008FD220, 008FD24D, 008FD277, 008FD2A5, 008FD2B3, 008FD2BD
OpenClipboard, xrefs: 008CD272, 008CD2AF, 008CD2EA, 008CD328, 008CD366, 008CD3A4, 008CD3E0, 008CD41E, 008CD45C, 008CD49A, 008CD4D6, 008CD514, 008CD550, 008CD58E, 008CD5CA, 008CD608, 008CD646, 008CD684, 008CD6C0, 008CD6FE, 008CD73A, 008CD778, 008CD7B4, 008CD7F2, 008CD82E, 008CD86C, 008CD8A8, 008CD8E6, 008CD922, 008CD960, 008CD99C, 008CD9DA, 008CDA18, 008CDA56, 008CDA92, 008CDAD0, 008CDB0C, 008CDB4A, 008CDB86, 008CDBC4, 008CDC00, 008CDC3E, 008CDC7A, 008CDCB8, 008CDCF4, 008CDD32, 008CDD6E, 008CDDAC, 008CDDE8, 008CDE26, 008CDE62, 008CDEA0, 008CDEDC, 008CDF1A, 008CDF56, 008CDF94, 008CDFD0, 008CE00E, 008CE04A, 008CE088, 008CE0C4, 008CE102, 008CE13E, 008CE17C, 008CE1B6, 008CE1DC, 008CE20A, 008CE238, 008CE266, 008CE294, 008CE2C2, 008CE2F0, 008CE31E, 008CE34C, 008CE37A, 008CE3A8, 008CE3D6, 008CE404, 008CE432, 008CE460, 008CE48E, 008CE4BC, 008CE4EA, 008CE518, 008CE546, 008CE574, 008CE5A2, 008CE5D0, 008CE5FE, 008CE62C, 008CE65A, 008CE688, 008CE6B6, 008CE6E4, 008CE712, 008CE740, 008CE76E, 008CE79C, 008CE7CA, 008CE7F8, 008CE826, 008CE854, 008CE882, 008CE8B0, 008CE8DE, 008CE90C, 008CE93A, 008CE968, 008CE996, 008CE9C4, 008CE9F2, 008CEA20, 008CEA4E, 008CEA7C, 008CEAAA, 008CEAD8, 008CEB06, 008CEB34, 008CEB62, 008CEB90, 008CEBBE, 008CEBEC, 008CEC1A, 008CEC48, 008CEC76, 008CECA4, 008CECD2, 008CED00, 008CED2D, 008CED57, 008CED85, 008CED93, 008CED9D
Advapi32.dll, xrefs: 008E52BE, 008E52FB, 008E5336, 008E5374, 008E53B2, 008E53F0, 008E542C, 008E546A, 008E54A8, 008E54E6, 008E5522, 008E5560, 008E559C, 008E55DA, 008E5616, 008E5654, 008E5692, 008E56D0, 008E570C, 008E574A, 008E5786, 008E57C4, 008E5800, 008E583E, 008E587A, 008E58B8, 008E58F4, 008E5932, 008E596E, 008E59AC, 008E59E8, 008E5A26, 008E5A64, 008E5AA2, 008E5ADE, 008E5B1C, 008E5B58, 008E5B96, 008E5BD2, 008E5C10, 008E5C4C, 008E5C8A, 008E5CC6, 008E5D04, 008E5D40, 008E5D7E, 008E5DBA, 008E5DF8, 008E5E34, 008E5E72, 008E5EAE, 008E5EEC, 008E5F28, 008E5F66, 008E5FA2, 008E5FE0, 008E601C, 008E605A, 008E6096, 008E60D4, 008E6110, 008E614E, 008E618A, 008E61C8, 008E6202, 008E6228, 008E6256, 008E6284, 008E62B2, 008E62E0, 008E630E, 008E633C, 008E636A, 008E6398, 008E63C6, 008E63F4, 008E6422, 008E6450, 008E647E, 008E64AC, 008E64DA, 008E6508, 008E6536, 008E6564, 008E6592, 008E65C0, 008E65EE, 008E661C, 008E664A, 008E6678, 008E66A6, 008E66D4, 008E6702, 008E6730, 008E675E, 008E678C, 008E67BA, 008E67E8, 008E6816, 008E6844, 008E6872, 008E68A0, 008E68CE, 008E68FC, 008E692A, 008E6958, 008E6986, 008E69B4, 008E69E2, 008E6A10, 008E6A3E, 008E6A6C, 008E6A9A, 008E6AC8, 008E6AF6, 008E6B24, 008E6B52, 008E6B80, 008E6BAE, 008E6BDC, 008E6C0A, 008E6C38, 008E6C66, 008E6C94, 008E6CC2, 008E6CF0, 008E6D1E, 008E6D4C, 008E6D79, 008E6DA3, 008E6DD1, 008E6DDF, 008E6DE9
connect, xrefs: 008FD305, 008FD342, 008FD37D, 008FD3BB, 008FD3F9, 008FD437, 008FD473, 008FD4B1, 008FD4EF, 008FD52D, 008FD569, 008FD5A7, 008FD5E3, 008FD621, 008FD65D, 008FD69B, 008FD6D9, 008FD717, 008FD753, 008FD791, 008FD7CD, 008FD80B, 008FD847, 008FD885, 008FD8C1, 008FD8FF, 008FD93B, 008FD979, 008FD9B5, 008FD9F3, 008FDA2F, 008FDA6D, 008FDAAB, 008FDAE9, 008FDB25, 008FDB63, 008FDB9F, 008FDBDD, 008FDC19, 008FDC57, 008FDC93, 008FDCD1, 008FDD0D, 008FDD4B, 008FDD87, 008FDDC5, 008FDE01, 008FDE3F, 008FDE7B, 008FDEB9, 008FDEF5, 008FDF33, 008FDF6F, 008FDFAD, 008FDFE9, 008FE027, 008FE063, 008FE0A1, 008FE0DD, 008FE11B, 008FE157, 008FE195, 008FE1D1, 008FE20F, 008FE249, 008FE26F, 008FE29D, 008FE2CB, 008FE2F9, 008FE327, 008FE355, 008FE383, 008FE3B1, 008FE3DF, 008FE40D, 008FE43B, 008FE469, 008FE497, 008FE4C5, 008FE4F3, 008FE521, 008FE54F, 008FE57D, 008FE5AB, 008FE5D9, 008FE607, 008FE635, 008FE663, 008FE691, 008FE6BF, 008FE6ED, 008FE71B, 008FE749, 008FE777, 008FE7A5, 008FE7D3, 008FE801, 008FE82F, 008FE85D, 008FE88B, 008FE8B9, 008FE8E7, 008FE915, 008FE943, 008FE971, 008FE99F, 008FE9CD, 008FE9FB, 008FEA29, 008FEA57, 008FEA85, 008FEAB3, 008FEAE1, 008FEB0F, 008FEB3D, 008FEB6B, 008FEB99, 008FEBC7, 008FEBF5, 008FEC23, 008FEC51, 008FEC7F, 008FECAD, 008FECDB, 008FED09, 008FED37, 008FED65, 008FED93, 008FEDC0, 008FEDEA, 008FEE18, 008FEE26, 008FEE30
closesocket, xrefs: 0090255E, 0090259B, 009025D6, 00902614, 00902652, 00902690, 009026CC, 0090270A, 00902748, 00902786, 009027C2, 00902800, 0090283C, 0090287A, 009028B6, 009028F4, 00902932, 00902970, 009029AC, 009029EA, 00902A26, 00902A64, 00902AA0, 00902ADE, 00902B1A, 00902B58, 00902B94, 00902BD2, 00902C0E, 00902C4C, 00902C88, 00902CC6, 00902D04, 00902D42, 00902D7E, 00902DBC, 00902DF8, 00902E36, 00902E72, 00902EB0, 00902EEC, 00902F2A, 00902F66, 00902FA4, 00902FE0, 0090301E, 0090305A, 00903098, 009030D4, 00903112, 0090314E, 0090318C, 009031C8, 00903206, 00903242, 00903280, 009032BC, 009032FA, 00903336, 00903374, 009033B0, 009033EE, 0090342A, 00903468, 009034A2, 009034C8, 009034F6, 00903524, 00903552, 00903580, 009035AE, 009035DC, 0090360A, 00903638, 00903666, 00903694, 009036C2, 009036F0, 0090371E, 0090374C, 0090377A, 009037A8, 009037D6, 00903804, 00903832, 00903860, 0090388E, 009038BC, 009038EA, 00903918, 00903946, 00903974, 009039A2, 009039D0, 009039FE, 00903A2C, 00903A5A, 00903A88, 00903AB6, 00903AE4, 00903B12, 00903B40, 00903B6E, 00903B9C, 00903BCA, 00903BF8, 00903C26, 00903C54, 00903C82, 00903CB0, 00903CDE, 00903D0C, 00903D3A, 00903D68, 00903D96, 00903DC4, 00903DF2, 00903E20, 00903E4E, 00903E7C, 00903EAA, 00903ED8, 00903F06, 00903F34, 00903F62, 00903F90, 00903FBE, 00903FEC, 00904019, 00904043, 00904071, 0090407F, 00904089
RegSetValueExA, xrefs: 008E6E2D, 008E6E6A, 008E6EA5, 008E6EE3, 008E6F21, 008E6F5F, 008E6F9B, 008E6FD9, 008E7017, 008E7055, 008E7091, 008E70CF, 008E710B, 008E7149, 008E7185, 008E71C3, 008E7201, 008E723F, 008E727B, 008E72B9, 008E72F5, 008E7333, 008E736F, 008E73AD, 008E73E9, 008E7427, 008E7463, 008E74A1, 008E74DD, 008E751B, 008E7557, 008E7595, 008E75D3, 008E7611, 008E764D, 008E768B, 008E76C7, 008E7705, 008E7741, 008E777F, 008E77BB, 008E77F9, 008E7835, 008E7873, 008E78AF, 008E78ED, 008E7929, 008E7967, 008E79A3, 008E79E1, 008E7A1D, 008E7A5B, 008E7A97, 008E7AD5, 008E7B11, 008E7B4F, 008E7B8B, 008E7BC9, 008E7C05, 008E7C43, 008E7C7F, 008E7CBD, 008E7CF9, 008E7D37, 008E7D71, 008E7D97, 008E7DC5, 008E7DF3, 008E7E21, 008E7E4F, 008E7E7D, 008E7EAB, 008E7ED9, 008E7F07, 008E7F35, 008E7F63, 008E7F91, 008E7FBF, 008E7FED, 008E801B, 008E8049, 008E8077, 008E80A5, 008E80D3, 008E8101, 008E812F, 008E815D, 008E818B, 008E81B9, 008E81E7, 008E8215, 008E8243, 008E8271, 008E829F, 008E82CD, 008E82FB, 008E8329, 008E8357, 008E8385, 008E83B3, 008E83E1, 008E840F, 008E843D, 008E846B, 008E8499, 008E84C7, 008E84F5, 008E8523, 008E8551, 008E857F, 008E85AD, 008E85DB, 008E8609, 008E8637, 008E8665, 008E8693, 008E86C1, 008E86EF, 008E871D, 008E874B, 008E8779, 008E87A7, 008E87D5, 008E8803, 008E8831, 008E885F, 008E888D, 008E88BB, 008E88E8, 008E8912, 008E8940, 008E894E, 008E8958
EmptyClipboard, xrefs: 008D0958, 008D0995, 008D09D0, 008D0A0E, 008D0A4C, 008D0A8A, 008D0AC6, 008D0B04, 008D0B42, 008D0B80, 008D0BBC, 008D0BFA, 008D0C36, 008D0C74, 008D0CB0, 008D0CEE, 008D0D2C, 008D0D6A, 008D0DA6, 008D0DE4, 008D0E20, 008D0E5E, 008D0E9A, 008D0ED8, 008D0F14, 008D0F52, 008D0F8E, 008D0FCC, 008D1008, 008D1046, 008D1082, 008D10C0, 008D10FE, 008D113C, 008D1178, 008D11B6, 008D11F2, 008D1230, 008D126C, 008D12AA, 008D12E6, 008D1324, 008D1360, 008D139E, 008D13DA, 008D1418, 008D1454, 008D1492, 008D14CE, 008D150C, 008D1548, 008D1586, 008D15C2, 008D1600, 008D163C, 008D167A, 008D16B6, 008D16F4, 008D1730, 008D176E, 008D17AA, 008D17E8, 008D1824, 008D1862, 008D189C, 008D18C2, 008D18F0, 008D191E, 008D194C, 008D197A, 008D19A8, 008D19D6, 008D1A04, 008D1A32, 008D1A60, 008D1A8E, 008D1ABC, 008D1AEA, 008D1B18, 008D1B46, 008D1B74, 008D1BA2, 008D1BD0, 008D1BFE, 008D1C2C, 008D1C5A, 008D1C88, 008D1CB6, 008D1CE4, 008D1D12, 008D1D40, 008D1D6E, 008D1D9C, 008D1DCA, 008D1DF8, 008D1E26, 008D1E54, 008D1E82, 008D1EB0, 008D1EDE, 008D1F0C, 008D1F3A, 008D1F68, 008D1F96, 008D1FC4, 008D1FF2, 008D2020, 008D204E, 008D207C, 008D20AA, 008D20D8, 008D2106, 008D2134, 008D2162, 008D2190, 008D21BE, 008D21EC, 008D221A, 008D2248, 008D2276, 008D22A4, 008D22D2, 008D2300, 008D232E, 008D235C, 008D238A, 008D23B8, 008D23E6, 008D2413, 008D243D, 008D246B, 008D2479, 008D2483
CreateMutexA, xrefs: 008C4937, 008C4974, 008C49AF, 008C49ED, 008C4A2B, 008C4A69, 008C4AA5, 008C4AE3, 008C4B21, 008C4B5F, 008C4B9B, 008C4BD9, 008C4C15, 008C4C53, 008C4C8F, 008C4CCD, 008C4D0B, 008C4D49, 008C4D85, 008C4DC3, 008C4DFF, 008C4E3D, 008C4E79, 008C4EB7, 008C4EF3, 008C4F31, 008C4F6D, 008C4FAB, 008C4FE7, 008C5025, 008C5061, 008C509F, 008C50DD, 008C511B, 008C5157, 008C5195, 008C51D1, 008C520F, 008C524B, 008C5289, 008C52C5, 008C5303, 008C533F, 008C537D, 008C53B9, 008C53F7, 008C5433, 008C5471, 008C54AD, 008C54EB, 008C5527, 008C5565, 008C55A1, 008C55DF, 008C561B, 008C5659, 008C5695, 008C56D3, 008C570F, 008C574D, 008C5789, 008C57C7, 008C5803, 008C5841, 008C587B, 008C58A1, 008C58CF, 008C58FD, 008C592B, 008C5959, 008C5987, 008C59B5, 008C59E3, 008C5A11, 008C5A3F, 008C5A6D, 008C5A9B, 008C5AC9, 008C5AF7, 008C5B25, 008C5B53, 008C5B81, 008C5BAF, 008C5BDD, 008C5C0B, 008C5C39, 008C5C67, 008C5C95, 008C5CC3, 008C5CF1, 008C5D1F, 008C5D4D, 008C5D7B, 008C5DA9, 008C5DD7, 008C5E05, 008C5E33, 008C5E61, 008C5E8F, 008C5EBD, 008C5EEB, 008C5F19, 008C5F47, 008C5F75, 008C5FA3, 008C5FD1, 008C5FFF, 008C602D, 008C605B, 008C6089, 008C60B7, 008C60E5, 008C6113, 008C6141, 008C616F, 008C619D, 008C61CB, 008C61F9, 008C6227, 008C6255, 008C6283, 008C62B1, 008C62DF, 008C630D, 008C633B, 008C6369, 008C6397, 008C63C5, 008C63F2, 008C641C, 008C644A, 008C6458, 008C6462
gethostbyname, xrefs: 008F9C1F, 008F9C5C, 008F9C97, 008F9CD5, 008F9D13, 008F9D51, 008F9D8D, 008F9DCB, 008F9E09, 008F9E47, 008F9E83, 008F9EC1, 008F9EFD, 008F9F3B, 008F9F77, 008F9FB5, 008F9FF3, 008FA031, 008FA06D, 008FA0AB, 008FA0E7, 008FA125, 008FA161, 008FA19F, 008FA1DB, 008FA219, 008FA255, 008FA293, 008FA2CF, 008FA30D, 008FA349, 008FA387, 008FA3C5, 008FA403, 008FA43F, 008FA47D, 008FA4B9, 008FA4F7, 008FA533, 008FA571, 008FA5AD, 008FA5EB, 008FA627, 008FA665, 008FA6A1, 008FA6DF, 008FA71B, 008FA759, 008FA795, 008FA7D3, 008FA80F, 008FA84D, 008FA889, 008FA8C7, 008FA903, 008FA941, 008FA97D, 008FA9BB, 008FA9F7, 008FAA35, 008FAA71, 008FAAAF, 008FAAEB, 008FAB29, 008FAB63, 008FAB89, 008FABB7, 008FABE5, 008FAC13, 008FAC41, 008FAC6F, 008FAC9D, 008FACCB, 008FACF9, 008FAD27, 008FAD55, 008FAD83, 008FADB1, 008FADDF, 008FAE0D, 008FAE3B, 008FAE69, 008FAE97, 008FAEC5, 008FAEF3, 008FAF21, 008FAF4F, 008FAF7D, 008FAFAB, 008FAFD9, 008FB007, 008FB035, 008FB063, 008FB091, 008FB0BF, 008FB0ED, 008FB11B, 008FB149, 008FB177, 008FB1A5, 008FB1D3, 008FB201, 008FB22F, 008FB25D, 008FB28B, 008FB2B9, 008FB2E7, 008FB315, 008FB343, 008FB371, 008FB39F, 008FB3CD, 008FB3FB, 008FB429, 008FB457, 008FB485, 008FB4B3, 008FB4E1, 008FB50F, 008FB53D, 008FB56B, 008FB599, 008FB5C7, 008FB5F5, 008FB623, 008FB651, 008FB67F, 008FB6AD, 008FB6DA, 008FB704, 008FB732, 008FB740, 008FB74A
Shell32.dll, xrefs: 008EF76C, 008EF7A9, 008EF7E4, 008EF822, 008EF860, 008EF89E, 008EF8DA, 008EF918, 008EF956, 008EF994, 008EF9D0, 008EFA0E, 008EFA4A, 008EFA88, 008EFAC4, 008EFB02, 008EFB40, 008EFB7E, 008EFBBA, 008EFBF8, 008EFC34, 008EFC72, 008EFCAE, 008EFCEC, 008EFD28, 008EFD66, 008EFDA2, 008EFDE0, 008EFE1C, 008EFE5A, 008EFE96, 008EFED4, 008EFF12, 008EFF50, 008EFF8C, 008EFFCA, 008F0006, 008F0044, 008F0080, 008F00BE, 008F00FA, 008F0138, 008F0174, 008F01B2, 008F01EE, 008F022C, 008F0268, 008F02A6, 008F02E2, 008F0320, 008F035C, 008F039A, 008F03D6, 008F0414, 008F0450, 008F048E, 008F04CA, 008F0508, 008F0544, 008F0582, 008F05BE, 008F05FC, 008F0638, 008F0676, 008F06B0, 008F06D6, 008F0704, 008F0732, 008F0760, 008F078E, 008F07BC, 008F07EA, 008F0818, 008F0846, 008F0874, 008F08A2, 008F08D0, 008F08FE, 008F092C, 008F095A, 008F0988, 008F09B6, 008F09E4, 008F0A12, 008F0A40, 008F0A6E, 008F0A9C, 008F0ACA, 008F0AF8, 008F0B26, 008F0B54, 008F0B82, 008F0BB0, 008F0BDE, 008F0C0C, 008F0C3A, 008F0C68, 008F0C96, 008F0CC4, 008F0CF2, 008F0D20, 008F0D4E, 008F0D7C, 008F0DAA, 008F0DD8, 008F0E06, 008F0E34, 008F0E62, 008F0E90, 008F0EBE, 008F0EEC, 008F0F1A, 008F0F48, 008F0F76, 008F0FA4, 008F0FD2, 008F1000, 008F102E, 008F105C, 008F108A, 008F10B8, 008F10E6, 008F1114, 008F1142, 008F1170, 008F119E, 008F11CC, 008F11FA, 008F1227, 008F1251, 008F127F, 008F128D, 008F1297
CloseHandle, xrefs: 008DAE0A, 008DAE47, 008DAE82, 008DAEC0, 008DAEFE, 008DAF3C, 008DAF78, 008DAFB6, 008DAFF4, 008DB032, 008DB06E, 008DB0AC, 008DB0E8, 008DB126, 008DB162, 008DB1A0, 008DB1DE, 008DB21C, 008DB258, 008DB296, 008DB2D2, 008DB310, 008DB34C, 008DB38A, 008DB3C6, 008DB404, 008DB440, 008DB47E, 008DB4BA, 008DB4F8, 008DB534, 008DB572, 008DB5B0, 008DB5EE, 008DB62A, 008DB668, 008DB6A4, 008DB6E2, 008DB71E, 008DB75C, 008DB798, 008DB7D6, 008DB812, 008DB850, 008DB88C, 008DB8CA, 008DB906, 008DB944, 008DB980, 008DB9BE, 008DB9FA, 008DBA38, 008DBA74, 008DBAB2, 008DBAEE, 008DBB2C, 008DBB68, 008DBBA6, 008DBBE2, 008DBC20, 008DBC5C, 008DBC9A, 008DBCD6, 008DBD14, 008DBD4E, 008DBD74, 008DBDA2, 008DBDD0, 008DBDFE, 008DBE2C, 008DBE5A, 008DBE88, 008DBEB6, 008DBEE4, 008DBF12, 008DBF40, 008DBF6E, 008DBF9C, 008DBFCA, 008DBFF8, 008DC026, 008DC054, 008DC082, 008DC0B0, 008DC0DE, 008DC10C, 008DC13A, 008DC168, 008DC196, 008DC1C4, 008DC1F2, 008DC220, 008DC24E, 008DC27C, 008DC2AA, 008DC2D8, 008DC306, 008DC334, 008DC362, 008DC390, 008DC3BE, 008DC3EC, 008DC41A, 008DC448, 008DC476, 008DC4A4, 008DC4D2, 008DC500, 008DC52E, 008DC55C, 008DC58A, 008DC5B8, 008DC5E6, 008DC614, 008DC642, 008DC670, 008DC69E, 008DC6CC, 008DC6FA, 008DC728, 008DC756, 008DC784, 008DC7B2, 008DC7E0, 008DC80E, 008DC83C, 008DC86A, 008DC898, 008DC8C5, 008DC8EF, 008DC91D, 008DC92B, 008DC935
GlobalLock, xrefs: 008BF6DE, 008BF71B, 008BF756, 008BF794, 008BF7D2, 008BF810, 008BF84C, 008BF88A, 008BF8C8, 008BF906, 008BF942, 008BF980, 008BF9BC, 008BF9FA, 008BFA36, 008BFA74, 008BFAB2, 008BFAF0, 008BFB2C, 008BFB6A, 008BFBA6, 008BFBE4, 008BFC20, 008BFC5E, 008BFC9A, 008BFCD8, 008BFD14, 008BFD52, 008BFD8E, 008BFDCC, 008BFE08, 008BFE46, 008BFE84, 008BFEC2, 008BFEFE, 008BFF3C, 008BFF78, 008BFFB6, 008BFFF2, 008C0030, 008C006C, 008C00AA, 008C00E6, 008C0124, 008C0160, 008C019E, 008C01DA, 008C0218, 008C0254, 008C0292, 008C02CE, 008C030C, 008C0348, 008C0386, 008C03C2, 008C0400, 008C043C, 008C047A, 008C04B6, 008C04F4, 008C0530, 008C056E, 008C05AA, 008C05E8, 008C0622, 008C0648, 008C0676, 008C06A4, 008C06D2, 008C0700, 008C072E, 008C075C, 008C078A, 008C07B8, 008C07E6, 008C0814, 008C0842, 008C0870, 008C089E, 008C08CC, 008C08FA, 008C0928, 008C0956, 008C0984, 008C09B2, 008C09E0, 008C0A0E, 008C0A3C, 008C0A6A, 008C0A98, 008C0AC6, 008C0AF4, 008C0B22, 008C0B50, 008C0B7E, 008C0BAC, 008C0BDA, 008C0C08, 008C0C36, 008C0C64, 008C0C92, 008C0CC0, 008C0CEE, 008C0D1C, 008C0D4A, 008C0D78, 008C0DA6, 008C0DD4, 008C0E02, 008C0E30, 008C0E5E, 008C0E8C, 008C0EBA, 008C0EE8, 008C0F16, 008C0F44, 008C0F72, 008C0FA0, 008C0FCE, 008C0FFC, 008C102A, 008C1058, 008C1086, 008C10B4, 008C10E2, 008C1110, 008C113E, 008C116C, 008C1199, 008C11C3, 008C11F1, 008C11FF, 008C1209
GlobalUnlock, xrefs: 008BDB6B, 008BDBA8, 008BDBE3, 008BDC21, 008BDC5F, 008BDC9D, 008BDCD9, 008BDD17, 008BDD55, 008BDD93, 008BDDCF, 008BDE0D, 008BDE49, 008BDE87, 008BDEC3, 008BDF01, 008BDF3F, 008BDF7D, 008BDFB9, 008BDFF7, 008BE033, 008BE071, 008BE0AD, 008BE0EB, 008BE127, 008BE165, 008BE1A1, 008BE1DF, 008BE21B, 008BE259, 008BE295, 008BE2D3, 008BE311, 008BE34F, 008BE38B, 008BE3C9, 008BE405, 008BE443, 008BE47F, 008BE4BD, 008BE4F9, 008BE537, 008BE573, 008BE5B1, 008BE5ED, 008BE62B, 008BE667, 008BE6A5, 008BE6E1, 008BE71F, 008BE75B, 008BE799, 008BE7D5, 008BE813, 008BE84F, 008BE88D, 008BE8C9, 008BE907, 008BE943, 008BE981, 008BE9BD, 008BE9FB, 008BEA37, 008BEA75, 008BEAAF, 008BEAD5, 008BEB03, 008BEB31, 008BEB5F, 008BEB8D, 008BEBBB, 008BEBE9, 008BEC17, 008BEC45, 008BEC73, 008BECA1, 008BECCF, 008BECFD, 008BED2B, 008BED59, 008BED87, 008BEDB5, 008BEDE3, 008BEE11, 008BEE3F, 008BEE6D, 008BEE9B, 008BEEC9, 008BEEF7, 008BEF25, 008BEF53, 008BEF81, 008BEFAF, 008BEFDD, 008BF00B, 008BF039, 008BF067, 008BF095, 008BF0C3, 008BF0F1, 008BF11F, 008BF14D, 008BF17B, 008BF1A9, 008BF1D7, 008BF205, 008BF233, 008BF261, 008BF28F, 008BF2BD, 008BF2EB, 008BF319, 008BF347, 008BF375, 008BF3A3, 008BF3D1, 008BF3FF, 008BF42D, 008BF45B, 008BF489, 008BF4B7, 008BF4E5, 008BF513, 008BF541, 008BF56F, 008BF59D, 008BF5CB, 008BF5F9, 008BF626, 008BF650, 008BF67E, 008BF68C, 008BF696

