Edit tour

Windows Analysis Report
ZtQY1K6aTi.exe

Overview

General Information

Sample name:	ZtQY1K6aTi.exe renamed because original name is a hash value
Original sample name:	7f991bd7699126d6cca12241de7e7c44.exe
Analysis ID:	1435778
MD5:	7f991bd7699126d6cca12241de7e7c44
SHA1:	63829ce5fcb6616b08d81fb456e92fcd1cac14c9
SHA256:	441bfb5e8bc07201c4c44de203b37c3ee9ab8d50dcfe025d7757fb7097c61156
Tags:	32exetrojan
Infos:

Detection

RisePro Stealer

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected RisePro Stealer

Adds extensions / path to Windows Defender exclusion list (Registry)

Contains functionality to inject threads in other processes

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Exclude list of file types from scheduled, custom, and real-time scanning

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Modifies Group Policy settings

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

ZtQY1K6aTi.exe (PID: 6788 cmdline: "C:\Users\user\Desktop\ZtQY1K6aTi.exe" MD5: 7F991BD7699126D6CCA12241DE7E7C44)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: ZtQY1K6aTi.exe PID: 6788	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Sigma Signatures

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\ZtQY1K6aTi.exe, ProcessId: 6788, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ZtQY1K6aTi.exe	ReversingLabs: Detection: 60%
Source: ZtQY1K6aTi.exe	Virustotal: Detection: 66%			Perma Link

Machine Learning detection for sample

Source: ZtQY1K6aTi.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_00263EB0 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,

0_2_00263EB0

Source: ZtQY1K6aTi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions			Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe			Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D2012 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_001D2012
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0027D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,	0_2_0027D2B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002633B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_002633B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002313F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_002313F0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00231A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	0_2_00231A60
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00283B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_00283B20
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001EFC1D FindFirstFileExW,	0_2_001EFC1D
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D1F8C FindClose,FindFirstFileExW,GetLastError,	0_2_001D1F8C

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 87.120.84.5:50500

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.84.5

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001B8DC0 recv,

0_2_001B8DC0

Source: ZtQY1K6aTi.exe	String found in binary or memory: http://www.winimage.com/zLibDll
Source: ZtQY1K6aTi.exe	String found in binary or memory: https://ipinfo.io/
Source: ZtQY1K6aTi.exe	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: ZtQY1K6aTi.exe, 00000000.00000002.3254044242.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: ZtQY1K6aTi.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_002833A0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

0_2_002833A0

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	File created: C:\Windows\System32\GroupPolicy\GPT.INI	Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F9588	0_2_001F9588
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001E001D	0_2_001E001D
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002E40A0	0_2_002E40A0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00298080	0_2_00298080
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002D20C0	0_2_002D20C0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0022E120	0_2_0022E120
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00222100	0_2_00222100
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002D81A0	0_2_002D81A0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002361D0	0_2_002361D0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002A4220	0_2_002A4220
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002B4220	0_2_002B4220
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00218200	0_2_00218200
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001AA2C0	0_2_001AA2C0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0028A2D0	0_2_0028A2D0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001E035F	0_2_001E035F
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00290350	0_2_00290350
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0027C3E0	0_2_0027C3E0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002463D0	0_2_002463D0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002A0520	0_2_002A0520
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F47AD	0_2_001F47AD
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0026E800	0_2_0026E800
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002DC8D0	0_2_002DC8D0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001DA918	0_2_001DA918
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001DC950	0_2_001DC950
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002509B0	0_2_002509B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002749B0	0_2_002749B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0024E9E0	0_2_0024E9E0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0026CAA0	0_2_0026CAA0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00294AA0	0_2_00294AA0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00238A80	0_2_00238A80
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002E4AE0	0_2_002E4AE0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002D6B30	0_2_002D6B30
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00230BA0	0_2_00230BA0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00284B90	0_2_00284B90
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F8BA0	0_2_001F8BA0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0023CBF0	0_2_0023CBF0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00294CD0	0_2_00294CD0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0028CD20	0_2_0028CD20
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F8E20	0_2_001F8E20
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00268E70	0_2_00268E70
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00246EA0	0_2_00246EA0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0023AEC0	0_2_0023AEC0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0024AED0	0_2_0024AED0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002BAF30	0_2_002BAF30
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00294F70	0_2_00294F70
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0028CFC0	0_2_0028CFC0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00295070	0_2_00295070
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002A1040	0_2_002A1040
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0022D0B0	0_2_0022D0B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002970E0	0_2_002970E0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00241130	0_2_00241130
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002E3160	0_2_002E3160
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D7190	0_2_001D7190
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002332B0	0_2_002332B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002DF280	0_2_002DF280
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0025F2D0	0_2_0025F2D0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0029D320	0_2_0029D320
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0029F360	0_2_0029F360
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0025D450	0_2_0025D450
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00293450	0_2_00293450
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002BF450	0_2_002BF450
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002A54A0	0_2_002A54A0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00219490	0_2_00219490
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0028B500	0_2_0028B500
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001CF570	0_2_001CF570
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002AF5E0	0_2_002AF5E0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002A7630	0_2_002A7630
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0021F730	0_2_0021F730
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0025B770	0_2_0025B770
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0027B7E0	0_2_0027B7E0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002977F0	0_2_002977F0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0028D7D0	0_2_0028D7D0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00255880	0_2_00255880
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001AB8E0	0_2_001AB8E0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002B18D0	0_2_002B18D0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00295960	0_2_00295960
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00231A60	0_2_00231A60
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001EDA74	0_2_001EDA74
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002E5A40	0_2_002E5A40
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0027DA80	0_2_0027DA80
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0028FBA0	0_2_0028FBA0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00223C3D	0_2_00223C3D
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00297CA0	0_2_00297CA0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001A9C90	0_2_001A9C90
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002E3CF0	0_2_002E3CF0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00247D20	0_2_00247D20
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00243D70	0_2_00243D70
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00241E40	0_2_00241E40
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00295EB0	0_2_00295EB0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00233ED0	0_2_00233ED0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0029DF20	0_2_0029DF20
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00281F80	0_2_00281F80
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0028BFC0	0_2_0028BFC0

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: String function: 001BACE0 appears 146 times
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: String function: 001A2CF0 appears 110 times
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: String function: 001D4370 appears 60 times
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: String function: 002E4890 appears 102 times

Source: ZtQY1K6aTi.exe, 00000000.00000000.1976300985.0000000000327000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs ZtQY1K6aTi.exe
Source: ZtQY1K6aTi.exe, 00000000.00000002.3254255271.00000000046F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs ZtQY1K6aTi.exe
Source: ZtQY1K6aTi.exe	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs ZtQY1K6aTi.exe

Source: ZtQY1K6aTi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal96.troj.evad.winEXE@1/3@0/1

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_002E23D0 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

0_2_002E23D0

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_002E2160 GetVersionExA,CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

0_2_002E2160

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_0022CB90 CreateDirectoryA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0022CB90

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_002709B0 CoInitializeEx,CoCreateInstance,RegCreateKeyExA,RegSetValueExA,RegCreateKeyExA,RegSetValueExA,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegOpenKeyExA,RegCreateKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,CoUninitialize,

0_2_002709B0

Source: ZtQY1K6aTi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

File read: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZtQY1K6aTi.exe, ZtQY1K6aTi.exe, 00000000.00000000.1976264611.00000000002FA000.00000002.00000001.01000000.00000003.sdmp, ZtQY1K6aTi.exe, 00000000.00000002.3254255271.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, ZtQY1K6aTi.exe, 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: ZtQY1K6aTi.exe, 00000000.00000000.1976264611.00000000002FA000.00000002.00000001.01000000.00000003.sdmp, ZtQY1K6aTi.exe, 00000000.00000002.3254255271.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, ZtQY1K6aTi.exe, 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: ZtQY1K6aTi.exe	ReversingLabs: Detection: 60%
Source: ZtQY1K6aTi.exe	Virustotal: Detection: 66%

Source: ZtQY1K6aTi.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: ZtQY1K6aTi.exe	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll\*value

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

File read: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

File written: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: ZtQY1K6aTi.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: ZtQY1K6aTi.exe

Static file information: File size 1672704 > 1048576

Source: ZtQY1K6aTi.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x158c00

Source: ZtQY1K6aTi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ZtQY1K6aTi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ZtQY1K6aTi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ZtQY1K6aTi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ZtQY1K6aTi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ZtQY1K6aTi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ZtQY1K6aTi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: ZtQY1K6aTi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ZtQY1K6aTi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ZtQY1K6aTi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ZtQY1K6aTi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ZtQY1K6aTi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001F9588 LoadLibraryA,GetProcAddress,MessageBoxA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,SetThreadExecutionState,

0_2_001F9588

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001D3F49 push ecx; ret

0_2_001D3F5C

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_0028A2D0 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0028A2D0

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_0-90433

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_0-90435

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-90366

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

0_2_001FDA50

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Window / User API: threadDelayed 6362

Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-90363

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-90396

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

API coverage: 7.2 %

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_002E1D30 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 002E1D71h

0_2_002E1D30

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D2012 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_001D2012
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_0027D2B0 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,	0_2_0027D2B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002633B0 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_002633B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002313F0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_002313F0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00231A60 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	0_2_00231A60
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00283B20 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_00283B20
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001EFC1D FindFirstFileExW,	0_2_001EFC1D
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D1F8C FindClose,FindFirstFileExW,GetLastError,	0_2_001D1F8C

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001F80C8 VirtualQuery,GetSystemInfo,

0_2_001F80C8

Source: ZtQY1K6aTi.exe, 00000000.00000002.3254044242.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ZtQY1K6aTi.exe, 00000000.00000002.3254044242.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnn

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001D4174 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001D4174

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001FA082 CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_001FA082

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

0_2_001F9588

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001FA082 mov eax, dword ptr fs:[00000030h]	0_2_001FA082
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001FA082 mov ecx, dword ptr fs:[00000030h]	0_2_001FA082
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002709B0 mov eax, dword ptr fs:[00000030h]	0_2_002709B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F9588 mov eax, dword ptr fs:[00000030h]	0_2_001F9588
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F9588 mov eax, dword ptr fs:[00000030h]	0_2_001F9588
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F9588 mov eax, dword ptr fs:[00000030h]	0_2_001F9588
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001F9588 mov ecx, dword ptr fs:[00000030h]	0_2_001F9588
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001FDA50 mov eax, dword ptr fs:[00000030h]	0_2_001FDA50
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001FDA50 mov eax, dword ptr fs:[00000030h]	0_2_001FDA50
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00264130 mov eax, dword ptr fs:[00000030h]	0_2_00264130
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00270420 mov ecx, dword ptr fs:[00000030h]	0_2_00270420
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001FA61F mov eax, dword ptr fs:[00000030h]	0_2_001FA61F
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001FA61F mov eax, dword ptr fs:[00000030h]	0_2_001FA61F
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001FA61F mov eax, dword ptr fs:[00000030h]	0_2_001FA61F
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_002332B0 mov eax, dword ptr fs:[00000030h]	0_2_002332B0
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00273630 mov eax, dword ptr fs:[00000030h]	0_2_00273630
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_00265A70 mov eax, dword ptr fs:[00000030h]	0_2_00265A70

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_00286E20 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,HeapAlloc,HeapFree,HeapAlloc,HeapFree,

0_2_00286E20

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D4174 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001D4174
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D4301 SetUnhandledExceptionFilter,	0_2_001D4301
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D450D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001D450D
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: 0_2_001D8A54 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001D8A54

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_0026C630 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_0026C630

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Jump to behavior

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_00273340 cpuid

0_2_00273340

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_001F2B48
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetLocaleInfoW,	0_2_001F2D4D
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: EnumSystemLocalesW,	0_2_001F2DF4
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: EnumSystemLocalesW,	0_2_001F2E3F
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: EnumSystemLocalesW,	0_2_001F2EDA
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_001F2F65
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetLocaleInfoW,	0_2_001F31B8
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: EnumSystemLocalesW,	0_2_001EB1A3
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_001F32E1
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetLocaleInfoW,	0_2_001F33E7
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_001F34BD
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetLocaleInfoW,	0_2_001EB726
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	0_2_0027DA80
Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_001D1D84

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001D43B5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_001D43B5

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_0026E800 OutputDebugStringA,CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,ShellExecuteA,

0_2_0026E800

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_001ED11E GetTimeZoneInformation,

0_2_001ED11E

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Code function: 0_2_002E2070 GetVersionExA,DeleteFileW,GetFileAttributesW,GetLastError,Sleep,DeleteFileA,GetFileAttributesA,GetLastError,Sleep,

0_2_002E2070

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6BB86D62-6074-413F-AC7A-F6E5212F3B22}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

Registry value created: Exclusions_Extensions 1

Jump to behavior

Modifies Group Policy settings

Source: C:\Users\user\Desktop\ZtQY1K6aTi.exe

File written: C:\Windows\System32\GroupPolicy\GPT.INI

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match

File source: Process Memory Space: ZtQY1K6aTi.exe PID: 6788, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match

File source: Process Memory Space: ZtQY1K6aTi.exe PID: 6788, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Bypass User Account Control	5 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Bypass User Account Control	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	25 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZtQY1K6aTi.exe	61%	ReversingLabs	Win32.Spyware.Risepro
ZtQY1K6aTi.exe	67%	Virustotal		Browse
ZtQY1K6aTi.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	ZtQY1K6aTi.exe	false	high
http://www.winimage.com/zLibDll	ZtQY1K6aTi.exe	false	high
https://t.me/RiseProSUPPORT	ZtQY1K6aTi.exe, 00000000.00000002.3254044242.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ipinfo.io/	ZtQY1K6aTi.exe	false	high
https://www.maxmind.com/en/locate-my-ip-address	ZtQY1K6aTi.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.84.5	unknown	Bulgaria		51189	SHARCOM-ASBG	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435778
Start date and time:	2024-05-03 06:06:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZtQY1K6aTi.exe renamed because original name is a hash value
Original Sample Name:	7f991bd7699126d6cca12241de7e7c44.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@1/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 21 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHARCOM-ASBG	Sig.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	87.120.84.140
	http://87.120.84.22	Get hash	malicious	Unknown	Browse	87.120.84.22
	Browser Update.js	Get hash	malicious	BitRAT, RHADAMANTHYS	Browse	87.120.84.233
	qqeng.pdf.lnk	Get hash	malicious	RHADAMANTHYS	Browse	87.120.84.233
	qqeng.exe	Get hash	malicious	RHADAMANTHYS	Browse	87.120.84.233
	W57eRMWUqG.exe	Get hash	malicious	Amadey, PureLog Stealer	Browse	87.120.84.156
	93GwwLKH1N.exe	Get hash	malicious	Amadey, PureLog Stealer	Browse	87.120.84.156
	ChromeSetup.exe	Get hash	malicious	RHADAMANTHYS	Browse	87.120.84.233
	iSbEfOEmv8.exe	Get hash	malicious	RHADAMANTHYS	Browse	87.120.84.233
	Midjourney.exe	Get hash	malicious	RHADAMANTHYS	Browse	87.120.84.233

Process:	C:\Users\user\Desktop\ZtQY1K6aTi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[General]..