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: AddressProc$LibraryLoad$___report_securityfailure
String ID: Advapi32.dll$CloseHandle$CreateDirectoryA$CreateMutexA$EmptyClipboard$ExitProcess$GetClipboardData$GetModuleFileName$GetProcAddress$GlobalAlloc$GlobalFree$GlobalLock$GlobalUnlock$Kernel32.dll$LoadLibraryA$MoveFileA$OpenClipboard$RegCloseKey$RegCreateKeyExA$RegOpenKeyExA$RegQueryValueExA$RegSetValueExA$ReleaseMutex$SHGetFolderPathA$SetClipboardData$Shell32.dll$ShellExecuteEx$Sleep$User32.dll$WSACleanup$WSAStartup$WaitForSingleObject$closesocket$connect$gethostbyname$htons$memcpy$msvcrt.dll$recv$socket$ws2_32.dll
API String ID: 2356647914-3371338090
Opcode ID: 4dc836d502a7311268f1c38033d685305e91cf5111e248fb32d1a4412584ca3d
Instruction ID: f14cdf8fb6c2a681fce454dca1da8e3b7714d6035d2708e244a01c9928705667
Opcode Fuzzy Hash: 4dc836d502a7311268f1c38033d685305e91cf5111e248fb32d1a4412584ca3d
Instruction Fuzzy Hash: 347487E26092A206E71D597C95323BF9EE7DBA2704F2C90BF9042DE7AED475CB448341

Uniqueness

Uniqueness Score: -1.00%

Function 008B2590 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 232
clipboardsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,8dddf1vvvv), ref: 008B25E1
GetLastError.KERNEL32 ref: 008B25E7
ExitProcess.KERNEL32 ref: 008B25F6
OpenClipboard.USER32(00000000), ref: 008B2648
GetClipboardData.USER32(00000001), ref: 008B2658
GlobalFix.KERNEL32(00000000), ref: 008B2667

Strings

8dddf1vvvv, xrefs: 008B25AA, 008B25AF, 008B25D8
i, xrefs: 008B2699

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Clipboard$CreateDataErrorExitGlobalLastMutexOpenProcess
String ID: 8dddf1vvvv$i
API String ID: 2612852249-950614044
Opcode ID: a1d09d73cb296282287b4e09c659bd79f7f86e15eddbe538a23646ddf08c8e0a
Instruction ID: 3f10dad5e682a6e376bc08b7ba7c82d0a5be9ee2e5ab1e11c418c99208d008f7
Opcode Fuzzy Hash: a1d09d73cb296282287b4e09c659bd79f7f86e15eddbe538a23646ddf08c8e0a
Instruction Fuzzy Hash: 61A116B042C7849EE324EF64EC1A7AE7BA0FF95305F00460DF485962A1DBB05986DB97

Uniqueness

Uniqueness Score: -1.00%

Function 009113BA Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(000000FF,00000000,?,?,00000000,00000000,00000000,?,00000000,?,?,?,0091160B,000000FF,000000FF,?), ref: 00911414
__alloca_probe_16.LIBCMT ref: 0091144C
MultiByteToWideChar.KERNEL32(000000FF,00000001,?,?,00000000,?,?,?,?,0091160B,000000FF,000000FF,?,?,?,?), ref: 0091149A
__alloca_probe_16.LIBCMT ref: 00911531
WideCharToMultiByte.KERNEL32(000000FF,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00911594
__freea.LIBCMT ref: 009115A1

Part of subcall function 0090D86D: HeapAlloc.KERNEL32(00000000,?,?,?,00908A77,?,?,?,?,?,008B1087,?,?,?), ref: 0090D89F

__freea.LIBCMT ref: 009115AA
__freea.LIBCMT ref: 009115CF

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: 11d8a3347192e66e3a8c497ea21a02adcfcd9a62c11fd1db03fde64d65e80aea
Instruction ID: d7cdaf0ea27b9fd19f076661c96b17dc258a6d2b3e54308bc72ba1019ed31a3d
Opcode Fuzzy Hash: 11d8a3347192e66e3a8c497ea21a02adcfcd9a62c11fd1db03fde64d65e80aea
Instruction Fuzzy Hash: 5351B172B1021ABFDB258EA4DC41EEF77AEEB85B50F154629FE06D6180EB34DC80D650

Uniqueness

Uniqueness Score: -1.00%

Function 00911C67 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE ref: 00911CBA
LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,000000FF,?,00000000), ref: 00911CD8

Strings

LCMapStringEx, xrefs: 00911C82

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: ebe38b4e1fefdd26d8ab93a2a9b2e74a644e41d3465545047e7625842f2d2231
Instruction ID: 9e83995a018dee5bd1ba684314d17348a002534812ab493342fdd54202365610
Opcode Fuzzy Hash: ebe38b4e1fefdd26d8ab93a2a9b2e74a644e41d3465545047e7625842f2d2231
Instruction Fuzzy Hash: 3C01483268521DBBCF129F90DD06DEE7FA6FF88760F008114FE14261A0C6328971EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00915406 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0091542B

Strings

, xrefs: 00915470

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: ce5cbcbbcab101fd4ff559e4760de01e10c3248dfcdff63e159ec897b65f2028
Instruction ID: 6a3176d194de3ca689a7666cdbe8e1f8e708d9dc066a169c97768224e8b46e24
Opcode Fuzzy Hash: ce5cbcbbcab101fd4ff559e4760de01e10c3248dfcdff63e159ec897b65f2028
Instruction Fuzzy Hash: 0341F970A0864CDADF218A64CC84BFABBBFEB85304F1504EDE59A87152D2359AC5DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0091575B Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0091532E: GetOEMCP.KERNEL32(00000000,?,?,009155B7,?), ref: 00915359