C:\Windows\System32\GroupPolicy\GPT.INI

Download File

Process:	C:\Users\user\Desktop\ZtQY1K6aTi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.080093624462795
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsUov:1WsMzYHxbnvEcvgqv
MD5:	8EF9853D1881C5FE4D681BFB31282A01
SHA1:	A05609065520E4B4E553784C566430AD9736F19F
SHA-256:	9228F13D82C3DC96B957769F6081E5BAC53CFFCA4FFDE0BA1E102D9968F184A2
SHA-512:	5DDEE931A08CFEA5BB9D1C36355D47155A24D617C2A11D08364FFC54E593064011DEE4FEA8AC5B67029CAB515D3071F0BA0422BB76AF492A3115272BA8FEB005
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=1..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Desktop\ZtQY1K6aTi.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.490534915401225
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZtQY1K6aTi.exe
File size:	1'672'704 bytes
MD5:	7f991bd7699126d6cca12241de7e7c44
SHA1:	63829ce5fcb6616b08d81fb456e92fcd1cac14c9
SHA256:	441bfb5e8bc07201c4c44de203b37c3ee9ab8d50dcfe025d7757fb7097c61156
SHA512:	fea0a97960ab293751f8afdac85fe1b39fcac247ad0e8baad2287e1a6cf177806644960070bdec91b5e9875d677f6596b9c592cf2471eda2bcef40311702e499
SSDEEP:	49152:TVTBGQcbvUDNbQ9jyA/gZd0x0Oj1o08pTdJG0K5:TVwQWvUDNbQ92AoZd0x0ORo
TLSH:	E0756B32A745A462E4A301B031AEFBB994A53D342751C4C7FBC06E6B77F56C22174E2B
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s

File Icon


Icon Hash:	4c4d96ec0ce6c600

Static PE Info

General

Entrypoint:	0x433d5d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6625EF5E [Mon Apr 22 05:02:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e2abfd7ba257adf7a15b19d55fcf4379

Entrypoint Preview

Instruction
call 00007F22BCE3D9A5h
jmp 00007F22BCE3D17Fh
cmp ecx, dword ptr [00582080h]
jne 00007F22BCE3D303h
ret
jmp 00007F22BCE3DAC5h
push ebp
mov ebp, esp
and dword ptr [00585560h], 00000000h
sub esp, 24h
or dword ptr [005820C4h], 01h
push 0000000Ah
call dword ptr [0055A0ECh]
test eax, eax
je 00007F22BCE3D4B2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-20h]
mov dword ptr [ebp-0Ch], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr [ebp-1Ch]
xor eax, 6C65746Eh
mov dword ptr [ebp-08h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
or eax, dword ptr [ebp-08h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007F22BCE3D345h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F22BCE3D325h
cmp eax, 00020660h
je 00007F22BCE3D31Eh
cmp eax, 00020670h
je 00007F22BCE3D317h
cmp eax, 00030650h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x180528	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x187000	0xafa0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x192000	0x9700	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x16e4c0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x16e500	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x162840	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15a000	0x3dc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x1803c4	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x158af8	0x158c00	096caf09bcd7657204f7281647f25f46	False	0.4725514412617839	data	6.524383214138694	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15a000	0x27b5a	0x27c00	f3caaa0faa68d0534b45b9387853ac8c	False	0.4351722189465409	data	5.301509174147987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x182000	0x4930	0x3200	016c6e583737ed5ccbe444835264d87c	False	0.153671875	DOS executable (block device driver)	3.9786896322347785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x187000	0xafa0	0xb000	8b8b7c1ae6164c3ae21fb08cef101ac3	False	0.11325905539772728	data	2.153408950986256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x192000	0x9700	0x9800	fa628a228d550942b95c34c4f5e3caac	False	0.5831620065789473	data	6.531418125993091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1875e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Russian	Russia	0.1320921985815603
RT_ICON	0x187a50	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600	Russian	Russia	0.10465116279069768
RT_ICON	0x188108	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Russian	Russia	0.08770491803278689
RT_ICON	0x188a90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Russian	Russia	0.05722326454033771
RT_ICON	0x189b38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Russian	Russia	0.03475103734439834
RT_ICON	0x18c0e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	Russian	Russia	0.02509447331128956
RT_ICON	0x190308	0x1aae	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia	0.39780380673499266
RT_GROUP_ICON	0x191db8	0x68	data	Russian	Russia	0.7596153846153846
RT_VERSION	0x187250	0x398	OpenPGP Public Key	Russian	Russia	0.42282608695652174
RT_MANIFEST	0x191e20	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	WaitForSingleObject, LocalAlloc, GetCurrentThreadId, GetModuleHandleA, GetLocaleInfoA, OpenProcess, CreateToolhelp32Snapshot, MultiByteToWideChar, Sleep, GetTempPathA, GetModuleHandleExA, GetTimeZoneInformation, GetTickCount64, CopyFileA, GetLastError, GetFileAttributesA, TzSpecificLocalTimeToSystemTime, CreateFileA, SetEvent, TerminateThread, LoadLibraryA, GetVersionExA, DeleteFileA, Process32Next, CloseHandle, GetSystemInfo, CreateThread, ResetEvent, GetWindowsDirectoryA, HeapAlloc, SetFileAttributesA, GetLocalTime, GetProcAddress, VirtualAllocEx, LocalFree, IsProcessorFeaturePresent, GetFileSize, RemoveDirectoryA, ReadProcessMemory, GetCurrentProcessId, GetProcessHeap, GlobalMemoryStatusEx, SetThreadExecutionState, FreeLibrary, WideCharToMultiByte, CreateRemoteThread, GetComputerNameExA, CreateDirectoryA, GetSystemTime, GetVolumeInformationA, CreateEventA, GetPrivateProfileStringA, IsWow64Process, IsDebuggerPresent, VirtualQueryEx, GetComputerNameA, SetUnhandledExceptionFilter, FindNextFileA, lstrcpynA, SetFilePointer, CreateFileW, AreFileApisANSI, EnterCriticalSection, GetFullPathNameW, GetDiskFreeSpaceW, LockFile, LeaveCriticalSection, InitializeCriticalSection, GetFullPathNameA, SetEndOfFile, GetTempPathW, GetFileAttributesW, FormatMessageW, GetDiskFreeSpaceA, DeleteFileW, UnlockFile, LockFileEx, DeleteCriticalSection, GetSystemTimeAsFileTime, FormatMessageA, QueryPerformanceCounter, GetTickCount, FlushFileBuffers, VirtualQuery, VirtualProtect, WriteConsoleW, HeapSize, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, CreateMutexA, FindClose, lstrlenA, InitializeCriticalSectionEx, GetProcessId, GetUserDefaultLocaleName, TerminateProcess, OutputDebugStringA, WriteFile, GetCurrentProcess, SetPriorityClass, SetLastError, ReadFile, HeapFree, FindFirstFileA, WriteProcessMemory, Process32First, GetPrivateProfileSectionNamesA, SetStdHandle, HeapReAlloc, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetFileSizeEx, GetConsoleOutputCP, ReadConsoleW, GetConsoleMode, GetStdHandle, GetModuleFileNameW, GetModuleHandleExW, ExitProcess, GetFileType, GetModuleFileNameA, SetFilePointerEx, LoadLibraryExW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, RaiseException, RtlUnwind, InitializeSListHead, GetStartupInfoW, UnhandledExceptionFilter, SleepConditionVariableSRW, WakeAllConditionVariable, GetStringTypeW, GetLocaleInfoEx, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, GetModuleHandleW, GetFileInformationByHandleEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, LCMapStringEx, EncodePointer, DecodePointer, CompareStringEx, GetCPInfo, LoadLibraryExA
USER32.dll	wsprintfA, GetSystemMetrics, MessageBoxA, GetWindowRect, EnumDisplayDevicesA, GetDC, GetKeyboardLayoutList, CharNextA, GetCursorPos, GetDesktopWindow, ReleaseDC
GDI32.dll	CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, DeleteObject, BitBlt
ADVAPI32.dll	RegQueryValueExA, LsaClose, LsaOpenPolicy, RegEnumKeyA, RegCloseKey, RegGetValueA, GetCurrentHwProfileA, LsaFreeMemory, CredEnumerateA, RegCreateKeyExA, GetUserNameA, RegSetValueExA, RegOpenKeyExA, LsaQueryInformationPolicy, RegEnumKeyExA
SHELL32.dll	ShellExecuteA, SHGetFolderPathA
ole32.dll	CoInitialize, CoCreateInstance, CoInitializeEx, CoUninitialize
WS2_32.dll	WSAStartup, socket, connect, recv, freeaddrinfo, setsockopt, WSAGetLastError, shutdown, WSACleanup, closesocket, getaddrinfo
CRYPT32.dll	CryptUnprotectData
SHLWAPI.dll	PathFindExtensionA
gdiplus.dll	GdipGetImageEncoders, GdipCloneImage, GdipAlloc, GdiplusShutdown, GdiplusStartup, GdipSaveImageToFile, GdipGetImageEncodersSize, GdipFree, GdipDisposeImage, GdipCreateBitmapFromHBITMAP
SETUPAPI.dll	SetupDiEnumDeviceInfo, SetupDiGetDeviceInterfaceDetailA, SetupDiGetClassDevsA, SetupDiEnumDeviceInterfaces
ntdll.dll	RtlUnicodeStringToAnsiString
RstrtMgr.DLL	RmStartSession, RmGetList, RmRegisterResources, RmShutdown, RmEndSession

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 3, 2024 06:07:02.238034010 CEST	49705	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:03.236388922 CEST	49705	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:05.252034903 CEST	49705	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:09.267770052 CEST	49705	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:17.267771959 CEST	49705	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:23.383326054 CEST	49713	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:24.392678976 CEST	49713	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:26.408281088 CEST	49713	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:30.423904896 CEST	49713	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:38.424065113 CEST	49713	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:44.554830074 CEST	49714	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:45.564652920 CEST	49714	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:47.564555883 CEST	49714	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:51.568836927 CEST	49714	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:07:59.564552069 CEST	49714	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:06.162511110 CEST	49716	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:07.173937082 CEST	49716	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:09.173957109 CEST	49716	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:13.173984051 CEST	49716	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:21.174048901 CEST	49716	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:27.351349115 CEST	49718	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:28.345860958 CEST	49718	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:30.345849037 CEST	49718	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:34.345841885 CEST	49718	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:42.361495018 CEST	49718	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:48.845076084 CEST	49719	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:49.845846891 CEST	49719	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:51.846060991 CEST	49719	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:08:55.845854044 CEST	49719	50500	192.168.2.5	87.120.84.5
May 3, 2024 06:09:03.845877886 CEST	49719	50500	192.168.2.5	87.120.84.5

Target ID:	0
Start time:	06:06:53
Start date:	03/05/2024
Path:	C:\Users\user\Desktop\ZtQY1K6aTi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZtQY1K6aTi.exe"
Imagebase:	0x1a0000
File size:	1'672'704 bytes
MD5 hash:	7F991BD7699126D6CCA12241DE7E7C44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.5%
Total number of Nodes:	769
Total number of Limit Nodes:	19

Executed Functions

Function 001FA082 Relevance: 56.5, APIs: 16, Strings: 16, Instructions: 502
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000C4EB0,00000000,00000000,00000000), ref: 001FA16B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 001FA172
Sleep.KERNELBASE(00000001), ref: 001FA22E
GetTempPathA.KERNEL32(000000FC,?,00000000,?,?,?,?,?,00000000), ref: 001FA2BA

Part of subcall function 00284050: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840AC
Part of subcall function 00284050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840B7

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 001FA4A5
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 001FA4CB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001FA4E2

Strings

(c2, xrefs: 001FA12B
hhc2, xrefs: 001FD7A1
t=2, xrefs: 001FA45D
jjj, xrefs: 001FA15C
t=2, xrefs: 001FA4AB
t=2, xrefs: 001FA494
t=2, xrefs: 001FA363
43t res tgy45yfhyrt, xrefs: 001FD74A
v<Ea, xrefs: 001FA3BB
hxc2, xrefs: 001FD7CD
v<Ea, xrefs: 001FA0A7
t=2, xrefs: 001FA444
2586, xrefs: 001FD851
h0u, xrefs: 001FD8BD
v<Ea, xrefs: 001FD8E9
hXb2, xrefs: 001FD78B