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,009155FC,?,00000000), ref: 009157CF
GetCPInfo.KERNEL32(00000000,009155FC,?,?,?,009155FC,?,00000000), ref: 009157E2

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: f49873e003140699122fb2de1a1848fef877c570c149d9c120f47eea753069af
Instruction ID: 1fdf9d6b37d5cc82483420693aa3e9bebd3df65998ea131d07df0cf5c16f8dcf
Opcode Fuzzy Hash: f49873e003140699122fb2de1a1848fef877c570c149d9c120f47eea753069af
Instruction Fuzzy Hash: B7511470F04A09DEDB249F75C8816FABBE9EFC1310F1744AED0968B151D7399582DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0091559A Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

Part of subcall function 009156B9: _abort.LIBCMT ref: 009156EB
Part of subcall function 009156B9: _free.LIBCMT ref: 0091571F

Part of subcall function 0091532E: GetOEMCP.KERNEL32(00000000,?,?,009155B7,?), ref: 00915359

_free.LIBCMT ref: 00915612
_free.LIBCMT ref: 00915648

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: cbf16a26ebb96d8810d121b4801bd5eb47b4aa6780d6d4a5943cba2fa72ff24b
Instruction ID: 661249c4e86219032bf41b53bc1174ae1ad8c92576ec4470d06802ded8c7a653
Opcode Fuzzy Hash: cbf16a26ebb96d8810d121b4801bd5eb47b4aa6780d6d4a5943cba2fa72ff24b
Instruction Fuzzy Hash: 7D318131A04608EFDB10EBA9D881BAD77E9DFC0360F674099E8159B291EB715D81DB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00905C20 Relevance: 20.0, APIs: 13, Instructions: 458
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 00906223
socket.WS2_32(00000002,00000001,00000006), ref: 00906237
WSACleanup.WS2_32 ref: 00906244
gethostbyname.WS2_32(0092CD50), ref: 0090627E
WSACleanup.WS2_32 ref: 0090628A
closesocket.WS2_32(00000000), ref: 00906291
memcpy.MSVCRT ref: 009062A7
htons.WS2_32(00000050), ref: 009062BB
connect.WS2_32(00000000,?,00000010), ref: 009062CC
send.WS2_32(00000000,00000000,00000000,00000000), ref: 009062E9
send.WS2_32(00000000,00000000,00000000,00000000), ref: 0090630A
closesocket.WS2_32(00000000), ref: 00906319
WSACleanup.WS2_32 ref: 0090631F

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Cleanup$closesocketsend$Startupconnectgethostbynamehtonsmemcpysocket
String ID:
API String ID: 128753205-0
Opcode ID: 8ec50b6426de02856d39c1526054d0c3f1aadd8063fbb195ba797016dfb3430b
Instruction ID: 50592bcfa9f2175a79a387c0e960cf9147aca3776c1aa3642de0c3ff8f577fae
Opcode Fuzzy Hash: 8ec50b6426de02856d39c1526054d0c3f1aadd8063fbb195ba797016dfb3430b
Instruction Fuzzy Hash: 6D1214B05286849EEB29CF34ED167FD7B65FF56308F04925CE442262F2DB70298B9B50

Uniqueness

Uniqueness Score: -1.00%

Function 00917B45 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00917BDE
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00917C07
GetACP.KERNEL32 ref: 00917C1C

Strings

OCP, xrefs: 00917B99
ACP, xrefs: 00917B63

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6e2a1e883e14d7bf6cf7a3490a028bc07333b9b3a21be07bf746a072c1f97d44
Instruction ID: d4ecd25f6e9274c03de1dd42163bd92009fb63a1089c4363e2471281c4cb3fa4
Opcode Fuzzy Hash: 6e2a1e883e14d7bf6cf7a3490a028bc07333b9b3a21be07bf746a072c1f97d44
Instruction Fuzzy Hash: 3D21797278C10A96D7348B94D900AE7F3BAEB54F64B568864ED49D7201F732DDC0D390

Uniqueness

Uniqueness Score: -1.00%

Function 00917D19 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

Part of subcall function 00910D45: _free.LIBCMT ref: 00910DA4
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DB1

GetUserDefaultLCID.KERNEL32 ref: 00917E25
IsValidCodePage.KERNEL32(00000000), ref: 00917E80
IsValidLocale.KERNEL32(?,00000001), ref: 00917E8F
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00917ED7
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00917EF6

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 397170cd69e8c861add2bb27ec8228cfd2c260de10f68cfdeec88d05cc3f8139
Instruction ID: f98f4365570557e9536970c09e01dbae17ff3dccaee7a278e71900d43d6c2139
Opcode Fuzzy Hash: 397170cd69e8c861add2bb27ec8228cfd2c260de10f68cfdeec88d05cc3f8139
Instruction Fuzzy Hash: 93516071B0820F9AEF10DFE5DC41AFAB3B8AF48700F1444A9E915E71A0D7709D8487A1

Uniqueness

Uniqueness Score: -1.00%

Function 009173E1 Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

IsValidCodePage.KERNEL32(00000000), ref: 009174C3
_wcschr.LIBVCRUNTIME ref: 00917553
_wcschr.LIBVCRUNTIME ref: 00917561
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00917604

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: 2358138d02b0db0041a6f9eadfc2a9db306e506e6fdcdeeffed58914d083a83f
Instruction ID: e636c74507fe4d1b521521b4833c1cef1bc13d9b3a17bbad17b8d059e4099e0b
Opcode Fuzzy Hash: 2358138d02b0db0041a6f9eadfc2a9db306e506e6fdcdeeffed58914d083a83f
Instruction Fuzzy Hash: 3D61E67170820FAADB24ABA4DC46BFAB7BDEF48710F144469F905D7181EA74EA80C760

Uniqueness

Uniqueness Score: -1.00%

Function 009084F8 Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0090852C
GetCurrentThreadId.KERNEL32 ref: 0090853B
GetCurrentProcessId.KERNEL32 ref: 00908544
QueryPerformanceCounter.KERNEL32(?), ref: 00908551

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0217826c52e9c775206aab01fa75d72557565094c970fea2c0d6846c026f744f
Instruction ID: e84e88e08ebd218fc4f0c73f8a5c3675e842a4e97d27664609297c6b9c6cf901
Opcode Fuzzy Hash: 0217826c52e9c775206aab01fa75d72557565094c970fea2c0d6846c026f744f
Instruction Fuzzy Hash: EB118F71E15208DFDF14CBB4D9445AFB7F4EB08311F5145AAE442E7290EF309A05DB50

Uniqueness

Uniqueness Score: -1.00%

Function 008B5500 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 381COMMON

Download Yara Rule

APIs

Part of subcall function 00906DDA: std::regex_error::regex_error.LIBCPMT ref: 00906DE6
Part of subcall function 00906DDA: __CxxThrowException@8.LIBVCRUNTIME ref: 00906DF4

___from_strstr_to_strchr.LIBCMT ref: 008B5646
___from_strstr_to_strchr.LIBCMT ref: 008B566A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_, xrefs: 008B5641, 008B5665

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ___from_strstr_to_strchr$Exception@8Throwstd::regex_error::regex_error
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_
API String ID: 451488043-3812731148
Opcode ID: 1207c95ca1a76ce58e9573387be6300a456b16e612422ae91c9431949550f275
Instruction ID: 1f54027d74ccf533836b656ec72ace5237571582d3e379703229605603f05849
Opcode Fuzzy Hash: 1207c95ca1a76ce58e9573387be6300a456b16e612422ae91c9431949550f275
Instruction Fuzzy Hash: EDE15575A00A49DFDB25CF28C490BEABBF2FF49314F240959E482DB791DB71A845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 009177CC Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

Part of subcall function 00910D45: _free.LIBCMT ref: 00910DA4
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DB1

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00917820
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00917871
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00917931

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 73eb096f2151452f236ecb1b2deab667cffe68bc9b1712bb9777c8f195648662
Instruction ID: 76e0ffc911e88aa4c42d5f2a87f1d047ac3612b5bc6b641b7c662ef07f9fe7e0
Opcode Fuzzy Hash: 73eb096f2151452f236ecb1b2deab667cffe68bc9b1712bb9777c8f195648662
Instruction Fuzzy Hash: A961BE7175820B9FEB299F64CC82BFAB7BCEF04300F1045A9E805D6581EB7499C9DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0090CC07 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0090CCFF
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0090CD09
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0090CD16

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2d2cb685d33c36e9f49907b3bbd67096e4ced099ce7ac3e5d90f17121838e8fc
Instruction ID: c6b06ab6e1b7cb3e990102b5191b30dcdefb8bf78d3a7bd5192176afe7c036f8
Opcode Fuzzy Hash: 2d2cb685d33c36e9f49907b3bbd67096e4ced099ce7ac3e5d90f17121838e8fc
Instruction Fuzzy Hash: 2231D5B4941228ABCB21DF64DD8979DBBB8BF48310F5046EAE40CA7291E7709B818F44

Uniqueness

Uniqueness Score: -1.00%

Function 0090E8F6 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,0090E8CC,00000000,00929858,0000000C,0090EA23,00000000,00000002,00000000), ref: 0090E917
TerminateProcess.KERNEL32(00000000,?,0090E8CC,00000000,00929858,0000000C,0090EA23,00000000,00000002,00000000), ref: 0090E91E
ExitProcess.KERNEL32 ref: 0090E930

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 260995aa17a91ecc2ee646b865e180afd68b413643de973b1180ab63e12ebb71
Instruction ID: 114b074d621c20a55deebc3b69e9d324a9ad3966da8ef8b48d366df1688f7857
Opcode Fuzzy Hash: 260995aa17a91ecc2ee646b865e180afd68b413643de973b1180ab63e12ebb71
Instruction Fuzzy Hash: A0E08C71210508EFCF51AF10DC08AA83B6EEF48B45F008414F8198A171CB35ED82DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00911A67 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,0090EBAD,?,00000006), ref: 00911ABA

Strings

GetLocaleInfoEx, xrefs: 00911A82

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: db27eb4fc4c9d6cb7e19a0248374562ef281dc6be9b3c24f688b97ffee2ac0ff
Instruction ID: b3cb150a8ab16518fba1ee9a97ccebea056d19ec49389437816349ce2721ef25
Opcode Fuzzy Hash: db27eb4fc4c9d6cb7e19a0248374562ef281dc6be9b3c24f688b97ffee2ac0ff
Instruction Fuzzy Hash: 74F02431B8521CBBCF11AF60EC02FEE7F69EF88710F004159FD05262A1CB314D60A695

Uniqueness

Uniqueness Score: -1.00%

Function 00912BD5 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,00912BD0,?,?,?,?,?,?,00000000), ref: 00912E02

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f5ae3599b62c120e34a6b4c7bd42afffbd0d2d73577b57aef8048265b167d220
Instruction ID: dedc9c49757d8ed309d0366f4ee37f7bc62868da4f8d4a60d11f6156f1c8be57
Opcode Fuzzy Hash: f5ae3599b62c120e34a6b4c7bd42afffbd0d2d73577b57aef8048265b167d220
Instruction Fuzzy Hash: 00B14D752106089FD719DF28C48ABA57BE0FF45364F298698E9DACF2E1C335D9A1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00917A1C Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

Part of subcall function 00910D45: _free.LIBCMT ref: 00910DA4
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DB1

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00917A70

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: eeb4444594d0c4a323ca6363548fb44e9f95a688d50b18cce6535aa7485ba550
Instruction ID: b6e796784d81f9079913dbde6baa0232cc7873baef5766c8c23b4e38c0978069
Opcode Fuzzy Hash: eeb4444594d0c4a323ca6363548fb44e9f95a688d50b18cce6535aa7485ba550
Instruction Fuzzy Hash: 6021717275820BABDB289AA4DC42BFEB7BCEF44310F10017AE905D6581EB75AEC4D750

Uniqueness

Uniqueness Score: -1.00%

Function 009176A4 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

EnumSystemLocalesW.KERNEL32(009177CC,00000001), ref: 00917716

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: bb9792d356ed9510d2113e969ed1604c7e17007571ed6c6b5e76d4aca26b0132
Instruction ID: fddc81c2d378486ba80e36556035b0d3e3a193c6ad0d6b7fcbb5596b5f7da9f3
Opcode Fuzzy Hash: bb9792d356ed9510d2113e969ed1604c7e17007571ed6c6b5e76d4aca26b0132
Instruction Fuzzy Hash: FF11293B3047069FDB18AF78C8916FAF7A1FF84358B15442DE94687A80D7717982C740

Uniqueness

Uniqueness Score: -1.00%

Function 00917C4C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,009179EA,00000000,00000000,?), ref: 00917C78

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 514295245dbde101662fddcb0b9841c6539c1bc9cc5c50231170174b973fa2be
Instruction ID: 322a4ded557656494b5e431f6403b5b16670ddd70ac260c5e77ca7cf5ed271bd
Opcode Fuzzy Hash: 514295245dbde101662fddcb0b9841c6539c1bc9cc5c50231170174b973fa2be
Instruction Fuzzy Hash: 6CF0F936B0811BABDB249BA4C805BFAB77CDB80354F044469EC49B3280EA74BD81C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 0091773F Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

EnumSystemLocalesW.KERNEL32(00917A1C,00000001), ref: 0091778B

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 1bd02eebb123efdf2ef920dd75836ab8aa3f5c0b89cb6d0d33ac9c958ddae70c
Instruction ID: 3af91bdc62cf864f59977bc793e403f16701485d8eeb172d70522bcb7bd0bf6c
Opcode Fuzzy Hash: 1bd02eebb123efdf2ef920dd75836ab8aa3f5c0b89cb6d0d33ac9c958ddae70c
Instruction Fuzzy Hash: AAF0C83630430A5FDB155F75DC81ABABBA5EFC0368F15442DF9058B590D6719C82C610

Uniqueness

Uniqueness Score: -1.00%

Function 009116C2 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0090D287: EnterCriticalSection.KERNEL32(?,?,0090DF84,00000000,00929838,0000000C,0090DF3F,?,?,?,0090D530,?,?,00910DFA,00000001,00000364), ref: 0090D296

EnumSystemLocalesW.KERNEL32(Function_0006167C,00000001,009299C0,0000000C), ref: 009116FA

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: b541ef4e1ef4b297d218c2f62f562b1975a25d4c3f43411cb630770bb7b1c973
Instruction ID: bb49f6f3be3c23c9b0ec9fb10dedfbeeac54ea56cc293fa6a1f02231a709510c
Opcode Fuzzy Hash: b541ef4e1ef4b297d218c2f62f562b1975a25d4c3f43411cb630770bb7b1c973
Instruction Fuzzy Hash: 95F04F76A60205EFDB21EF78D846B8D77F0AB48721F108119F820DB2E5CB748A81DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00917659 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

EnumSystemLocalesW.KERNEL32(009175B0,00000001), ref: 00917690

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 05d9b832baec6521e822a7ce11435d0bdb4348fdbf0e787f6a7eca7601faf4ba
Instruction ID: 8b654a0a704c318d6d3499c27e4ef4364cf2690aab295fda1784168231e22e95
Opcode Fuzzy Hash: 05d9b832baec6521e822a7ce11435d0bdb4348fdbf0e787f6a7eca7601faf4ba
Instruction Fuzzy Hash: 49F0E53A30420A97CB049F79D845BEABFA5EFC1754B864059FA098B691D671D882C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00908757 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00058763,00907F41), ref: 0090875C

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7a659c440f34c64ff402b9fa2f55bdcc66bbfc8dc2f28e9ee7afe27966373c62
Instruction ID: 1db5dcdd5a439e17045f5fc9f77898c576356225b5107c133b4831633d474d49
Opcode Fuzzy Hash: 7a659c440f34c64ff402b9fa2f55bdcc66bbfc8dc2f28e9ee7afe27966373c62
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00912404 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00912404

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a5d7a8dba12939fee20bd2bd425697f41ed8907c5a849aa35a88781d07b8fec3
Instruction ID: b977b2e5b8e9e2f951df21cd09a621efbcb04e02c5ad3e9fb0da0db0659de9a6
Opcode Fuzzy Hash: a5d7a8dba12939fee20bd2bd425697f41ed8907c5a849aa35a88781d07b8fec3
Instruction Fuzzy Hash: C5A022F03A8202CF8B00CF30AE0830C3AE8FA0A2C0B00C028A008C2030EF308002FB00

Uniqueness

Uniqueness Score: -1.00%

Function 008B1A40 Relevance: 1.0, Instructions: 959COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Initstd::locale::_
String ID:
API String ID: 1620887387-0
Opcode ID: 5bef8c9cdfc47b92fe9df1436948c11cdd268be3ce71c1a39ebcbfc0d166d996
Instruction ID: a36a7997fafd10497f656c57ac5b809acf61e6cdf1e776fb26e65dfc6923af46
Opcode Fuzzy Hash: 5bef8c9cdfc47b92fe9df1436948c11cdd268be3ce71c1a39ebcbfc0d166d996
Instruction Fuzzy Hash: 50825A74B052058BEF18CBA8C8A4BADB7A1FF89704F58416CE456EF7A1DB71AD41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00913759 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1027f0786a6f7df57b792448af679780a06b7261ab022970396265f429cb4422
Instruction ID: f048f1dbbd73a4bb8e5b88608d7a0d3b1db7b6ddefe0bd5058ec867f7808d215
Opcode Fuzzy Hash: 1027f0786a6f7df57b792448af679780a06b7261ab022970396265f429cb4422
Instruction Fuzzy Hash: AB325322E29F054DD7239635DC22336A65CAFB73C4F15C727F81AB5AAAEB29C5C35100

Uniqueness

Uniqueness Score: -1.00%

Function 0090B6D1 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: d885db7587c9e41faf5bf4c7f9a3e8a19579a961887ab9b2553947df0a453e2a
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: D2C17F322051930EEF2D867E847413EBBE95EA27B131A1B6DD4BACB1D4FF20C525D620

Uniqueness

Uniqueness Score: -1.00%

Function 0090BB06 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 730a89fa236338e85f4847e4706a761007d32299e618e5e0d77954283a7a3153
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 22C16F322051A30EEF2D867EC47413EBBE55AA27B131A1B6DD4BACB1D4FF20C525D620

Uniqueness

Uniqueness Score: -1.00%

Function 0090B29C Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: de17c43f26dabae4d19405f68a5c16fc38a46aef3646dce100742477367c115e
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 08C181322051930EEF2D867EC47413EBBE95AA27B131A0B6DE4B6CB1D5FF20C565D620

Uniqueness

Uniqueness Score: -1.00%

Function 0090AE84 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 5a4c873aa0b182272d175b9c01c7136b31d89926a85550100556dc9f83686ef7
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: F9C17E322091930DEF6D863EC43413EBBE95AA27B131A0B6DD4B6CB1D4FF20D569D620

Uniqueness

Uniqueness Score: -1.00%

Function 008B2D60 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23c4094b837be603a276dd9b36caba6fc9f4c8d7a97366dcdbfae5905e1f5aa
Instruction ID: 05864340f48b03482be713e84753757f073727e56efed2ec53dbb834ba7d62e2
Opcode Fuzzy Hash: d23c4094b837be603a276dd9b36caba6fc9f4c8d7a97366dcdbfae5905e1f5aa
Instruction Fuzzy Hash: D5F05831744608DFC714CF55C840F6AB7E9FB49B10F1482ADE916CBBA0DB36A800CA40

Uniqueness

Uniqueness Score: -1.00%

Function 008B1390 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3dd1f551c5a965b638d44823d94218a89eb2fdf3d51ec60156ca11fcfb748b
Instruction ID: ee539ff0532f24d2036e48c715a203240b06237c32b330539573824d3788aa40
Opcode Fuzzy Hash: 7c3dd1f551c5a965b638d44823d94218a89eb2fdf3d51ec60156ca11fcfb748b
Instruction Fuzzy Hash: 55F0A031744648DFCB14CF54C854F6AB7E8FB09B10F0082ADE81ACBBA0EB35A801CA40

Uniqueness

Uniqueness Score: -1.00%

Function 0090CEA8 Relevance: 22.8, APIs: 15, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0090CF18
_free.LIBCMT ref: 0090CF2E
_free.LIBCMT ref: 0090CF3F
_free.LIBCMT ref: 0090CF50
_free.LIBCMT ref: 0090CF67
GetCPInfo.KERNEL32(?,?), ref: 0090CFAF

Part of subcall function 009110EB: _free.LIBCMT ref: 00911156

_free.LIBCMT ref: 0090D15B
_free.LIBCMT ref: 0090D16E
_free.LIBCMT ref: 0090D17C
_free.LIBCMT ref: 0090D187
_free.LIBCMT ref: 0090D1C9
_free.LIBCMT ref: 0090D1D1
_free.LIBCMT ref: 0090D1D9
_free.LIBCMT ref: 0090D1E1
_free.LIBCMT ref: 0090D1EF

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 16812511dc794368d029de1107674032b599c0fbc909c7c5785b6f0479a15d81
Instruction ID: 617f5244fdca6a75e665d338586772c792480927360e8685cfd15aa40d91fd1a
Opcode Fuzzy Hash: 16812511dc794368d029de1107674032b599c0fbc909c7c5785b6f0479a15d81
Instruction Fuzzy Hash: 17B1A171D053099FDB21DFA8C881BEEBBF9BF48300F144069F959A7292DB75A841DB60

Uniqueness

Uniqueness Score: -1.00%

Function 009169CF Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 00916A13

Part of subcall function 00915D28: _free.LIBCMT ref: 00915D45
Part of subcall function 00915D28: _free.LIBCMT ref: 00915D57
Part of subcall function 00915D28: _free.LIBCMT ref: 00915D69
Part of subcall function 00915D28: _free.LIBCMT ref: 00915D7B
Part of subcall function 00915D28: _free.LIBCMT ref: 00915D8D
Part of subcall function 00915D28: _free.LIBCMT ref: 00915D9F
Part of subcall function 00915D28: _free.LIBCMT ref: 00915DB1
Part of subcall function 00915D28: _free.LIBCMT ref: 00915DC3
Part of subcall function 00915D28: _free.LIBCMT ref: 00915DD5
Part of subcall function 00915D28: _free.LIBCMT ref: 00915DE7
Part of subcall function 00915D28: _free.LIBCMT ref: 00915DF9
Part of subcall function 00915D28: _free.LIBCMT ref: 00915E0B
Part of subcall function 00915D28: _free.LIBCMT ref: 00915E1D