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Create$Directory$AttributesChangeCloseErrorFileFindLastNotificationPathSleepTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: (c2$2586$43t res tgy45yfhyrt$h0u$hXb2$hhc2$hxc2$jjj$t=2$t=2$t=2$t=2$t=2$v<Ea$v<Ea$v<Ea
API String ID: 2868636072-3305052068
Opcode ID: ca58999fecf37ec6be3a3115a0aeaa506136e26005fed9ae1b560eef9f77f686
Instruction ID: 87f49bc86eac743ddae5c8ff93e4cb68a4a4f84d23be57c63dd63bdb224edde3
Opcode Fuzzy Hash: ca58999fecf37ec6be3a3115a0aeaa506136e26005fed9ae1b560eef9f77f686
Instruction Fuzzy Hash: F422BBB0E00219DBCB15EFA8C856BEEBBB1AF55300F544198E9096B391DB346E44CF92

Uniqueness

Uniqueness Score: -1.00%

Function 002709B0 Relevance: 38.7, APIs: 19, Strings: 2, Instructions: 1989registrycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,61453C75,811C9DC5), ref: 00270A17
CoCreateInstance.OLE32(0030426C,00000000,00000001,0030B4FC,00000000), ref: 00270A51
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 00270CF5
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 00270EBB
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 0027118A
RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?,00000002), ref: 002712CE
RegOpenKeyExA.KERNELBASE(?,?,00000000,00020006,?), ref: 002714A7
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 0027168B
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 00271843
RegOpenKeyExA.KERNELBASE(?,?,00000000,00020006,?), ref: 002719EF
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 00271E87
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 00272058
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 00272228
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 002723F8
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 002725A8
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 00272758
RegSetValueExA.KERNELBASE(?,?,00000000,00000004,00000001,00000004), ref: 00272928
RegCloseKey.KERNELBASE(?), ref: 002729BE
CoUninitialize.OLE32(00000000), ref: 002729EA

Strings

v<Ea, xrefs: 0027263E
v<Ea, xrefs: 002727FA

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Value$Create$Open$CloseInitializeInstanceUninitialize
String ID: v<Ea$v<Ea
API String ID: 1434900157-2190929436
Opcode ID: 7307500e0c4c3a679a735b4157eaf05c66ed2a651ec19184f07a6d1eb23f25ff
Instruction ID: 2de7ba31bd82a7ffdf2cffa8d27071f0a50c675faeb8809da69ff40fbea3d068
Opcode Fuzzy Hash: 7307500e0c4c3a679a735b4157eaf05c66ed2a651ec19184f07a6d1eb23f25ff
Instruction Fuzzy Hash: 8C33C0B4D0525A8FCB19CF98C991AEEBBB1FF48310F244199D949BB350D7306A81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 001F9588 Relevance: 32.2, APIs: 9, Strings: 9, Instructions: 702
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 001F95EB
GetProcAddress.KERNEL32(00000000,00000000), ref: 001F96C8
MessageBoxA.USER32(00000000,00000000,00000000,00000014), ref: 001F992D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001F995F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001F99C8
GetProcessId.KERNELBASE(0000A9BE,00000000,00000000,00000003,00000000,00000000,00000000,00000003,00000000,00000000), ref: 001F9A26
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001F9E46
SetThreadExecutionState.KERNEL32(80000041), ref: 001F9EB0
SetThreadExecutionState.KERNEL32(80000001), ref: 001F9EBB

Strings

hb2, xrefs: 001F9E26
8e2, xrefs: 001F9765
8e2, xrefs: 001F973A
v<Ea, xrefs: 001F9DF5
Mr, xrefs: 001F98CD
v<Ea, xrefs: 001F97EF
8e2, xrefs: 001F9797
/*************/, xrefs: 001F9C21
0Dl, xrefs: 001F96EF

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ExecutionStateThread$AddressLibraryLoadMessageProcProcess
String ID: /*************/$0Dl$8e2$8e2$8e2$hb2$v<Ea$v<Ea$Mr
API String ID: 3049294613-24350104
Opcode ID: a06e8b99f8d0c1eb7a7b2ee1332eeeedc2b1e20a6fb4dcc0a038258be1f6e676
Instruction ID: 924fdd06020c5d8dedfc34a5d1b97a8fa2d98da051dfe91e7cc8a82062f14da5
Opcode Fuzzy Hash: a06e8b99f8d0c1eb7a7b2ee1332eeeedc2b1e20a6fb4dcc0a038258be1f6e676
Instruction Fuzzy Hash: 666247B4E002198FCB15DF98C995BAEBBB1EF48310F244199D909BB351DB70AE81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001FDA50 Relevance: 7.7, APIs: 5, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 001FDA63
GetCursorPos.USER32(?), ref: 001FDA69
Sleep.KERNELBASE(000003E9), ref: 001FDB18
GetCursorPos.USER32(?), ref: 001FDB1E
Sleep.KERNELBASE(00000001), ref: 001FDBCA

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Cursor$Sleep
String ID:
API String ID: 1847515627-0
Opcode ID: 7c4abb6c82b81b0509319ac4c6c0364c87b76071692872dc66002c24e38e995c
Instruction ID: 4b6047b712600c90a57992d19f2a058c2ece04be39a49c0010abd7aba1d6470a
Opcode Fuzzy Hash: 7c4abb6c82b81b0509319ac4c6c0364c87b76071692872dc66002c24e38e995c
Instruction Fuzzy Hash: B5519D35A04119CFCB18CF58D8D0EB9B7B2FF45754B2A4199DA45AB352D731ED06CB80

Uniqueness

Uniqueness Score: -1.00%

Function 001B8DC0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ebe4beb484f22a2609c0ccc7c45953d4e706c4f685085bf56cf8dbf2ee9ba3
Instruction ID: fb9668b5fac5ecaca169b5f9e0c8e482ecd827a21358d1f8e1293f4505b408cf
Opcode Fuzzy Hash: 06ebe4beb484f22a2609c0ccc7c45953d4e706c4f685085bf56cf8dbf2ee9ba3
Instruction Fuzzy Hash: C441B675A00518AFCB15DF6CD8809EEBBB9FF55360F50422AF928DB341DB319A50CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00264CE0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 351
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00264E8B
std::_Throw_Cpp_error.LIBCPMT ref: 00264E9C
setsockopt.WS2_32(FFFFFFFF,0000FFFF,00001006,?,00000008), ref: 00264F56
recv.WS2_32(?,00000004,00000002), ref: 00264F71
WSAGetLastError.WS2_32 ref: 00264F75
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00264FF3
recv.WS2_32(00000000,0000000C,00000008), ref: 00265014
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 002650B0
recv.WS2_32(00000000,?,00000008), ref: 002650CB

Strings

v<Ea, xrefs: 00264D8A
(c2, xrefs: 00264F05

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: recv$Cpp_errorThrow_setsockoptstd::_$ErrorLast
String ID: (c2$v<Ea
API String ID: 4262120464-1552078506
Opcode ID: 11f5f8c1f5d5aa027b01c86f1ce0dab49c26ca7e82250534641d2028d1faf4cf
Instruction ID: 10fb924f82e6c6b30ede95137aa153bf3e33ce43b1deaa9cc370b635d00fb913
Opcode Fuzzy Hash: 11f5f8c1f5d5aa027b01c86f1ce0dab49c26ca7e82250534641d2028d1faf4cf
Instruction Fuzzy Hash: 5BE1CBB0C04348DFEB11DFA8DC89BADBBB4FF15310F204259E854AB292D7B55985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00264EB0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(FFFFFFFF,0000FFFF,00001006,?,00000008), ref: 00264F56
recv.WS2_32(?,00000004,00000002), ref: 00264F71
WSAGetLastError.WS2_32 ref: 00264F75
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00264FF3
recv.WS2_32(00000000,0000000C,00000008), ref: 00265014
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 002650B0
recv.WS2_32(00000000,?,00000008), ref: 002650CB

Part of subcall function 00265940: WSAStartup.WS2_32 ref: 0026596A
Part of subcall function 00265940: getaddrinfo.WS2_32(?,?,?,00326328), ref: 002659EC
Part of subcall function 00265940: socket.WS2_32(?,?,?), ref: 00265A0D
Part of subcall function 00265940: connect.WS2_32(00000000,002F6B31,?), ref: 00265A21
Part of subcall function 00265940: closesocket.WS2_32(00000000), ref: 00265A2D
Part of subcall function 00265940: freeaddrinfo.WS2_32(?,?,?,?,00326328,?,?), ref: 00265A3A
Part of subcall function 00265940: WSACleanup.WS2_32 ref: 00265A40

recv.WS2_32(?,00000004,00000008), ref: 002651D3
__Xtime_get_ticks.LIBCPMT ref: 002651DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002651E8
Sleep.KERNEL32(00000001,00000000,?,00002710,00000000), ref: 00265261
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 00265269

Strings

(c2, xrefs: 00264F05

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID: (c2
API String ID: 4125349891-1327015854
Opcode ID: 82a28b7c25f56a87e4a045a4df7c52dd68d4dcdac12f976040c79280ddf46861
Instruction ID: 7296d4ef6043de0973da9cd3ced8ff04540d721c754c6b45158ed6e2fc7e419d
Opcode Fuzzy Hash: 82a28b7c25f56a87e4a045a4df7c52dd68d4dcdac12f976040c79280ddf46861
Instruction Fuzzy Hash: F0B1BBB0D10318DFEB21DFA8DC4ABADBBB5BF55310F204219E454AB2E2D7B05985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001E2CC3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E297C: CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 001E2999

GetLastError.KERNEL32 ref: 001E2DD7
__dosmaperr.LIBCMT ref: 001E2DDE
GetFileType.KERNELBASE(00000000), ref: 001E2DEA
GetLastError.KERNEL32 ref: 001E2DF4
__dosmaperr.LIBCMT ref: 001E2DFD
CloseHandle.KERNEL32(00000000), ref: 001E2E1D
CloseHandle.KERNEL32(?), ref: 001E2F6A
GetLastError.KERNEL32 ref: 001E2F9C
__dosmaperr.LIBCMT ref: 001E2FA3

Strings

H, xrefs: 001E2F28

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ac5b7c00e92bb00344f198e3120b7a4fadce35d211524d25e7f25f773c50c564
Instruction ID: 8a1056732baa0d8dc535bb2440da33c7a3c34cf471afb8cd8e2b4124af29088d
Opcode Fuzzy Hash: ac5b7c00e92bb00344f198e3120b7a4fadce35d211524d25e7f25f773c50c564
Instruction Fuzzy Hash: E2A16832A149949FCF19AF69DC61BBD3BB9AB16324F18015DF801EF3A1DB348906CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001E8900 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 001E8B81, 001E8B84

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: bbfe466201b8afee3eb381963ff292d11cdb36307a0b1718799d0f552a9f8495
Instruction ID: 75e2ac60a65e7570aaa4a58e3ee7d201195b3ee7b3fa8bffc0c8e658cfe6e660
Opcode Fuzzy Hash: bbfe466201b8afee3eb381963ff292d11cdb36307a0b1718799d0f552a9f8495
Instruction Fuzzy Hash: 87B139B0E04AC8AFDB11DF9AC881BBEBBB5BF59314F144158E408A7392DB709D41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00265940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0026596A
getaddrinfo.WS2_32(?,?,?,00326328), ref: 002659EC
socket.WS2_32(?,?,?), ref: 00265A0D
connect.WS2_32(00000000,002F6B31,?), ref: 00265A21
closesocket.WS2_32(00000000), ref: 00265A2D
freeaddrinfo.WS2_32(?,?,?,?,00326328,?,?), ref: 00265A3A
WSACleanup.WS2_32 ref: 00265A40
freeaddrinfo.WS2_32(?,?,?,?,00326328,?,?), ref: 00265A55

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 55a48f378cf99625307b610a43d224e381214a66ffbfe4ef6b149f0a43ac5632
Instruction ID: 23b8f9213e43600dbb0da717df4ebe04380271c0a6dc2d899c68189ff5ceeab1
Opcode Fuzzy Hash: 55a48f378cf99625307b610a43d224e381214a66ffbfe4ef6b149f0a43ac5632
Instruction Fuzzy Hash: 8A31B0725057119BD7209F68EC88A6ABBE5FF84774F10476DF8A9922E0D330AC54CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001D3C23 Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___scrt_release_startup_lock.LIBCMT ref: 001D3C73
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 001D3C87
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 001D3CAD
___scrt_uninitialize_crt.LIBCMT ref: 001D3CF0

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___scrt_release_startup_lock___scrt_uninitialize_crt
String ID:
API String ID: 3089971210-0
Opcode ID: 273f18b488bf60f3e0db17840ac3236cb01564e07e1e0e56932628cbaa4acc54
Instruction ID: 25524e1dc6f6621982aa016abaca55028d701e34d87ed438d973e82b46062e03
Opcode Fuzzy Hash: 273f18b488bf60f3e0db17840ac3236cb01564e07e1e0e56932628cbaa4acc54
Instruction Fuzzy Hash: D7214672110A51ABCB353B76AC0BA6E77959F62BA0F20002BF4613B3D2CB354F409612

Uniqueness

Uniqueness Score: -1.00%

Function 00273430 Relevance: 4.5, APIs: 3, Instructions: 28
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00273438
Sleep.KERNELBASE(000005DC), ref: 00273447
GetTickCount64.KERNEL32 ref: 0027344D

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Count64Tick$Sleep
String ID:
API String ID: 417912201-0
Opcode ID: e5c3f3a7802ea171017ea611e5c98e195bf89337cabcb91e514377260ffb4259
Instruction ID: f97ab6e9b80a0b674d1df551c38f65511f7a3099e8b17c74107971280c1b7c45
Opcode Fuzzy Hash: e5c3f3a7802ea171017ea611e5c98e195bf89337cabcb91e514377260ffb4259
Instruction Fuzzy Hash: C2E0CD7274020957DA116F7DBC8D639B798F7D5773B14427BED0CC2250DC228C26B566

Uniqueness

Uniqueness Score: -1.00%

Function 002846E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 00284833

Strings

v<Ea, xrefs: 00284785

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: __fread_nolock
String ID: v<Ea
API String ID: 2638373210-4124759590
Opcode ID: 8740f70b0e89d49ff8bf9258a0b705977b7f8cd8078387a5003930a8796f815c
Instruction ID: ebbab229dc83a4476ad5bfd6c55343632dca29f7c24f36e58c12fc4f9af0101c
Opcode Fuzzy Hash: 8740f70b0e89d49ff8bf9258a0b705977b7f8cd8078387a5003930a8796f815c
Instruction Fuzzy Hash: C35139B5D002489BCB10EF98D981BEEBBF4EF59710F244159E814BB381D771AE41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 001E8DEF Relevance: 3.1, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,001E8CD6,00000000,CF830579,00317178,0000000C,001E8D92,001DD06D,?), ref: 001E8E45
GetLastError.KERNEL32(?,001E8CD6,00000000,CF830579,00317178,0000000C,001E8D92,001DD06D,?), ref: 001E8E4F

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: d12629ed9da1f71814002f0234a8011bdeed74058da325262f018cc618750ff3
Instruction ID: 49b703d19bccbe7cd4c907fabaea17f8c1a46651e26cbe5c8c9ebc22b091a739
Opcode Fuzzy Hash: d12629ed9da1f71814002f0234a8011bdeed74058da325262f018cc618750ff3
Instruction Fuzzy Hash: 46118E33600EE05AC6262376BC49B7E67C98B96B38F29061DF81C971C2EF319C81C190

Uniqueness

Uniqueness Score: -1.00%

Function 001E250C Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00316E30,001D2B4E,00000002,001D2B4E,00000000,?,?,?,001E2616,00000000,?,001D2B4E,00000002,00316E30), ref: 001E2548
GetLastError.KERNEL32(001D2B4E,?,?,?,001E2616,00000000,?,001D2B4E,00000002,00316E30,00000000,001D2B4E,00000000,00316E30,0000000C,001DD60E), ref: 001E2555

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 23d08c79a6c3eca09a79e06155423c650215eca745b614a3f1b96a2ec7fbca62
Instruction ID: c2ecad8b1b2a22258830ee5d4ae52e4a60b3a5ea40154843f89080ea8b2e9165
Opcode Fuzzy Hash: 23d08c79a6c3eca09a79e06155423c650215eca745b614a3f1b96a2ec7fbca62
Instruction Fuzzy Hash: 9801C832610555AFCF098F56EC25DAE3B6DEF85330F240218F81197291EB71E941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001D8DF2 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8080f48df3aa79a4d5c03e33d0338291e66c0597f77789de7d520bf31942726
Instruction ID: 063816e701be10624dfa2071127851b5cad3942af035439b71efeb05ac885f82
Opcode Fuzzy Hash: e8080f48df3aa79a4d5c03e33d0338291e66c0597f77789de7d520bf31942726
Instruction Fuzzy Hash: AF51C471A00214AFDF14DF58C885AAD7BB6EF99324F29815AF8099B352D731DE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001EAC71 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 001EACAB

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 330aadf0607906bfff930cff6822c1ef3da1a21549bfdf57a53ff053c05d6370
Instruction ID: fb98106ffc6322b58b0b1a8d95cb4498343d2bb282a4fdd9d40b198dc6a6e48d
Opcode Fuzzy Hash: 330aadf0607906bfff930cff6822c1ef3da1a21549bfdf57a53ff053c05d6370
Instruction Fuzzy Hash: A9114571A0024AAFCB05DF59E941A9F7BF8EF48314F114069F809AB212D730EA11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 001D3BE1 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

___scrt_release_startup_lock.LIBCMT ref: 001D3C73

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ___scrt_release_startup_lock
String ID:
API String ID: 1340410277-0
Opcode ID: 01188f6d95d7aeff6a392f970752cd965f913b4d469be6fafe7d352c8d578577
Instruction ID: 93d12de82955b13ce1e40368e2d2a297c56a58ecb2d05d23f68462944947c7cf
Opcode Fuzzy Hash: 01188f6d95d7aeff6a392f970752cd965f913b4d469be6fafe7d352c8d578577
Instruction Fuzzy Hash: C201F231641664ABCB21B7F55C077EE66665F35718F14001BF0A07B383CB304B80D662

Uniqueness

Uniqueness Score: -1.00%

Function 001A32D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001A331F

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction ID: d087e1d161fdd4d9aa454510caadfc3fe8587af2e61bb15ca0562fd42ad40bb3
Opcode Fuzzy Hash: 88e0f75f83d5f9e69285ef2088a1dfdc1055322beeb667a90db4e8c6ac7f301f
Instruction Fuzzy Hash: DFF0B4761001049BCF146F64D4169E9B3E8EF253A1710097BF8ADC7612EB36DA40C791

Uniqueness

Uniqueness Score: -1.00%

Function 001EB086 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,001D4B2F,?,?,76A923A0,?,?,001A3522,?,?), ref: 001EB0B8

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca1c16a33b55099fd9cd37331fe4a0027fe622b2522fef4af20a1d9b19f002fc
Instruction ID: f8eed5354d59d990d8c07b69395634edd21c4a0d2e9296c1002a7858688f7462
Opcode Fuzzy Hash: ca1c16a33b55099fd9cd37331fe4a0027fe622b2522fef4af20a1d9b19f002fc
Instruction Fuzzy Hash: C9E06531108ED16BE63527679C45B5F3669AF413B0F150231FD65970E1DF61EC0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 001E297C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 001E2999

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 987b8ab738f2568e8b2f84dbc2a7ca97bb2103b6173919ce6320a31803b99a11
Instruction ID: 7c6d08c718e0431ed21dff6532349e5cb39921f2dc94293e1d7596be72b1c80b
Opcode Fuzzy Hash: 987b8ab738f2568e8b2f84dbc2a7ca97bb2103b6173919ce6320a31803b99a11
Instruction Fuzzy Hash: 76D06C3200010DBFDF028F84EC0AEDA3BAAFB48754F014010BA1C56120C732E821EB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0023CBF0 Relevance: 172.9, APIs: 6, Strings: 91, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0023CD44
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0023CE42
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0023D035
CreateDirectoryA.KERNEL32(?,00000000), ref: 0023F796

Part of subcall function 00284050: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840AC
Part of subcall function 00284050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840B7

CreateDirectoryA.KERNEL32(?,00000000), ref: 0023FA7D
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00240FAE

Strings

v<Ea, xrefs: 0023FABC
v<Ea, xrefs: 0023F8A7
v<Ea, xrefs: 0023E85C
cannot use operator[] with a string argument with , xrefs: 00241091, 002410E6
v<Ea, xrefs: 0023D3E5
v<Ea, xrefs: 0023DED5
v<Ea, xrefs: 0023F38D
v<Ea, xrefs: 00240403
v<Ea, xrefs: 0023FC7B
v<Ea, xrefs: 0023FCCD
v<Ea, xrefs: 00240943
v<Ea, xrefs: 0023DC4E
v<Ea, xrefs: 0023FC02
v<Ea, xrefs: 0023EBE6
v<Ea, xrefs: 00240560
v<Ea, xrefs: 0023DA28
v<Ea, xrefs: 0023DC9A
v<Ea, xrefs: 0023F3D9
XO4, xrefs: 0023D399
v<Ea, xrefs: 0023FFD0
v<Ea, xrefs: 0023CECF
v<Ea, xrefs: 0023EC6F
v<Ea, xrefs: 0023CE7D
v<Ea, xrefs: 0023D9DC
v<Ea, xrefs: 00240B48
v<Ea, xrefs: 00240654
v<Ea, xrefs: 0023D067
v<Ea, xrefs: 0023F27C
v<Ea, xrefs: 0023D68A
v<Ea, xrefs: 0023D2A8
v<Ea, xrefs: 0023FEC5
v<Ea, xrefs: 0023CFD8
v<Ea, xrefs: 0023DE89
v<Ea, xrefs: 00240B94
v<Ea, xrefs: 0023FD8D
v<Ea, xrefs: 0023E938
v<Ea, xrefs: 002407E4
v<Ea, xrefs: 002401E1
v<Ea, xrefs: 0023FBB6
v<Ea, xrefs: 0023E80A
v<Ea, xrefs: 00240022
v<Ea, xrefs: 0023CF85
v<Ea, xrefs: 0023E262
v<Ea, xrefs: 0023FE73
v<Ea, xrefs: 002402A6
v<Ea, xrefs: 0023EB9A
v<Ea, xrefs: 0023F0D8
v<Ea, xrefs: 0023FB0E
v<Ea, xrefs: 0023F5C2
cannot use push_back() with , xrefs: 00241038
v<Ea, xrefs: 0023F03B
v<Ea, xrefs: 002403B1
v<Ea, xrefs: 00240D24
v<Ea, xrefs: 0023E61F
v<Ea, xrefs: 0023D2FA
v<Ea, xrefs: 0023EDA4
v<Ea, xrefs: 0023F972
v<Ea, xrefs: 0023ED58
v<Ea, xrefs: 0023D0B3
v<Ea, xrefs: 00240C5F
v<Ea, xrefs: 0023EB03
v<Ea, xrefs: 0023F12A
v<Ea, xrefs: 0023F4C8
v<Ea, xrefs: 0023CDC3
v<Ea, xrefs: 00240116
v<Ea, xrefs: 0023E05E
v<Ea, xrefs: 002402F2
v<Ea, xrefs: 0023EFE9
v<Ea, xrefs: 0023F476
v<Ea, xrefs: 0023E0AA
v<Ea, xrefs: 0024071F
v<Ea, xrefs: 0023FDDF
v<Ea, xrefs: 0023F6FC
v<Ea, xrefs: 0023F85B
v<Ea, xrefs: 0023F920
v<Ea, xrefs: 00240830
v<Ea, xrefs: 0024018F
v<Ea, xrefs: 00240E83
v<Ea, xrefs: 0023E6FF
v<Ea, xrefs: 0023E6AD
v<Ea, xrefs: 0023D21C
v<Ea, xrefs: 0023F576
v<Ea, xrefs: 0023E5CD
v<Ea, xrefs: 00240AA0
v<Ea, xrefs: 0023ECC1
v<Ea, xrefs: 0023E216
v<Ea, xrefs: 00240608
v<Ea, xrefs: 0023EA1E
v<Ea, xrefs: 002400CA
v<Ea, xrefs: 0023EEDE
v<Ea, xrefs: 00240D70

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: XO4$cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 2833034228-769388876
Opcode ID: f52f8c2eaafdae72fc268df55ba6506d5cc8bddc7736d6d50beec6e3a52caff3
Instruction ID: c17e9149a90dd02f0565d3c83501c9b1d5a4dda22922155b333f55eae922283e
Opcode Fuzzy Hash: f52f8c2eaafdae72fc268df55ba6506d5cc8bddc7736d6d50beec6e3a52caff3
Instruction Fuzzy Hash: 1393BBB4D152A98ADB65CF28C995BEDBBB1AF59304F0082DAD84DB7241DB702F84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 002509B0 Relevance: 123.0, APIs: 2, Strings: 66, Instructions: 3964COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 00250B13

Part of subcall function 002633B0: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 002634EF

Strings

v<Ea, xrefs: 00253DBF
cannot use operator[] with a string argument with , xrefs: 002557A4, 0025583D
v<Ea, xrefs: 00253D73
v<Ea, xrefs: 00254019
v<Ea, xrefs: 00250D48
v<Ea, xrefs: 00254B47
v<Ea, xrefs: 002521A1
v<Ea, xrefs: 00250E27
v<Ea, xrefs: 00251819
v<Ea, xrefs: 002541E6
v<Ea, xrefs: 00252A0E
v<Ea, xrefs: 002535B1
v<Ea, xrefs: 00254232
v<Ea, xrefs: 0025196F
v<Ea, xrefs: 00251E9F
v<Ea, xrefs: 00252F8C
v<Ea, xrefs: 00251A50
v<Ea, xrefs: 00252780
v<Ea, xrefs: 00250C48
v<Ea, xrefs: 00251FB5
v<Ea, xrefs: 00252EF1
v<Ea, xrefs: 0025264E
v<Ea, xrefs: 00252859
v<Ea, xrefs: 00251A9C
v<Ea, xrefs: 00250CFC
v<Ea, xrefs: 0025311A
v<Ea, xrefs: 00254895
v<Ea, xrefs: 00253996
v<Ea, xrefs: 002539E2
v<Ea, xrefs: 00252C1D
v<Ea, xrefs: 0025272E
v<Ea, xrefs: 002555DA
v<Ea, xrefs: 00254F42
v<Ea, xrefs: 002523E1
v<Ea, xrefs: 00253BEB
v<Ea, xrefs: 00250BFC
v<Ea, xrefs: 002553D1
cannot use push_back() with , xrefs: 00255646, 002557DE
v<Ea, xrefs: 002526A0
v<Ea, xrefs: 00254EF6
v<Ea, xrefs: 002528E3
v<Ea, xrefs: 002522AF
v<Ea, xrefs: 00254B99
v<Ea, xrefs: 002530CE
v<Ea, xrefs: 00251D43
v<Ea, xrefs: 00255385
v<Ea, xrefs: 00252935
v<Ea, xrefs: 00252EA5
v<Ea, xrefs: 00253B9F
v<Ea, xrefs: 00254C76
v<Ea, xrefs: 002543B6
v<Ea, xrefs: 00254849
v<Ea, xrefs: 0025191D
v<Ea, xrefs: 00254402
v<Ea, xrefs: 00252FDE
v<Ea, xrefs: 00255146
v<Ea, xrefs: 00251F69
v<Ea, xrefs: 00254065
v<Ea, xrefs: 00252C69
v<Ea, xrefs: 00252395
v<Ea, xrefs: 00250DD5
v<Ea, xrefs: 00254C24
v<Ea, xrefs: 0025465C
v<Ea, xrefs: 00255588
v<Ea, xrefs: 002550FA
v<Ea, xrefs: 0025225D