_free.LIBCMT ref: 00916A08

Part of subcall function 0090D833: HeapFree.KERNEL32(00000000,00000000,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?), ref: 0090D849
Part of subcall function 0090D833: GetLastError.KERNEL32(?,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?,?), ref: 0090D85B

_free.LIBCMT ref: 00916A2A
_free.LIBCMT ref: 00916A3F
_free.LIBCMT ref: 00916A4A
_free.LIBCMT ref: 00916A6C
_free.LIBCMT ref: 00916A7F
_free.LIBCMT ref: 00916A8D
_free.LIBCMT ref: 00916A98
_free.LIBCMT ref: 00916AD0
_free.LIBCMT ref: 00916AD7
_free.LIBCMT ref: 00916AF4
_free.LIBCMT ref: 00916B0C

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 825aa9f73f4229e17ee9a489f3ff28e39ef490ec795186b096dba3efbae96338
Instruction ID: e11a422209d989972a0ce18a1ca4050096794c49016c2248adb721a9972f13a5
Opcode Fuzzy Hash: 825aa9f73f4229e17ee9a489f3ff28e39ef490ec795186b096dba3efbae96338
Instruction Fuzzy Hash: AF314C31B043099FEB21AEB9E845B9AB3E9EF40310F10C429E859E7191DF71ED80DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00915E26 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00915E6E
_free.LIBCMT ref: 00915E92
_free.LIBCMT ref: 00915E9F
_free.LIBCMT ref: 00915EC4
_free.LIBCMT ref: 00915ED1
_free.LIBCMT ref: 00915EDA
_free.LIBCMT ref: 009161B8
_free.LIBCMT ref: 009161C0

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9f24d92f32dfd4bd6f8b41c5f3e5067a62b7645e7a3cc42b6e2367e7f4a257a0
Instruction ID: 44acb20fe62a32552a3df76b8ecb96e0366d595cfe0c05abdfc4165b148d3663
Opcode Fuzzy Hash: 9f24d92f32dfd4bd6f8b41c5f3e5067a62b7645e7a3cc42b6e2367e7f4a257a0
Instruction Fuzzy Hash: 40C10276E41608BFDB20DBE8CD42FEA77F8AF48700F154165FA05FB286D67099819B60

Uniqueness

Uniqueness Score: -1.00%

Function 00910C51 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00910C65

Part of subcall function 0090D833: HeapFree.KERNEL32(00000000,00000000,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?), ref: 0090D849
Part of subcall function 0090D833: GetLastError.KERNEL32(?,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?,?), ref: 0090D85B

_free.LIBCMT ref: 00910C71
_free.LIBCMT ref: 00910C7C
_free.LIBCMT ref: 00910C87
_free.LIBCMT ref: 00910C92
_free.LIBCMT ref: 00910C9D
_free.LIBCMT ref: 00910CA8
_free.LIBCMT ref: 00910CB3
_free.LIBCMT ref: 00910CBE
_free.LIBCMT ref: 00910CCC

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: eba72d5dea4f8b1ebf7fe3307ae2960e79194440457c05282e21d50337ad88b8
Instruction ID: 6ffa89ad1c8be83af5a3631bf879bec360f779d2801c1133782a3d11bdd875ab
Opcode Fuzzy Hash: eba72d5dea4f8b1ebf7fe3307ae2960e79194440457c05282e21d50337ad88b8
Instruction Fuzzy Hash: 19117775A05108AFCB01EFD4C942ED93BB5EF84350B9181A5BE084B262D672DE91EB80

Uniqueness

Uniqueness Score: -1.00%

Function 0090F85C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00910D45: GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
Part of subcall function 00910D45: _free.LIBCMT ref: 00910D7C
Part of subcall function 00910D45: SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
Part of subcall function 00910D45: _abort.LIBCMT ref: 00910DC3

_memcmp.LIBVCRUNTIME ref: 0090FB06
_free.LIBCMT ref: 0090FB77
_free.LIBCMT ref: 0090FB90
_free.LIBCMT ref: 0090FBC2
_free.LIBCMT ref: 0090FBCB
_free.LIBCMT ref: 0090FBD7

Strings

C, xrefs: 0090F9C4

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: d5eb1befe38e8b42f008b4645e22ce2b31f5b7a3022beda54c65566187226327
Instruction ID: 012103415c0681edffff6db13a1db44fea46481a14fcecd2a4bec4dcbaea405a
Opcode Fuzzy Hash: d5eb1befe38e8b42f008b4645e22ce2b31f5b7a3022beda54c65566187226327
Instruction Fuzzy Hash: EBB11975A012199FDB24DF18C894BADB7B4FF48314F5085AAE849A7791E731AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 008B7100 Relevance: 10.7, APIs: 7, Instructions: 214COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 008B7158
new.LIBCMT ref: 008B7196
new.LIBCMT ref: 008B71E1
new.LIBCMT ref: 008B722C
new.LIBCMT ref: 008B726A

Part of subcall function 008B6200: new.LIBCMT ref: 008B622A

new.LIBCMT ref: 008B732A
new.LIBCMT ref: 008B736B

Part of subcall function 00907E27: Concurrency::cancel_current_task.LIBCPMT ref: 00907E3F

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a01977a29b16fcf574ac60d83946f5ab67d132b59ccdfbf4de2cc737a6ad3e9d
Instruction ID: 1799494dbcb385fb85ef83d72157faf30b165088e7c19234d285be555506c2e2
Opcode Fuzzy Hash: a01977a29b16fcf574ac60d83946f5ab67d132b59ccdfbf4de2cc737a6ad3e9d
Instruction Fuzzy Hash: 93B1CFB09147458FD724CF19C484B42BBE0FF59324F15C69EE8588B362E3B5EA84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0091624B Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009162BA
_free.LIBCMT ref: 009162C8
_free.LIBCMT ref: 009163F6
_free.LIBCMT ref: 00916401

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5f47ea5ab4f9e6343402963ed32fcdcae3ce96e3411897811f5547b5bf21f5d6
Instruction ID: 984906f4f83068154f08cfbf80aee857615bf52cd9cc92d4db97c6fad4ae12e9
Opcode Fuzzy Hash: 5f47ea5ab4f9e6343402963ed32fcdcae3ce96e3411897811f5547b5bf21f5d6
Instruction Fuzzy Hash: 0561B571E04219AFDB20DFA4C841BEEBBF8EF44710F144569E954EB291D770AD81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00919B3D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0091A2B2,?,00000000,?,00000000,00000000), ref: 00919B7F
__fassign.LIBCMT ref: 00919BFA
__fassign.LIBCMT ref: 00919C15
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00919C3B
WriteFile.KERNEL32(?,?,00000000,0091A2B2,00000000,?,?,?,?,?,?,?,?,?,0091A2B2,?), ref: 00919C5A
WriteFile.KERNEL32(?,?,00000001,0091A2B2,00000000,?,?,?,?,?,?,?,?,?,0091A2B2,?), ref: 00919C93

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: e44c4881819dab33ae7d85b8c0ea78c638dfb472727f7bb3db976bdc2ef3a38c
Instruction ID: 6963fa59db0ba83a309ca27c759c2a7d424ba479f6e06d350819c1047e15bf5f
Opcode Fuzzy Hash: e44c4881819dab33ae7d85b8c0ea78c638dfb472727f7bb3db976bdc2ef3a38c
Instruction Fuzzy Hash: 655195B1E042499FDB10CFA8D895AEEBBF8FF09310F14451AE995E7251D730E981CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00916720 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00916467: _free.LIBCMT ref: 00916490

_free.LIBCMT ref: 0091676E

Part of subcall function 0090D833: HeapFree.KERNEL32(00000000,00000000,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?), ref: 0090D849
Part of subcall function 0090D833: GetLastError.KERNEL32(?,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?,?), ref: 0090D85B

_free.LIBCMT ref: 00916779
_free.LIBCMT ref: 00916784
_free.LIBCMT ref: 009167D8
_free.LIBCMT ref: 009167E3
_free.LIBCMT ref: 009167EE
_free.LIBCMT ref: 009167F9

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2c787a4941dabb1e22ee1c462e5b8ef14b0e9f0bdd24f9a8dba4ce42484360ea
Instruction ID: 68c39531b813cdbb4ef0cd2129828809417aa8c84d73f0e506b9b7994849f3e3
Opcode Fuzzy Hash: 2c787a4941dabb1e22ee1c462e5b8ef14b0e9f0bdd24f9a8dba4ce42484360ea
Instruction Fuzzy Hash: AA1103B1E41B08BAD620FBF0DC47FDB7B9C6F84700F804829B69D661E2EA79B5449750

Uniqueness

Uniqueness Score: -1.00%

Function 0090C4FD Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0090C4F4,00909C67,009296D8,00000010,0090942F,?,?,?,?,?,00000000,?), ref: 0090C50B
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0090C519
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0090C532
SetLastError.KERNEL32(00000000,0090C4F4,00909C67,009296D8,00000010,0090942F,?,?,?,?,?,00000000,?), ref: 0090C584

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2d1e3b66624d536a6f60e403ae8cf6d411587c3e9a5a939b049671ad1060033b
Instruction ID: 8d254d56d2e873106b31984b0b34a905210601380bf56031ecfec1488a5f39a8
Opcode Fuzzy Hash: 2d1e3b66624d536a6f60e403ae8cf6d411587c3e9a5a939b049671ad1060033b
Instruction Fuzzy Hash: 6D01F2B725E2196EEA2527B4BC85B6B2B9CEB497B53600329F230910F1FF116C41B140

Uniqueness

Uniqueness Score: -1.00%

Function 0090D303 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0090D32F
__cftoe.LIBCMT ref: 0090D361

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: d6dfc5abe80bfd44a1f4e5fd82f88a8745a1fdd5149b6a7ce57b84c123d1243c
Instruction ID: 83c0d32f4a9bba78d2d03ca63bc962c7a3633ecea15c8edd50d19410100794ee
Opcode Fuzzy Hash: d6dfc5abe80bfd44a1f4e5fd82f88a8745a1fdd5149b6a7ce57b84c123d1243c
Instruction Fuzzy Hash: 7551E932901205AFDF249BE98C41FAE77ACAF89334F244229F829D61D2DB35D94096A1

Uniqueness

Uniqueness Score: -1.00%

Function 008B3600 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008B3636
std::_Lockit::_Lockit.LIBCPMT ref: 008B3659
std::_Lockit::~_Lockit.LIBCPMT ref: 008B3679
__CxxThrowException@8.LIBVCRUNTIME ref: 008B36EF
std::_Facet_Register.LIBCPMT ref: 008B3705
std::_Lockit::~_Lockit.LIBCPMT ref: 008B3710

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: fe86d573e6a68c0ca1b1b4d866f7f0b83f41b93f72ce4c71dc9bb61ac34f5e3b
Instruction ID: ce10edc53ec07b436dfe3bf49ec3ee4e66e5d229a1f6054e418d15b9ac4542d5
Opcode Fuzzy Hash: fe86d573e6a68c0ca1b1b4d866f7f0b83f41b93f72ce4c71dc9bb61ac34f5e3b
Instruction Fuzzy Hash: 6031B1B1D04218AFCB21DF94D881AEEB7F4FF99324F104129E801A7391DB31AE45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 008B3750 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008B3786
std::_Lockit::_Lockit.LIBCPMT ref: 008B37A9
std::_Lockit::~_Lockit.LIBCPMT ref: 008B37C9
__CxxThrowException@8.LIBVCRUNTIME ref: 008B383F
std::_Facet_Register.LIBCPMT ref: 008B3855
std::_Lockit::~_Lockit.LIBCPMT ref: 008B3860

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: 77b288878b7bbbe2e9ad6b8aa63c2aa839ea99ce826d915d18764dd96c55874c
Instruction ID: 864f5547b85b570b00cf228bcb365504c850fba0883fa76775539a678ca64664
Opcode Fuzzy Hash: 77b288878b7bbbe2e9ad6b8aa63c2aa839ea99ce826d915d18764dd96c55874c
Instruction Fuzzy Hash: 3031AEB5D042189FCB21DFA4D880AEEB7B4FF48724F114269E805B7391DB31AE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00910D45 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0090CE3C,?,?,00906E03,?,?,?,00929624,?), ref: 00910D49
_free.LIBCMT ref: 00910D7C
_free.LIBCMT ref: 00910DA4
SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DB1
SetLastError.KERNEL32(00000000,?,00929624,?,?,?,?,?,?,?,?), ref: 00910DBD
_abort.LIBCMT ref: 00910DC3

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: ceda14c3fcf0a913b74eac3f45009dbb23c35d9d304b043d321cdfa047612c1a
Instruction ID: 71b5dcf0a4668ae8c15d06604720aa5faf4a99e19e712d3441d64642560418c1
Opcode Fuzzy Hash: ceda14c3fcf0a913b74eac3f45009dbb23c35d9d304b043d321cdfa047612c1a
Instruction Fuzzy Hash: 6AF0A939349708AAC61133B47C06FEE15799FC2765F254114F958A61D2EE6598C19160

Uniqueness

Uniqueness Score: -1.00%

Function 008B1130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008B1167
___std_exception_copy.LIBVCRUNTIME ref: 008B11D3
__CxxThrowException@8.LIBVCRUNTIME ref: 008B11EB

Part of subcall function 0090A91A: RaiseException.KERNEL32(?,?,00906DB9,?,?,?,?,?,?,?,?,00906DB9,?,009295AC,?), ref: 0090A979

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008B11F2

Strings

bad locale name, xrefs: 008B11BF

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrow___std_exception_copy
String ID: bad locale name
API String ID: 2988018378-1405518554
Opcode ID: 2c381f0cce5c08af412342de135fcc1271e748859b8fbea55c611ae470546ba7
Instruction ID: 5335fee4918404293c5699b75ec90c41ed6fff2f6d149aa80f8f67f45ef02ae7
Opcode Fuzzy Hash: 2c381f0cce5c08af412342de135fcc1271e748859b8fbea55c611ae470546ba7
Instruction Fuzzy Hash: 1D219C719147489ECB20CFA8C805B8FBBF8FF59710F10461EE445A3781E775A6088BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0090E97B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0090E92C,00000000,?,0090E8CC,00000000,00929858,0000000C,0090EA23,00000000,00000002), ref: 0090E99B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0090E9AE
FreeLibrary.KERNEL32(00000000,?,?,?,0090E92C,00000000,?,0090E8CC,00000000,00929858,0000000C,0090EA23,00000000,00000002), ref: 0090E9D1

Strings

CorExitProcess, xrefs: 0090E9A6
mscoree.dll, xrefs: 0090E994

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 17b940fb9327d60b30ab698014e9472e2ef47ee827a134e3588953734298ff13
Instruction ID: 190c09596b36c54d23050ed05aca966b7e2fab1362cf19c6769d595e196d04be
Opcode Fuzzy Hash: 17b940fb9327d60b30ab698014e9472e2ef47ee827a134e3588953734298ff13
Instruction Fuzzy Hash: D7F04F70B5821CFFDF119BA0DC09BEEBFB8EB48755F004169F805A22A0CB705E81DA90

Uniqueness

Uniqueness Score: -1.00%

Function 009120B6 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25af42fe4ef09500f90fb968f163e876eba0d6c5162d12ec6e728fa62a9247f7
Instruction ID: baa77c80c7f006a90165353041f03a6ab5d54e673e39ae9dc465633f03bacde3
Opcode Fuzzy Hash: 25af42fe4ef09500f90fb968f163e876eba0d6c5162d12ec6e728fa62a9247f7
Instruction Fuzzy Hash: 57718071B0021A9FCF29EB94CC84AFEBB79EF45750B244629E5216B180D7748DD2DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0090F3DE Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0090D86D: HeapAlloc.KERNEL32(00000000,?,?,?,00908A77,?,?,?,?,?,008B1087,?,?,?), ref: 0090D89F

_free.LIBCMT ref: 0090F4E9
_free.LIBCMT ref: 0090F500
_free.LIBCMT ref: 0090F51F
_free.LIBCMT ref: 0090F53A
_free.LIBCMT ref: 0090F551

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 94e17135632367b35fa8e478ecb9507ffedd42800d152aa1a79546abd1bdd82c
Instruction ID: d431226ff160f64f3d6a777594372284ebe9f7e2d7a74b9de724d0128dc572fb
Opcode Fuzzy Hash: 94e17135632367b35fa8e478ecb9507ffedd42800d152aa1a79546abd1bdd82c
Instruction Fuzzy Hash: CD51AE32A00604AFDB30DF69DC51B6AB7F8EF89720B144579E809D76A0E731EA01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0090FE94 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0090FF06
_free.LIBCMT ref: 0090FF26

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1d1cf6bd907c2bbaaa4c229552fdf9a57a023ab1902c988244f085115e289f8b
Instruction ID: 7fee028e50508d247555f2fff2c77d04a88c45cd665a30fd9b51df401011408b
Opcode Fuzzy Hash: 1d1cf6bd907c2bbaaa4c229552fdf9a57a023ab1902c988244f085115e289f8b
Instruction Fuzzy Hash: B641D532A002049FCB20DF78C891B5EB7F5EF89714F154569EA15EB791DB31AE02DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0091129D Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000006,00000000,0000007F,00920060,00000000,00000000,8B56FF8B,0090EBAD,?,00000006,00000001,00920060,0000007F,?,8B56FF8B,00000001), ref: 009112EA
__alloca_probe_16.LIBCMT ref: 00911322
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00911373
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00911385
__freea.LIBCMT ref: 0091138E

Part of subcall function 0090D86D: HeapAlloc.KERNEL32(00000000,?,?,?,00908A77,?,?,?,?,?,008B1087,?,?,?), ref: 0090D89F

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 430c4cb044dc0a01c33c9ae96c0a064e3b8d940604f8ef9f56070a923e626d1a
Instruction ID: 268a46bfacd420087450d848cc5a167f37b35f87fb7fb60d64e80d561794dee8
Opcode Fuzzy Hash: 430c4cb044dc0a01c33c9ae96c0a064e3b8d940604f8ef9f56070a923e626d1a
Instruction Fuzzy Hash: AD31DC72B0020AABDF258F64CC45EEE7BA9EB44710F044228FD24D7194E735DC91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00915A1D Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00915A26
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00915A49

Part of subcall function 0090D86D: HeapAlloc.KERNEL32(00000000,?,?,?,00908A77,?,?,?,?,?,008B1087,?,?,?), ref: 0090D89F

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00915A6F
_free.LIBCMT ref: 00915A82
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00915A91

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: e162418f254bde43b65ed784589e6b400412fee0e01220f9447158df2e9cc2d4
Instruction ID: b42d6c63d945474b36b9baf0ae64d6c8fc0c3456ddeb2c140c8be65d700d3a9a
Opcode Fuzzy Hash: e162418f254bde43b65ed784589e6b400412fee0e01220f9447158df2e9cc2d4
Instruction Fuzzy Hash: 5C0124B2742A29FF672056B69C88CFB696CDEC6BA13130228BD05C3210EA618D41A1B0

Uniqueness

Uniqueness Score: -1.00%

Function 00910DC9 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0090D809,0090D8B0,?,?,00908A77,?,?,?,?,?,008B1087,?,?), ref: 00910DCE
_free.LIBCMT ref: 00910E03
_free.LIBCMT ref: 00910E2A
SetLastError.KERNEL32(00000000,?,?,?), ref: 00910E37
SetLastError.KERNEL32(00000000,?,?,?), ref: 00910E40

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2e0f930a73da24e51462ca087a92fd3fa0411701f91498f633b8531845a35073
Instruction ID: 2e3fd167cb020b8bbf7ede7db09a807517e6d28ff941a2aa24f2e3a849ad16a0
Opcode Fuzzy Hash: 2e0f930a73da24e51462ca087a92fd3fa0411701f91498f633b8531845a35073
Instruction Fuzzy Hash: 62017D32349208ABC72227766C45EEF266D9FD13707214924F818E3292EFB28CC1E060

Uniqueness

Uniqueness Score: -1.00%

Function 009161E2 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009161FA

Part of subcall function 0090D833: HeapFree.KERNEL32(00000000,00000000,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?), ref: 0090D849
Part of subcall function 0090D833: GetLastError.KERNEL32(?,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?,?), ref: 0090D85B

_free.LIBCMT ref: 0091620C
_free.LIBCMT ref: 0091621E
_free.LIBCMT ref: 00916230
_free.LIBCMT ref: 00916242

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c15acfdda4a66379855fe3d4e6f20c693c898ee3da965430da8470a5bdf69bbc
Instruction ID: a4c3f6e4dcd9011a2467bcee93bf1e4068cd618d5c5f5435bbfb6ce39244dfdf
Opcode Fuzzy Hash: c15acfdda4a66379855fe3d4e6f20c693c898ee3da965430da8470a5bdf69bbc
Instruction Fuzzy Hash: 94F03032A19204ABC631EFD8F882D5A73EDAE447107648C19F439D7545CB34FCC1EAA4

Uniqueness

Uniqueness Score: -1.00%

Function 009100E6 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00910104

Part of subcall function 0090D833: HeapFree.KERNEL32(00000000,00000000,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?), ref: 0090D849
Part of subcall function 0090D833: GetLastError.KERNEL32(?,?,00916495,?,00000000,?,00000000,?,00916739,?,00000007,?,?,00916B67,?,?), ref: 0090D85B

_free.LIBCMT ref: 00910116
_free.LIBCMT ref: 00910129
_free.LIBCMT ref: 0091013A
_free.LIBCMT ref: 0091014B