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 2195519125-3470562539
Opcode ID: b6c77dec6ee014f72675538662d70b19720f4a46754904d9c734e149b2fa3b1a
Instruction ID: 78ad82a378d62a0a00dc7c4528d2afae726a31c29be5f49b23038b64ea8d9bec
Opcode Fuzzy Hash: b6c77dec6ee014f72675538662d70b19720f4a46754904d9c734e149b2fa3b1a
Instruction Fuzzy Hash: FDB31FB4D152A98BDB65CF68C994BEDBBB0AF59304F1082D9D848B7241DB702F84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001FA61F Relevance: 96.4, APIs: 19, Strings: 35, Instructions: 1929sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 001FA69D
GetLastError.KERNEL32 ref: 001FA6B2
Sleep.KERNEL32(00000529), ref: 001FA6D5
Sleep.KERNEL32(0000002F), ref: 001FA756
shutdown.WS2_32(00000002), ref: 001FA774
closesocket.WS2_32 ref: 001FA780
WSACleanup.WS2_32 ref: 001FA786
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001FA844
Sleep.KERNEL32(00000000), ref: 001FAAF1
GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00302AF8,00000001), ref: 001FB082
GetProcAddress.KERNEL32(00000000,00000000), ref: 001FB08A
GetCurrentProcess.KERNEL32(00000000), ref: 001FB098

Part of subcall function 002649C0: Sleep.KERNEL32(00000065), ref: 00264A37

OutputDebugStringA.KERNEL32(Dk43l_dwmk438*,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 001FB0AC
OutputDebugStringA.KERNEL32(ewetwertyer eytdryrtdy,00000000,00000000), ref: 001FB1A3
OutputDebugStringA.KERNEL32(td ydrthrhfty,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001FB463
OutputDebugStringA.KERNEL32(er ert 346 34634 6ch,003029DA,?,?), ref: 001FC55C
CreateThread.KERNEL32(00000000,00000000,0020A8A0,00000000,00000000,00000000), ref: 001FC57D
CreateThread.KERNEL32(00000000,00000000,00209F60,00000000,00000000,00000000), ref: 001FC591
WaitForSingleObject.KERNEL32(?,00000000,?,00000000,00000000,?,?), ref: 001FC811

Strings

jjj, xrefs: 001FC56E
ewetwertyer eytdryrtdy, xrefs: 001FB199
v<Ea, xrefs: 001FC055
\=2, xrefs: 001FAB9F
\=2, xrefs: 001FAA8F
v<Ea, xrefs: 001FBD1B
ntdll.dll, xrefs: 001FB07B
v<Ea, xrefs: 001FB9AC
h-0, xrefs: 001FAAFC
jjj, xrefs: 001FC57F
v<Ea, xrefs: 001FBB3B
4, xrefs: 001FC67C
v<Ea, xrefs: 001FB897
hc2, xrefs: 001FC790
v<Ea, xrefs: 001FC63B
v<Ea, xrefs: 001FAF59
2586, xrefs: 001FA65D, 001FA93B
v<Ea, xrefs: 001FC49B
v<Ea, xrefs: 001FC30C
v<Ea, xrefs: 001FBFD7
v<Ea, xrefs: 001FBA46
\=2, xrefs: 001FABE6
v<Ea, xrefs: 001FBE42
v<Ea, xrefs: 001FBED6
\=2, xrefs: 001FAB83
td ydrthrhfty, xrefs: 001FB459
Dk43l_dwmk438*, xrefs: 001FB0A7
hc2, xrefs: 001FC667
v<Ea, xrefs: 001FBBAD
\=2, xrefs: 001FAA4D
v<Ea, xrefs: 001FC1C3
\=2, xrefs: 001FAB01
v<Ea, xrefs: 001FC6C1
v<Ea, xrefs: 001FB729
er ert 346 34634 6ch, xrefs: 001FC557

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: DebugOutputSleepString$Create$Thread$AddressCleanupCurrentErrorHandleLastModuleMutexObjectProcProcessSingleUnothrow_t@std@@@Wait__ehfuncinfo$??2@closesocketshutdown
String ID: 2586$4$Dk43l_dwmk438*$\=2$\=2$\=2$\=2$\=2$\=2$er ert 346 34634 6ch$ewetwertyer eytdryrtdy$hc2$hc2$h-0$jjj$jjj$ntdll.dll$td ydrthrhfty$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 3508711938-3638927473
Opcode ID: bf20c04780d26724534bc8f58ba1d62a05518e35c0a4073354fdf26d2284536f
Instruction ID: df4885eeb5bf2a73bcdb4c3c1a67232b1d660b0a757975c7afeb0b0cdbcc1233
Opcode Fuzzy Hash: bf20c04780d26724534bc8f58ba1d62a05518e35c0a4073354fdf26d2284536f
Instruction Fuzzy Hash: 342310B4D052698BCB25DFA8C995BEEBBB4AF19300F1081D9D519B7381DB702B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0022E120 Relevance: 78.6, APIs: 13, Strings: 31, Instructions: 1609registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0022E35B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0022E38F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,?,?), ref: 0022E3B5
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,?), ref: 0022E54C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,00000104), ref: 0022E7D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,00000104), ref: 0022E8C0
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 0022EA01
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,00000200), ref: 0022EAEB
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,00000200), ref: 0022EBD5
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 0022ECBF
RegCloseKey.ADVAPI32(?), ref: 0022FDBB
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 0022FDF1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0022FE05

Part of subcall function 001D51EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,76A923A0,?,001D1CF9,?,003169D8,76A923A0,?,76A923A0,-00326880), ref: 001D524B

Strings

v<Ea, xrefs: 0022EE87
cannot use operator[] with a string argument with , xrefs: 0022FEBE, 0022FF13
v<Ea, xrefs: 0022E76E
cannot use push_back() with , xrefs: 0022FE65
v<Ea, xrefs: 0022F0C7
v<Ea, xrefs: 0022EA89
v<Ea, xrefs: 0022FB86
v<Ea, xrefs: 0022ED1B
v<Ea, xrefs: 0022E48F
v<Ea, xrefs: 0022F73F
v<Ea, xrefs: 0022E61C
v<Ea, xrefs: 0022F07B
v<Ea, xrefs: 0022EE3B
v<Ea, xrefs: 0022EFA7
v<Ea, xrefs: 0022E4E7
v<Ea, xrefs: 0022F4F0
v<Ea, xrefs: 0022E5D0
v<Ea, xrefs: 0022E99C
v<Ea, xrefs: 0022FB3A
v<Ea, xrefs: 0022F9BA
v<Ea, xrefs: 0022F53C
v<Ea, xrefs: 0022F28C
v<Ea, xrefs: 0022E85B
v<Ea, xrefs: 0022ED67
8d2, xrefs: 0022E26C
v<Ea, xrefs: 0022EC5D
v<Ea, xrefs: 0022F78B
v<Ea, xrefs: 0022EF5B
v<Ea, xrefs: 0022EB73
v<Ea, xrefs: 0022F2D8
v<Ea, xrefs: 0022F96E

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen$ExceptionRaise
String ID: 8d2$cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 2021570681-3941151722
Opcode ID: 0b270b2c43711ae6ae1d71bedb9cd91d36a7b0c129988bcc40f1b0faa322b73f
Instruction ID: d56b957fdcea276c614e31bd05e0cd5149992a0be3868dd4cd82fd2fd91cbbf9
Opcode Fuzzy Hash: 0b270b2c43711ae6ae1d71bedb9cd91d36a7b0c129988bcc40f1b0faa322b73f
Instruction Fuzzy Hash: E10301B4D042699BDB65CF68CD84BEDBBB4AF59304F1082DAE849B7241DB706B84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002361D0 Relevance: 75.6, APIs: 4, Strings: 38, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 00236324
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00236422
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00236618
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00238931

Strings

v<Ea, xrefs: 00238359
v<Ea, xrefs: 0023681C
v<Ea, xrefs: 00236CB4
cannot use operator[] with a string argument with , xrefs: 002389A3, 00238A39
v<Ea, xrefs: 002377EF
v<Ea, xrefs: 00236868
v1, xrefs: 002361DD
v<Ea, xrefs: 00238793
v<Ea, xrefs: 00238547
v<Ea, xrefs: 00236A5C
v<Ea, xrefs: 00236D92
v<Ea, xrefs: 002383A5
cannot use push_back() with , xrefs: 00238851, 002389DA
v<Ea, xrefs: 0023664A
v<Ea, xrefs: 00236AA8
v<Ea, xrefs: 002387E5
v<Ea, xrefs: 00237417
v<Ea, xrefs: 002365BB
v<Ea, xrefs: 0023761D
v<Ea, xrefs: 00237E92
v<Ea, xrefs: 00236D40
v<Ea, xrefs: 00237CC2
v<Ea, xrefs: 00236568
v<Ea, xrefs: 00237C76
v<Ea, xrefs: 002364B2
v<Ea, xrefs: 002377A3
v<Ea, xrefs: 00237AA9
v<Ea, xrefs: 00237AF5
v<Ea, xrefs: 002370CC
v<Ea, xrefs: 002373CB
v<Ea, xrefs: 002375D1
v<Ea, xrefs: 00236460
v<Ea, xrefs: 002363A3
v<Ea, xrefs: 00237E46
v<Ea, xrefs: 00238151
v<Ea, xrefs: 00236696
v<Ea, xrefs: 00238593
XO4, xrefs: 00236C62

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: XO4$cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v1
API String ID: 1311570089-1867026944
Opcode ID: cb3367ef01be13cc712656bc55abd27d907469451c2bc9a3509c3b5fe5482d6c
Instruction ID: 3a7bd2ba57e275fca2c8bac22b78addf40bfd010b6f997d2fb6b16a4dedefd4c
Opcode Fuzzy Hash: cb3367ef01be13cc712656bc55abd27d907469451c2bc9a3509c3b5fe5482d6c
Instruction Fuzzy Hash: 824321B0D152698BDB65CF28C884BEDBBB5AF59304F1482D9E448B7242DB706F84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00268E70 Relevance: 74.8, APIs: 1, Strings: 40, Instructions: 3030COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0026C61E

Strings

v<Ea, xrefs: 002696AD
v<Ea, xrefs: 002693B3
cannot use operator[] with a string argument with , xrefs: 0026C0DC, 0026C10D, 0026C1D4, 0026C205, 0026C56A
v<Ea, xrefs: 0026AF31
v<Ea, xrefs: 0026B135
v<Ea, xrefs: 0026A3FD
type must be object, but is , xrefs: 0026C29A
v<Ea, xrefs: 002699A1
v<Ea, xrefs: 0026BA01
v<Ea, xrefs: 0026B0E9
v<Ea, xrefs: 0026A321
Pe2, xrefs: 00268F7A
v<Ea, xrefs: 0026AF7D
v<Ea, xrefs: 0026920D
v<Ea, xrefs: 00268FF0
v<Ea, xrefs: 0026A9C4
v<Ea, xrefs: 0026A2CF
v<Ea, xrefs: 0026B9B5
v<Ea, xrefs: 0026A824
v<Ea, xrefs: 0026BBBA
v<Ea, xrefs: 0026A4AC
v<Ea, xrefs: 00269DDE
v<Ea, xrefs: 00269D8C
v<Ea, xrefs: 00269790
cannot get value, xrefs: 0026B909, 0026C127, 0026C18B, 0026C21F, 0026C2D6, 0026C3BD, 0026C3F6, 0026C42F, 0026C4A1, 0026C5A7
v<Ea, xrefs: 00269D02
v<Ea, xrefs: 00269744
v<Ea, xrefs: 0026A3AB
v<Ea, xrefs: 0026A870
v<Ea, xrefs: 0026994F
v<Ea, xrefs: 00269559
Pe2, xrefs: 00268EC6
v<Ea, xrefs: 0026BB6E
v<Ea, xrefs: 002698A4
cannot compare iterators of different containers, xrefs: 0026C159, 0026C251, 0026C308, 0026C468, 0026C4DA, 0026C513, 0026C5E0
v<Ea, xrefs: 0026AA16
v<Ea, xrefs: 0026A4FE
v<Ea, xrefs: 00269E8D
v<Ea, xrefs: 00269EDF
v<Ea, xrefs: 00269CB0

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: Pe2$Pe2$cannot compare iterators of different containers$cannot get value$cannot use operator[] with a string argument with $type must be object, but is $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 118556049-1021030959
Opcode ID: 148b7cc3828a81be9968974b1b18af9d9508d9f34ab3379740832fdb5d780df8
Instruction ID: ce1a2bbe812d36a3741fe2c6fc2d85f43c5afaa8fcbd357c927a5f3829d00740
Opcode Fuzzy Hash: 148b7cc3828a81be9968974b1b18af9d9508d9f34ab3379740832fdb5d780df8
Instruction Fuzzy Hash: BC7331B0D142698BDB25DF68C894BEDBBB4AF59300F1481D9E449A7282DB716FC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 002749B0 Relevance: 64.1, APIs: 31, Strings: 2, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,002F80C7,000000FF), ref: 00274A1C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00274A43
CreateDirectoryA.KERNEL32(?,00000000), ref: 00274D09
CreateDirectoryA.KERNEL32(?,00000000), ref: 0027506B
CreateDirectoryA.KERNEL32(?,00000000), ref: 00275712
CreateDirectoryA.KERNEL32(?,00000000), ref: 002759D3
CreateDirectoryA.KERNEL32(?,00000000), ref: 002761A7
CreateDirectoryA.KERNEL32(?,00000000), ref: 0027658D
CreateDirectoryA.KERNEL32(?,00000000), ref: 00276D42
CreateDirectoryA.KERNEL32(?,00000000), ref: 00277003
CreateDirectoryA.KERNEL32(?,00000000), ref: 002776CE
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0027779F
CreateDirectoryA.KERNEL32(?,00000000), ref: 00277AC2
CreateDirectoryA.KERNEL32(?,00000000), ref: 00277E2D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00277EFE
CreateDirectoryA.KERNEL32(?,00000000), ref: 002781E9
CreateDirectoryA.KERNEL32(?,00000000), ref: 00278479
CreateDirectoryA.KERNEL32(?,00000000), ref: 0027862C
CreateDirectoryA.KERNEL32(?,00000000), ref: 00278906
CreateDirectoryA.KERNEL32(?,00000000), ref: 00278CEC
CreateDirectoryA.KERNEL32(?,00000000), ref: 002790A1
CreateDirectoryA.KERNEL32(?,00000000), ref: 00279254
CreateDirectoryA.KERNEL32(?,00000000), ref: 0027952E
CreateDirectoryA.KERNEL32(?,00000000), ref: 00279914
CreateDirectoryA.KERNEL32(?,00000000), ref: 00277363

Part of subcall function 0027D2B0: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0027D906
Part of subcall function 0027D2B0: GetLastError.KERNEL32 ref: 0027D950

CreateDirectoryA.KERNEL32(?,00000000), ref: 002769F8

Part of subcall function 0027D2B0: FindNextFileA.KERNEL32(00000000,?), ref: 0027D91C
Part of subcall function 0027D2B0: FindClose.KERNEL32(00000000), ref: 0027D92C
Part of subcall function 0027D2B0: GetLastError.KERNEL32 ref: 0027D932

CreateDirectoryA.KERNEL32(?,00000000), ref: 00275D1A

Part of subcall function 0027D2B0: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00302B0C,00000001,0000002E,0000002F,?,002F83D1,001B2233,002F83D1), ref: 0027D78B

CreateDirectoryA.KERNEL32(?,00000000), ref: 00275ECD
CreateDirectoryA.KERNEL32(?,00000000), ref: 002753CB

Part of subcall function 0027D2B0: FindFirstFileA.KERNEL32(00000000,?), ref: 0027D4BB

Part of subcall function 00284050: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840AC
Part of subcall function 00284050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840B7

Part of subcall function 00284050: std::_Throw_Cpp_error.LIBCPMT ref: 002840FF
Part of subcall function 00284050: std::_Throw_Cpp_error.LIBCPMT ref: 00284110

CreateDirectoryA.KERNEL32(?,00000000), ref: 00279D4C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 00279EA3

Part of subcall function 0027B7E0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0027B84D

Strings

v<Ea, xrefs: 0027B484
v<Ea, xrefs: 0027A158

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: CreateDirectory$File$Copy$ErrorFindFolderLastPath$Cpp_errorThrow_std::_$AttributesCloseFirstNext
String ID: v<Ea$v<Ea
API String ID: 901091077-2190929436
Opcode ID: 40d2a4cf63102bde02cdc62dbf30a860a0c94a7ee4b516f4e038770c7bdd3b84
Instruction ID: d1ab158f154bd6b3f8bef25232c55fe7e57d54417c6cc452c37560d42d828d32
Opcode Fuzzy Hash: 40d2a4cf63102bde02cdc62dbf30a860a0c94a7ee4b516f4e038770c7bdd3b84
Instruction Fuzzy Hash: 19F303B4D1525E8BDB15DFA8C981AEEBBB0AF19300F144199D949B7341E7702F84CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00238A80 Relevance: 59.6, APIs: 4, Strings: 29, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 00238C78
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00238D85
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00238F78
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0023AD4D

Strings

v<Ea, xrefs: 00238FAA
cannot use operator[] with a string argument with , xrefs: 0023ADBC, 0023AE73
cannot use push_back() with , xrefs: 0023AC0A, 0023AE0C
v<Ea, xrefs: 002396A0
v<Ea, xrefs: 0023A209
v<Ea, xrefs: 00238E12
v<Ea, xrefs: 002393BC
v<Ea, xrefs: 0023AB1F
v<Ea, xrefs: 0023A556
v<Ea, xrefs: 00239CFA
v<Ea, xrefs: 0023A34F
v<Ea, xrefs: 0023A255
v<Ea, xrefs: 00239A2C
v<Ea, xrefs: 00238FF6
v<Ea, xrefs: 002391C8
v<Ea, xrefs: 0023A80F
v<Ea, xrefs: 0023A7C3
v<Ea, xrefs: 0023A303
v<Ea, xrefs: 00238DC0
v<Ea, xrefs: 0023917C
v<Ea, xrefs: 00239CAB
v<Ea, xrefs: 00239EA9
v<Ea, xrefs: 00239408
v<Ea, xrefs: 00238CFA
v<Ea, xrefs: 00238F1B
v<Ea, xrefs: 00239614
v<Ea, xrefs: 00238EC8
v<Ea, xrefs: 002396F2
v<Ea, xrefs: 0023A5A2

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 1311570089-2661975114
Opcode ID: 5e0a40dd8130dbce34c36c6f28a225539801c5a051d3227dad8c3572be688fc4
Instruction ID: 46eee92f569023076218461838bda6973846f6ae5e6b5f89ea1d1fa94a80e4fd
Opcode Fuzzy Hash: 5e0a40dd8130dbce34c36c6f28a225539801c5a051d3227dad8c3572be688fc4
Instruction Fuzzy Hash: ED2301B4D142698BDB65CF28C8847EDBBB5AF59304F1082D9E849B7281EB706F84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0024E9E0 Relevance: 42.0, APIs: 2, Strings: 21, Instructions: 1700COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 0024EB4E

Part of subcall function 002633B0: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 002634EF

Strings

v<Ea, xrefs: 0024F4C4
v<Ea, xrefs: 00250086
v<Ea, xrefs: 0024EAC8
cannot use operator[] with a string argument with , xrefs: 00250872, 002508B0, 00250965
R~u, xrefs: 0024F86A
v<Ea, xrefs: 0024F168
v<Ea, xrefs: 0024FE1A
cannot use push_back() with , xrefs: 00250717, 00250908
v<Ea, xrefs: 0024F19C
v<Ea, xrefs: 0024EC6A
v<Ea, xrefs: 0025031C
v<Ea, xrefs: 0024F9BE
v<Ea, xrefs: 002500D2
v<Ea, xrefs: 0024EC36
v<Ea, xrefs: 0025056B
v<Ea, xrefs: 0024F510
v<Ea, xrefs: 00250368
v<Ea, xrefs: 0024F38F
v<Ea, xrefs: 002505B7
v<Ea, xrefs: 0024FE66
v<Ea, xrefs: 0024F3E1

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: R~u$cannot use operator[] with a string argument with $cannot use push_back() with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 2195519125-4272359862
Opcode ID: e09c53ffc8f18ebca95ab999a4cc62e29f002833876b30f8b0309fe8e0e570c6
Instruction ID: 9f5604a63a9ba0489dc5b2aeb72dd1cc52dbdcc635cbf4b98cb850cbdee41d3d
Opcode Fuzzy Hash: e09c53ffc8f18ebca95ab999a4cc62e29f002833876b30f8b0309fe8e0e570c6
Instruction Fuzzy Hash: 721322B0D102698BDB25CF68C994BEDBBB5AF59304F1082D9D849B7282DB706F84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00222100 Relevance: 41.7, APIs: 8, Strings: 15, Instructions: 1485COMMON

Download Yara Rule

Strings

v<Ea, xrefs: 002222BE
v<Ea, xrefs: 002223D3
v<Ea, xrefs: 002230E0
v<Ea, xrefs: 0022241F
v<Ea, xrefs: 002233E9
v<Ea, xrefs: 00222817
v<Ea, xrefs: 00223435
v<Ea, xrefs: 002229AF
v<Ea, xrefs: 00222310
h2, xrefs: 00223819
v<Ea, xrefs: 00222B9C
v<Ea, xrefs: 00222963
v<Ea, xrefs: 0022312C
v<Ea, xrefs: 00222BE8
v<Ea, xrefs: 002227CB

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$h2
API String ID: 1799206407-2909964905
Opcode ID: d3454b7b7063239d5e425194c11d8a182cce5d2dd606a51f5ae28f0963c826b1
Instruction ID: fa031cf8dda0a35dea0afd15843b90f935cb79d80a376406f36b14bf237a7675
Opcode Fuzzy Hash: d3454b7b7063239d5e425194c11d8a182cce5d2dd606a51f5ae28f0963c826b1
Instruction Fuzzy Hash: 51E2BA70D10269DBCB25CF68C884BEDBBB4AF15300F1482D9D859AB282DB749F85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00284B90 Relevance: 40.0, APIs: 5, Strings: 17, Instructions: 1467processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00284CF2
Process32First.KERNEL32(00000000,00000128), ref: 00284D02
Process32Next.KERNEL32(00000000,00000128), ref: 00284D1F
Process32Next.KERNEL32(00000000,00000128), ref: 00284FB6
CloseHandle.KERNEL32(00000000), ref: 00284FC2

Strings

v<Ea, xrefs: 00285F77
v<Ea, xrefs: 00285E92
v<Ea, xrefs: 00285EDE
v<Ea, xrefs: 00284E61
v<Ea, xrefs: 00284EDA
v<Ea, xrefs: 00285058
tF2, xrefs: 00284C8A
v<Ea, xrefs: 00284D50
tF2, xrefs: 0028641D
v<Ea, xrefs: 00286087
v<Ea, xrefs: 00284E27
v<Ea, xrefs: 00286053
v<Ea, xrefs: 00284DA2
exists, xrefs: 00286364, 00286458
v<Ea, xrefs: 0028535F
v<Ea, xrefs: 00285FAB
v<Ea, xrefs: 00285313

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Process32$Next$CloseCreateFirstHandleSnapshotToolhelp32
String ID: exists$tF2$tF2$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 2284531361-3839386153
Opcode ID: af9e598a829e3545b4220c00184ee4b0e2383f523260c613b0b89b5e77c0e913
Instruction ID: e6f90c157631ccf8ab076bd06e7419edffde599eeaa689a3fe6497768f1a84d5
Opcode Fuzzy Hash: af9e598a829e3545b4220c00184ee4b0e2383f523260c613b0b89b5e77c0e913
Instruction Fuzzy Hash: 62F244B4C112698BDB25CF68C898BEDBBB1BF49310F1482D9D859B7281DB706E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 001AA2C0 Relevance: 28.7, Strings: 22, Instructions: 1233COMMON

Download Yara Rule

Strings

v<Ea, xrefs: 001AA94E
v<Ea, xrefs: 001AB411
v<Ea, xrefs: 001AB004
cannot use operator[] with a string argument with , xrefs: 001AB7E6, 001AB840, 001AB895
v<Ea, xrefs: 001AADC2
v<Ea, xrefs: 001AB271
v<Ea, xrefs: 001AAAEF
v<Ea, xrefs: 001AB5B0
v<Ea, xrefs: 001AB55E
v<Ea, xrefs: 001AA6D1
v<Ea, xrefs: 001AA71D
v<Ea, xrefs: 001AAE14
v<Ea, xrefs: 001AAB41
v<Ea, xrefs: 001AB3BF
v<Ea, xrefs: 001AAC90
v<Ea, xrefs: 001AAFB8
v<Ea, xrefs: 001AA9A0
v<Ea, xrefs: 001AB6E2
v<Ea, xrefs: 001AB21F
v<Ea, xrefs: 001AACE2
v<Ea, xrefs: 001AB690
v<Ea, xrefs: 001AA396

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: cannot use operator[] with a string argument with $v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 1646373207-2201726487
Opcode ID: a609125de0660467f4f8589c731ab96d658f69d991fe097aa7ee96a9df8669d2
Instruction ID: 8ebab11043f1d01960e2e830f2286dddbc5e5893de1af879ade71ef7dd746e7a
Opcode Fuzzy Hash: a609125de0660467f4f8589c731ab96d658f69d991fe097aa7ee96a9df8669d2
Instruction Fuzzy Hash: DDD201B4D052A99BDB25CF68C894BEDBBB4AF59300F1481D9D848B7342DB706B84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0028A2D0 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 617libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36,0000006F,00000000,00000000), ref: 0028A42D
GetProcAddress.KERNEL32(00000000,?), ref: 0028A4C9
GetProcAddress.KERNEL32(00000000,?), ref: 0028A5DB
GetProcAddress.KERNEL32(00000000,?), ref: 0028A65B
GetProcAddress.KERNEL32(00000000,?), ref: 0028A74F
GetProcAddress.KERNEL32(00000000,?), ref: 0028A843
GetProcAddress.KERNEL32(00000000,?), ref: 0028A937
GetProcAddress.KERNEL32(00000000,?), ref: 0028AA2B
GetProcAddress.KERNEL32(00000000,?), ref: 0028AAAB
GetProcAddress.KERNEL32(00000000,?), ref: 0028AB9F
GetProcAddress.KERNEL32(00000000,?), ref: 0028AC93

Strings

v<Ea, xrefs: 0028AC28
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36, xrefs: 0028A389

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36$v<Ea
API String ID: 667068680-1999961152
Opcode ID: dcf5a09d12918828e946551c54e9a35bc43e54220515e8d2f874e1dfb0658c01
Instruction ID: 018dbcef54e562459a36e90e6bdeaf465071cc7288dc9512d70e30dd278a6f3a
Opcode Fuzzy Hash: dcf5a09d12918828e946551c54e9a35bc43e54220515e8d2f874e1dfb0658c01
Instruction Fuzzy Hash: 997279B8D1525ECBDB15CFA8D6826EEBBB1BF08310F20411AD955B7350D7702A81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0026C630 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 240injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 0026C6A1
WriteProcessMemory.KERNEL32(00000000,00000000,0026558D,?,00000000), ref: 0026C6BD
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0026C6F2
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 0026C71B
WriteProcessMemory.KERNEL32(?,00000000,?,00000218,00000000,?,?,?,00326328), ref: 0026C8BF
WriteProcessMemory.KERNEL32(?,00000218,0026C990,-00000010,00000000,?,?,?,00326328), ref: 0026C8E1
CreateRemoteThread.KERNEL32(?,00000000,00000000,00000218,00000000,00000000,00000000), ref: 0026C8F4
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,00326328), ref: 0026C8FD

Strings

%s|%s, xrefs: 0026C89F
v<Ea, xrefs: 0026C7D2
(c2, xrefs: 0026C80E
2586, xrefs: 0026C883, 0026C893

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$(c2$2586$v<Ea
API String ID: 2137838514-1515221397
Opcode ID: 2aa5322da5e852077095fd516d5ca0db18d821da440dbbf2b862009b1464c70b
Instruction ID: 6c9745d57bf6b403b77157593623bb0a9e0a0df778a9d38ed10a45476111bcf3
Opcode Fuzzy Hash: 2aa5322da5e852077095fd516d5ca0db18d821da440dbbf2b862009b1464c70b
Instruction Fuzzy Hash: B2B16AB1D00208DFDB14CFA8DC89BAEBBB4FF48310F104269E959BB291D7746980CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00230BA0 Relevance: 19.8, APIs: 5, Strings: 6, Instructions: 533fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000), ref: 00230BED
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000), ref: 00230C01
ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,00000000), ref: 00230C38
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00230C43
CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00230C65

Strings

v<Ea, xrefs: 00230F8F
v<Ea, xrefs: 0023119F
v<Ea, xrefs: 00230E41
v<Ea, xrefs: 00230E8D
v<Ea, xrefs: 0023104D
v<Ea, xrefs: 00231099

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: File$CloseHandle$CreateReadSize
String ID: v<Ea$v<Ea$v<Ea$v<Ea$v<Ea$v<Ea
API String ID: 3664964396-3480959595
Opcode ID: bb40e054403721a9154597fde6457ff7ff31c7ad956e3a936601d787d0549f5f
Instruction ID: 6bcada3a13629917b13f49273594a7423dff340efbb1c082c6d7219bfd28c26a
Opcode Fuzzy Hash: bb40e054403721a9154597fde6457ff7ff31c7ad956e3a936601d787d0549f5f
Instruction Fuzzy Hash: B1328AB1D142689FDB25CF64C890BEDBBB1BF59300F148299E859B7381DB702A95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0026CAA0 Relevance: 19.2, APIs: 8, Strings: 2, Instructions: 1695registryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001A8A00: GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 001A8A4F

GetUserNameA.ADVAPI32(?,00000104), ref: 0026CD04
CopyFileA.KERNEL32(?,?,00000000), ref: 0026D10B
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 0026D2C5
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?), ref: 0026D309
RegCloseKey.ADVAPI32(?), ref: 0026D315
CopyFileA.KERNEL32(?,?,00000000), ref: 0026D8AA
__Xtime_get_ticks.LIBCPMT ref: 0026E57D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0026E58B

Strings

2586, xrefs: 0026CB66, 0026CC0C, 0026CCAF, 0026E460
v<Ea, xrefs: 0026E520

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: File$CopyName$CloseModuleOpenUnothrow_t@std@@@UserValueXtime_get_ticks__ehfuncinfo$??2@
String ID: 2586$v<Ea
API String ID: 3408431245-2190683800
Opcode ID: 39fcba04ead3b859038e24e9bf203b46aa9cfcc561c74a10c2841abdbabf4010
Instruction ID: 91f307496c2b4d5cff319d43e78501d0f151ab08235953f0eb23918988a4e2e9
Opcode Fuzzy Hash: 39fcba04ead3b859038e24e9bf203b46aa9cfcc561c74a10c2841abdbabf4010
Instruction Fuzzy Hash: E013F2B4D1425E8BDB15CFA8C995AEEBBB0BF19300F204199D949B7341EB701B84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0026E800 Relevance: 17.2, APIs: 7, Strings: 2, Instructions: 1469registryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001A8A00: GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 001A8A4F

CopyFileA.KERNEL32(?,?,00000000), ref: 0026EE20
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 0026EFDA
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?), ref: 0026F01E
RegCloseKey.ADVAPI32(?), ref: 0026F02A
CopyFileA.KERNEL32(?,?,00000000), ref: 0026F51C
GetUserNameA.ADVAPI32(?,00000104), ref: 0026F558
ShellExecuteA.SHELL32(00000000,?,?,00000000,00000000,00000001), ref: 0027003D

Strings

2586, xrefs: 0026E8C6, 0026E96C, 0026EA0F
v<Ea, xrefs: 00270002

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: File$CopyName$CloseExecuteModuleOpenShellUserValue
String ID: 2586$v<Ea
API String ID: 164619896-2190683800
Opcode ID: b7e6f781e42d93996a580e54b29bd098b72827f3a6bcf219c8def85fb799ec88
Instruction ID: b6da77b16acfd861e52a9a718cc454f5fccf9fbe6963a97cd9fb691b07c34c49
Opcode Fuzzy Hash: b7e6f781e42d93996a580e54b29bd098b72827f3a6bcf219c8def85fb799ec88
Instruction Fuzzy Hash: 2803F1B4D0425E8BDB15CFA8D995AEEBBB0BF19300F204199D949B7341DB701B84CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 001D2012 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,?,00000000,00000000), ref: 001D20AA
GetLastError.KERNEL32(?,00000000,00000000), ref: 001D20B4
FindFirstFileW.KERNEL32(?,?,?,00000000,00000000), ref: 001D20CB
GetLastError.KERNEL32(?,00000000,00000000), ref: 001D20D6
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 001D20E2
___std_fs_open_handle@16.LIBCPMT ref: 001D219B

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 82156740e7bac5938465c7418982a6bd462a3c755cb20e1a90a60aed1ad525bb
Instruction ID: d4f032992879011b8bdd131759aafdac7b41cb88b87e63343d4da92c8bb1fd83
Opcode Fuzzy Hash: 82156740e7bac5938465c7418982a6bd462a3c755cb20e1a90a60aed1ad525bb
Instruction Fuzzy Hash: D471A575A006199FCB24CF68DC88BA9B7B8BF25360F144256FC69E3390DB31AD45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002E2070 Relevance: 13.6, APIs: 9, Instructions: 88sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002E26B0: GetVersionExA.KERNEL32(?), ref: 002E26D6

GetVersionExA.KERNEL32(?), ref: 002E20B3
DeleteFileW.KERNEL32(00000000), ref: 002E20D2
GetFileAttributesW.KERNEL32(00000000), ref: 002E20D9
GetLastError.KERNEL32 ref: 002E20E6
Sleep.KERNEL32(00000064), ref: 002E20FC
DeleteFileA.KERNEL32(00000000), ref: 002E2105
GetFileAttributesA.KERNEL32(00000000), ref: 002E210C
GetLastError.KERNEL32 ref: 002E2119
Sleep.KERNEL32(00000064), ref: 002E212F

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastSleepVersion
String ID:
API String ID: 1421123951-0
Opcode ID: 59730e4c4cb8db99ec4390dea240ee34c886e3029d5771491677cdcd60274722
Instruction ID: 2408a7be03dda8e94e2ed1953f489d507ef6073c99a4043b5a0a33a52f239bf0
Opcode Fuzzy Hash: 59730e4c4cb8db99ec4390dea240ee34c886e3029d5771491677cdcd60274722
Instruction Fuzzy Hash: 0B210571960214DFCB20AF75BC8C67E73BCEB2A370F600169E91FD6280DE30499AD642

Uniqueness

Uniqueness Score: -1.00%

Function 0027C3E0 Relevance: 13.1, APIs: 5, Strings: 2, Instructions: 876COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,00000003), ref: 0027C44A
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,00000003), ref: 0027C6D9

Part of subcall function 00284050: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840AC
Part of subcall function 00284050: GetLastError.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840B7

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 0027C8DA
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 0027CBFA

Part of subcall function 00284050: std::_Throw_Cpp_error.LIBCPMT ref: 002840FF
Part of subcall function 00284050: std::_Throw_Cpp_error.LIBCPMT ref: 00284110

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 0027D02D

Strings

v<Ea, xrefs: 0027C85E
v<Ea, xrefs: 0027D0F9

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileFolderLastPath
String ID: v<Ea$v<Ea
API String ID: 3108237365-2190929436
Opcode ID: 7ccc8ce48d588c0a475dad0e08fe22d986b276bf695d93c7ebb84762e787d6f1
Instruction ID: f918b5a42c042cb5e9d155ee0dfb77ff4b2bad6b3f91d1e0e4a9827c4d66e644
Opcode Fuzzy Hash: 7ccc8ce48d588c0a475dad0e08fe22d986b276bf695d93c7ebb84762e787d6f1
Instruction Fuzzy Hash: 10A2FFB4D0525D8BDB25CFA8C981BEEBBB0BF19310F204199D949B7351E7702A84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00286E20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 181memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,7591E010,?), ref: 00286F9E
GetProcAddress.KERNEL32(00000000,?), ref: 00286FA9
GetProcessHeap.KERNEL32 ref: 00286FB4
HeapAlloc.KERNEL32(00000000,00000000,00010000), ref: 00286FCE
HeapAlloc.KERNEL32(?,00000000,00010000), ref: 00287007

Strings

v<Ea, xrefs: 00286F6C

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Heap$Alloc$AddressHandleModuleProcProcess
String ID: v<Ea
API String ID: 349456774-4124759590
Opcode ID: 0335909070d4898df2547a5ce90e8cb1b39d6b8d099fe4a2cf5c3b998cf2a666
Instruction ID: 59206cf67862d3b3582565a865576753eca113ec44eb8d6e06f76d236b385514
Opcode Fuzzy Hash: 0335909070d4898df2547a5ce90e8cb1b39d6b8d099fe4a2cf5c3b998cf2a666
Instruction Fuzzy Hash: 3281F3B5D14229ABDB14CFA9E885AEEFBB5FF48310F10816AE924B7340D7706A01CF55

Uniqueness

Uniqueness Score: -1.00%

Function 002E23D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 002E23E1
GetVersionExA.KERNEL32(?), ref: 002E2405
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 002E2437
LocalFree.KERNEL32(?), ref: 002E244E
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 002E2486

Part of subcall function 002E2ED0: AreFileApisANSI.KERNEL32(00000000,00000000,?,?,?,002E1C25), ref: 002E2EDC
Part of subcall function 002E2ED0: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,?,?,?,002E1C25), ref: 002E2EF1
Part of subcall function 002E2ED0: MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 002E2F17

Strings

OsError 0x%x (%u), xrefs: 002E24A1

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ByteCharFormatMessageMultiWide$ApisErrorFileFreeLastLocalVersion
String ID: OsError 0x%x (%u)
API String ID: 807219750-2664311388
Opcode ID: a9ce656bc7e182ebb394d0f862ecba2d4051b7d0e881174d8935bec3574908c7
Instruction ID: d0add9267f10fe46a280ad3721baa71b1621849c88091aaaf99a7d841d21ad6a
Opcode Fuzzy Hash: a9ce656bc7e182ebb394d0f862ecba2d4051b7d0e881174d8935bec3574908c7
Instruction Fuzzy Hash: 48219571A50218BBDB20AB62AC4AFAE7BBCEB45791F5000A5F909E2290D6745E14CA51

Uniqueness

Uniqueness Score: -1.00%

Function 001F47AD Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001F49C4

Strings

1#INF, xrefs: 001F48E3
1#QNAN, xrefs: 001F48C0
1#IND, xrefs: 001F48B2
1#SNAN, xrefs: 001F48B9

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 68e435f5ad75e06654ec72d2aea965cc8e1c42b617a0629961114d42e04023c4
Instruction ID: 6edd0170e658f712527b2e1b0ec1ec80845ebc1cece05226e0a0c72ed321dbd8
Opcode Fuzzy Hash: 68e435f5ad75e06654ec72d2aea965cc8e1c42b617a0629961114d42e04023c4
Instruction Fuzzy Hash: E6D22771E0862D8FDB64CE28CD447EAB7B6EB44315F1441EAD60DE7240EB78AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 00298080 Relevance: 9.2, Strings: 7, Instructions: 484COMMON

Download Yara Rule

Strings

no such vfs: %s, xrefs: 00298237
sqlite_rename_table, xrefs: 00298464
automatic extension loading failed: %s, xrefs: 002985AC
RTRIM, xrefs: 002982E8
NOCASE, xrefs: 002983AA
MATCH, xrefs: 00298488, 00298499, 002984B9, 002984BA, 002984D0
BINARY, xrefs: 002982A5, 002982B4, 002982CE, 0029830E, 00298319, 00298331, 00298383, 00298384

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: 7503370419f3bd7a146366d3d7c0dfc0f4ca65fa81fa84304ae5858df7ab13e4
Instruction ID: c319c7e26333e6fcb5ce5f441b56911236be6bf18a77ba5e96e536eb98564c09
Opcode Fuzzy Hash: 7503370419f3bd7a146366d3d7c0dfc0f4ca65fa81fa84304ae5858df7ab13e4
Instruction Fuzzy Hash: 9B025970A207019FEF319F25DC45B6B77E8AF41300F18442DE84A9B292DFB5E965CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0022CB90 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 334processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0022CCBC
Process32First.KERNEL32(00000000,?), ref: 0022CCE2
Process32Next.KERNEL32(00000000,00000128), ref: 0022CD31
CloseHandle.KERNEL32(00000000), ref: 0022CD47

Strings

v<Ea, xrefs: 0022CC44

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: v<Ea
API String ID: 420147892-4124759590
Opcode ID: ce317182a4b824e4291cdf6af0bb5db826b4bbbd59ac488c5248d17527daf30f
Instruction ID: 9db71753f43562ac0f1b49f90a24e926f1c05fd4150c647bfafa22a4151346ef
Opcode Fuzzy Hash: ce317182a4b824e4291cdf6af0bb5db826b4bbbd59ac488c5248d17527daf30f
Instruction Fuzzy Hash: DCD1BCB1D102199BDB14CFA8D9847EEBBF5EF45310F244269E804AB381DB75AE44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002B4220 Relevance: 8.9, Strings: 6, Instructions: 1371COMMON

Download Yara Rule

Strings

table %S has %d columns but %d values were supplied, xrefs: 002B4869
%d values for %d columns, xrefs: 002B4933
ROWID, xrefs: 002B49F2
OID, xrefs: 002B4A02
_ROWID_, xrefs: 002B49DD
table %S has no column named %s, xrefs: 002B4A3F

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: %d values for %d columns$OID$ROWID$_ROWID_$table %S has %d columns but %d values were supplied$table %S has no column named %s
API String ID: 0-3534356592
Opcode ID: 79a1afd6d1c74c2451135d6092d89028ef62a6d056b380aacdb6f36b46d48edc
Instruction ID: 21968ff0feb6f9ca1b23b11743b49a08b18571233e843930dbec135e7cbb2d30
Opcode Fuzzy Hash: 79a1afd6d1c74c2451135d6092d89028ef62a6d056b380aacdb6f36b46d48edc
Instruction Fuzzy Hash: C3D27A706147428FD724EF18C480B6ABBE1FF84384F15895DE8868B352EB75E965CF82

Uniqueness

Uniqueness Score: -1.00%

Function 002E2160 Relevance: 7.7, APIs: 5, Instructions: 208fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 002E2223
CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 002E2253
CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 002E225B

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: CreateFile$Version
String ID:
API String ID: 1715692615-0
Opcode ID: c51528d543c0241d95443ac723cf264627927bd2cd50a3b55589b68156f2c578
Instruction ID: 8af137aaa9863ef602a1a490e5e7d29da06c8fd76c00dd139a4844824cd7b0dc
Opcode Fuzzy Hash: c51528d543c0241d95443ac723cf264627927bd2cd50a3b55589b68156f2c578
Instruction Fuzzy Hash: 8861FEB1654342DFDB10CF26D845BABB7E8FF84310F44456DF99AD6280E738C9288B92

Uniqueness

Uniqueness Score: -1.00%

Function 001F2B48 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001E9E32: GetLastError.KERNEL32(00000000,?,001EF819), ref: 001E9E36
Part of subcall function 001E9E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 001E9ED8

GetACP.KERNEL32(?,?,?,?,?,?,001E72F0,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 001F2C07
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,001E72F0,?,?,?,00000055,?,-00000050,?,?), ref: 001F2C3E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 001F2DA1

Strings

utf8, xrefs: 001F2D10

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 6406bf60cf1b0540b7df6d782c64dc5befc3c9aca48598ceec1519560c480ee0
Instruction ID: cd361eeb9abd5752d4f46a6a56979298c6820b7070a0b1d0d7e667c08d9db41f
Opcode Fuzzy Hash: 6406bf60cf1b0540b7df6d782c64dc5befc3c9aca48598ceec1519560c480ee0
Instruction Fuzzy Hash: 3A71037560060EAADB29AFB5CC82BBB73A8EF55710F14442AFB05DB181EB70ED408761

Uniqueness

Uniqueness Score: -1.00%

Function 001DC950 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction ID: c5ff71ea9a7847cb53ea3a5e0bcd92db28a369b3eb307875ced371b441229c43
Opcode Fuzzy Hash: d832fe2a0f42001a57c9b2c34ab75cd1b9a187cae735d2738bff895b2773b599
Instruction Fuzzy Hash: 38023D71E0161A9BDF14CFA8D9806AEFBF1FF48314F24866AE519E7380D731A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002A4220 Relevance: 6.2, Strings: 4, Instructions: 1164COMMON

Download Yara Rule

Strings

ROWID, xrefs: 002A4508
OID, xrefs: 002A4518
no such column: %s, xrefs: 002A4597
_ROWID_, xrefs: 002A44F4

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: OID$ROWID$_ROWID_$no such column: %s
API String ID: 0-2593059340
Opcode ID: f091b497ba8e0552f7c2943dcb8d0833efdb14adbc2d633fb52ad8c7c122bc6e
Instruction ID: 9d97a3a61a9f6915b9ed3273c422431350f9692297a5f7d604c6063ed1934e5e
Opcode Fuzzy Hash: f091b497ba8e0552f7c2943dcb8d0833efdb14adbc2d633fb52ad8c7c122bc6e
Instruction Fuzzy Hash: 63C259706147428FD724EF18C090B2BBBE1FF86344F15895DE98A4B352DBB5E825CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001D4174 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 001D4180
IsDebuggerPresent.KERNEL32 ref: 001D424C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001D4265
UnhandledExceptionFilter.KERNEL32(?), ref: 001D426F

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c9181f84dc1bee15c672c0ef03a9cb2e0a93991c5a0bf194b8fe8056edf158f3
Instruction ID: ea7162dc24dd5566cf965990968b28dcb60c751ab977e2c1b29aa189bc843ce7
Opcode Fuzzy Hash: c9181f84dc1bee15c672c0ef03a9cb2e0a93991c5a0bf194b8fe8056edf158f3
Instruction Fuzzy Hash: E631F7B5D05229DBDF20DFA4D9897CDBBB8BF08300F1041AAE40DAB250EB759A84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00264130 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00264401
std::_Throw_Cpp_error.LIBCPMT ref: 00264412

Strings

v<Ea, xrefs: 00264239

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: v<Ea
API String ID: 2134207285-4124759590
Opcode ID: 6022e7e7770ac2d32fd78c488f1fcd89db1f6ddcbcd0127bdccbcfbbbf5b5c9f
Instruction ID: 9d8b893aeb4d757f8f59ccddde248f703e4e511062f06eb5c8610e9c4b19f2eb
Opcode Fuzzy Hash: 6022e7e7770ac2d32fd78c488f1fcd89db1f6ddcbcd0127bdccbcfbbbf5b5c9f
Instruction Fuzzy Hash: C591F1B0D04288CFCB05DF98C882BEDBBB1BF59304F14819DE8516B392D775A956CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00270420 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 202libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00270591
GetProcAddress.KERNEL32(00000000,?), ref: 0027059C

Strings

v<Ea, xrefs: 00270564

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: v<Ea
API String ID: 1646373207-4124759590
Opcode ID: 1e9a0b60fe9d98bc71d3577db2d9dfad1ab14869a8dfc9202d69ce0636d51275
Instruction ID: 6b8badf7f8fd3f90703412946d4791a60b6d48acd3271f88d389a1c14ea046d3
Opcode Fuzzy Hash: 1e9a0b60fe9d98bc71d3577db2d9dfad1ab14869a8dfc9202d69ce0636d51275
Instruction Fuzzy Hash: 7B9178B4D10209DFDB14CF98C881BAEBBB5FF48310F248159E908BB381D770AA55CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 001F80C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 001F80D9
GetSystemInfo.KERNEL32(?), ref: 001F80F4

Strings

D, xrefs: 001F80E8

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 7cda7d3295a98511aaf4ca2f25b03d4727f723bfce446e8157e0b2e6fe98f143
Instruction ID: df3fc8b7c03182972eff9fc81e1688205fca048807893325d8a381d6babe2947
Opcode Fuzzy Hash: 7cda7d3295a98511aaf4ca2f25b03d4727f723bfce446e8157e0b2e6fe98f143
Instruction Fuzzy Hash: 2201F7726001096BDB14DE29DC09BEE7BB9EFC4364F0CC224AE19D7240DB38D906C680

Uniqueness

Uniqueness Score: -1.00%

Function 001D8A54 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 001D8B4C
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 001D8B56
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 001D8B63

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d5925e01876cbededa0d8f33f46cdd38ba6953fff0d0bd0cd6e43fd569c7d330
Instruction ID: f51ccce54dcc4c410f52144acf7238204f3c9169341ad306b0cc747048a0b788
Opcode Fuzzy Hash: d5925e01876cbededa0d8f33f46cdd38ba6953fff0d0bd0cd6e43fd569c7d330
Instruction Fuzzy Hash: 7B31C4B4901229ABCB21DF68DC8979DBBB8BF18350F5041EAE41CA7250EB749F85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00218200 Relevance: 3.6, Strings: 2, Instructions: 1092COMMON

Download Yara Rule

Strings

v<Ea, xrefs: 002193FB
v<Ea, xrefs: 002182CA

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: v<Ea$v<Ea
API String ID: 0-2190929436
Opcode ID: 3889a5ec22b8ac0efada64f6759a8bd969c18949708ea5cb9a7cfe098b3a30bc
Instruction ID: 2d76bee54bb22aec3f0b5477061153e5790fd10d89a04c0046747818f9af47ac
Opcode Fuzzy Hash: 3889a5ec22b8ac0efada64f6759a8bd969c18949708ea5cb9a7cfe098b3a30bc
Instruction Fuzzy Hash: 17D2DFB4D1425A8BDB19CFA8D9816EEFBB0BF49300F204289D959B7341D7706B85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 002DC8D0 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002DCA85
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002DCD87

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: ae44195e0f25fbc77191ba1112dd43f9a2389636270ae980bd49fd0423b58a15
Instruction ID: 11de1dcb4d34ebaf2f018faad72aabc377956e79f300da5a001bcb8774723dfb
Opcode Fuzzy Hash: ae44195e0f25fbc77191ba1112dd43f9a2389636270ae980bd49fd0423b58a15
Instruction Fuzzy Hash: CC028C70624603AFDB18CF68C850B6AB7E5BF88314F24866EE859CB750D774ED64CB81

Uniqueness

Uniqueness Score: -1.00%

Function 002E40A0 Relevance: 3.5, APIs: 2, Instructions: 465COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E4443
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E44A1

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: bbc183165b8456e0db17e3a48dc9edb3ddbf89557cfc3b4e3e51ce4df5dfcc96
Instruction ID: b598b213b4158df10c93d2180ef936babe0961912877dfa6bdade3efa44de89b
Opcode Fuzzy Hash: bbc183165b8456e0db17e3a48dc9edb3ddbf89557cfc3b4e3e51ce4df5dfcc96
Instruction Fuzzy Hash: 08021771E1065A8BCF19DF6EC8A03BDFBB1BF99310F5542AAE958AB381D7344941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 002463D0 Relevance: 3.2, Strings: 2, Instructions: 701COMMON

Download Yara Rule

Strings

v<Ea, xrefs: 00246554
v<Ea, xrefs: 0024681B

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3Setgloballocalestd::locale::_
String ID: v<Ea$v<Ea
API String ID: 3356752076-2190929436
Opcode ID: 4337ead98339d53d29cd59ce7883a483e21d845fed54fdef8b994f94705a7c10
Instruction ID: f223f37fd769ed2706014a10ff27bb2c8bf4dd7e09124aa67118166ab8279844
Opcode Fuzzy Hash: 4337ead98339d53d29cd59ce7883a483e21d845fed54fdef8b994f94705a7c10
Instruction Fuzzy Hash: CE727BB0D10259CFDB24CFA8C9457EEBBB0AF55304F148299D459BB382DB746A84CF92

Uniqueness

Uniqueness Score: -1.00%

Function 001F8E20 Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

+, xrefs: 001F9353
/, xrefs: 001F9358

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: +$/
API String ID: 0-2439032044
Opcode ID: ccf1d9c94f6e27482a23339851742c0793b344f1c46cc76423ff3eb2b31d284b
Instruction ID: 8a1a937c5edfcf6dbc808a1b4a36fbc5c9ecb45d85dd1b712f8b18046bdcd85e
Opcode Fuzzy Hash: ccf1d9c94f6e27482a23339851742c0793b344f1c46cc76423ff3eb2b31d284b
Instruction Fuzzy Hash: 8202D170A042499FCB15DF68C8947FEBBF5FF5A310F14426AE965A7382D7309A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 002D81A0 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

d, xrefs: 002D83D1
Wa-, xrefs: 002D81DC, 002D848A, 002D8437, 002D837D, 002D840D

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: Wa-$d
API String ID: 0-1143596532
Opcode ID: 4d2e40d0ee049fcd3d8f72c1fa515a9766287207d900e49fb11eb8d4540daae0
Instruction ID: 31aed791e76e41176271b06dbfcc15182facc2788d3969fff37fbfadad4459d0
Opcode Fuzzy Hash: 4d2e40d0ee049fcd3d8f72c1fa515a9766287207d900e49fb11eb8d4540daae0
Instruction Fuzzy Hash: 20B1A5306187428FC314CF19C49056ABBE1BF99304F1885AEE8958F743DB75ED26CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002A0520 Relevance: 2.1, Strings: 1, Instructions: 858COMMON

Download Yara Rule

Strings

match, xrefs: 002A0E38

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: match
API String ID: 0-2052834565
Opcode ID: 18768b04a36f9535187d02fe2935fd47c00cc8f9749387199019b8791e1ca7bc
Instruction ID: b4371444ee5d795f773bcaef7062829675130569a690d8c980b0c681bb641abc
Opcode Fuzzy Hash: 