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f0c5412d6c436fe9d724cd13f50b7f9ede81383fc353bb13a61929d6ca0ef09d
Instruction ID: 9e57bf326b530ed6323db3d5481e3369155df5ef94b8cdfa142b030973cdced9
Opcode Fuzzy Hash: f0c5412d6c436fe9d724cd13f50b7f9ede81383fc353bb13a61929d6ca0ef09d
Instruction Fuzzy Hash: 46F03AB992A6219FD722AFB4FC0252C7BA4EF547203004216F818632B1C7355993FFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0090E1D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\kGZyUV1upG.exe,00000104), ref: 0090E212
_free.LIBCMT ref: 0090E2DD
_free.LIBCMT ref: 0090E2E7

Strings

C:\Users\user\Desktop\kGZyUV1upG.exe, xrefs: 0090E209, 0090E210, 0090E23F, 0090E277

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\kGZyUV1upG.exe
API String ID: 2506810119-3519604130
Opcode ID: ad9474a9719643da247db76e22b0feaede6f1c54f25edda73aeca64d63857d4a
Instruction ID: 0853b19b19e28f6e2983761e7b743ab9d6737c6867e9d29be4313619af97ea17
Opcode Fuzzy Hash: ad9474a9719643da247db76e22b0feaede6f1c54f25edda73aeca64d63857d4a
Instruction Fuzzy Hash: BF31A1B1A05218EFDB21DF98DC81AAEBBFCEFC5710F104566F914A7291D6708E81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 008B7C10 Relevance: 6.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 008B7C6D
new.LIBCMT ref: 008B7CDF
Concurrency::cancel_current_task.LIBCPMT ref: 008B7D6D
Concurrency::cancel_current_task.LIBCPMT ref: 008B7D72

Part of subcall function 008B7E90: new.LIBCMT ref: 008B7EC2

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2dc3797ed0fc6ac80b3cd04e6037b8c1b205901038ccad802048c113beae1528
Instruction ID: 548d80e5269acf3012cb23307eb0ce4e43fe4ffa4c0422e74c3bfecdaff6a099
Opcode Fuzzy Hash: 2dc3797ed0fc6ac80b3cd04e6037b8c1b205901038ccad802048c113beae1528
Instruction Fuzzy Hash: 41418B75A047069FC724CF29C890AA9FBE1FF99311B14866EE899C7752D331F990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 008B4290 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 008B42C6
Concurrency::cancel_current_task.LIBCPMT ref: 008B4330

Part of subcall function 00906D7D: __CxxThrowException@8.LIBVCRUNTIME ref: 00906D94

Concurrency::cancel_current_task.LIBCPMT ref: 008B4335

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Concurrency::cancel_current_task$Exception@8Throw
String ID:
API String ID: 3339364867-0
Opcode ID: a08711649eb5669a9a1a0d0dc449c42cfb0618a87269a46a5a51f4623f9fd0aa
Instruction ID: 707ca5c5885fce5734f62ec957b5674be521304db7a476697b4540c6f835edb5
Opcode Fuzzy Hash: a08711649eb5669a9a1a0d0dc449c42cfb0618a87269a46a5a51f4623f9fd0aa
Instruction Fuzzy Hash: 731190B2A0051AAFC718DF68C882DAAF7A8FF543107144239E919C3391E771EE64C791

Uniqueness

Uniqueness Score: -1.00%

Function 008B4ED0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 008B4F06
Concurrency::cancel_current_task.LIBCPMT ref: 008B4F70

Part of subcall function 00906D7D: __CxxThrowException@8.LIBVCRUNTIME ref: 00906D94

Concurrency::cancel_current_task.LIBCPMT ref: 008B4F75

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: Concurrency::cancel_current_task$Exception@8Throw
String ID:
API String ID: 3339364867-0
Opcode ID: 9cbbee8e32b90f32dc8ebc305f7290a3a7abf18e2bd0fe49b99b1586c9e47662
Instruction ID: 5f97b8303e5e286fd93dee437f6275cc9c971b7db12814fbc349f331f007bc32
Opcode Fuzzy Hash: 9cbbee8e32b90f32dc8ebc305f7290a3a7abf18e2bd0fe49b99b1586c9e47662
Instruction Fuzzy Hash: 5B1160B1A01516AFD718DF68D8829BAF7A8FF44310B144639E919C3391EB71FE24C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00911824 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,009117CB,?,00000000,00000000,00000000,?,00911A35,00000006,FlsSetValue), ref: 00911856
GetLastError.KERNEL32(?,009117CB,?,00000000,00000000,00000000,?,00911A35,00000006,FlsSetValue,00920664,0092066C,00000000,00000364,?,00910E17), ref: 00911862
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,009117CB,?,00000000,00000000,00000000,?,00911A35,00000006,FlsSetValue,00920664,0092066C,00000000), ref: 00911870

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ea35037e180ed7dd5ac8f9590f8063323ddd6d82243f5f8c22a2c36d83fa1244
Instruction ID: 545691dd29276a4fd30914c509c8b9a45e18f292e723a7b386cf448d203dcf0e
Opcode Fuzzy Hash: ea35037e180ed7dd5ac8f9590f8063323ddd6d82243f5f8c22a2c36d83fa1244
Instruction Fuzzy Hash: 4901F73676922EFBDB318A789C44AE6775CAF497A1B108660FB0ED3140D724D841C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 009093EA Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00909401

Part of subcall function 00909A39: ___AdjustPointer.LIBCMT ref: 00909A83

_UnwindNestedFrames.LIBCMT ref: 00909418
___FrameUnwindToState.LIBVCRUNTIME ref: 0090942A
CallCatchBlock.LIBVCRUNTIME ref: 0090944E

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 2b147a754eb2872ebc8fdcf565fcaff096bfe3dfa664835812cca1db22f0c56c
Instruction ID: 2fc07eed21e3e9aed518e61f532a831748bbf6951843afd0b3bcff64f43e02e0
Opcode Fuzzy Hash: 2b147a754eb2872ebc8fdcf565fcaff096bfe3dfa664835812cca1db22f0c56c
Instruction Fuzzy Hash: DA01E532400109BFCF126F55CC45EEA7BBAEF88754F158014F918661A2D776E8A2EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008B4420 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 008B444B

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44edd02de8b77c63a7b644a902c5084350287424c1cadf83eb20808f932732aa
Instruction ID: 93a96ea7da0c60f059dea61fbf4b9e158e10fdb3bf3f34619fa2fc82ca109197
Opcode Fuzzy Hash: 44edd02de8b77c63a7b644a902c5084350287424c1cadf83eb20808f932732aa
Instruction Fuzzy Hash: 25F027B2A452040ED618EB749843B6E7384EFA0360710423AF21BC23D2F622ED71815A

Uniqueness

Uniqueness Score: -1.00%

Function 008B4D70 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 008B4D9B

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce6c199081048989e6eda411506324274c8179fb52135dfae83c246bb68abff
Instruction ID: baf2b1385f99e78c243f19fccb310b5c296ad7f9d05c1e83127e26d86ac8d252
Opcode Fuzzy Hash: dce6c199081048989e6eda411506324274c8179fb52135dfae83c246bb68abff
Instruction Fuzzy Hash: 77F0ECB3A441040ED61CE7B49853EAE7398DFA03A0704063EF21BC63D3F622ED65C156

Uniqueness

Uniqueness Score: -1.00%

Function 0090C416 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 0090C416
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0090C41B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 0090C420

Part of subcall function 0090C78E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0090C79F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 0090C435

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 9047f225a710797a61a8bf253e382432c5199412e9a5610390c563821c608de7
Instruction ID: d2c4e9b4d8a978285a947e6a5c410efe9f4a30c2e6d21eeff20278b2f4287e65
Opcode Fuzzy Hash: 9047f225a710797a61a8bf253e382432c5199412e9a5610390c563821c608de7
Instruction Fuzzy Hash: 41C04CD91042055DDC203BB172637BD23442CE67D5BC42BC1F941371E35B09040E3432

Uniqueness

Uniqueness Score: -1.00%

Function 0090DA9D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0090DB2D

Strings

pow, xrefs: 0090DB05, 0090DB22

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 2ba60af0cd228f3551a0af03b5d16ba672bb096b2b517793321f611aa425e730
Instruction ID: 447979f9e97938c1fd24168809f7c7ccbda129495682e333140936b9faa75014
Opcode Fuzzy Hash: 2ba60af0cd228f3551a0af03b5d16ba672bb096b2b517793321f611aa425e730
Instruction Fuzzy Hash: 07519161B1E1098EDB21BB54CD013FA7BECDB85750F208D68E0D5862E9EB358CD1EA46

Uniqueness

Uniqueness Score: -1.00%

Function 00917240 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002), ref: 0091731B

Strings

OCP, xrefs: 00917294
ACP, xrefs: 0091725E

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 3539d6df5050d74613802da016d8eaf49d9345143def945f13d55dd89419814d
Instruction ID: 80fb5f53f0dfa20ff89f672f7987b7c3fa9e26c899be5d249a8093e4bdd0a64f
Opcode Fuzzy Hash: 3539d6df5050d74613802da016d8eaf49d9345143def945f13d55dd89419814d
Instruction Fuzzy Hash: BD219566B0810AA6DB248AD59901BD7E3BEAB64B50B564C64FD25D7104E732DE82C250

Uniqueness

Uniqueness Score: -1.00%

Function 00911E3A Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00911ED0
GetLastError.KERNEL32(?,00000000), ref: 00911EDE
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,?,00000000,?,00000000), ref: 00911F39

Memory Dump Source

Source File: 00000000.00000002.4062882740.00000000008B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.4062861774.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062924649.000000000091C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062941314.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4062954973.000000000092E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_kGZyUV1upG.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 3b4fc3e5d6f4b9bcf913b878bce13864f7c8c21a6a9a2449382da1ccb28447e7
Instruction ID: 82c2925412d4c71e5b89912471c27e88ed429f6ddaa590cf436848789629d4e8
Opcode Fuzzy Hash: 3b4fc3e5d6f4b9bcf913b878bce13864f7c8c21a6a9a2449382da1ccb28447e7
Instruction Fuzzy Hash: A341C631B0424EBFDF219F64C844BFABBA8EF41310F158159FA5997291D7308D82CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kGZyUV1upG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: kGZyUV1upG.exePID: 6896, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: kGZyUV1upG.exePID: 6896, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 008B89F0 Relevance: 125.0, APIs: 19, Strings: 41, Instructions: 20001libraryloaderCOMMON

Control-flow Graph

Windows Analysis Report
kGZyUV1upG.exe

Function 008B89F0 Relevance: 125.0, APIs: 19, Strings: 41, Instructions: 20001
libraryloaderCOMMON

Function 008B2590 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 232
clipboardsynchronizationCOMMON

Function 009113BA Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Function 00911C67 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00915406 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Function 0091575B Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Function 0091559A Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 00905C20 Relevance: 20.0, APIs: 13, Instructions: 458
networkCOMMON

Function 0090CEA8 Relevance: 22.8, APIs: 15, Instructions: 296
COMMON

Function 009169CF Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE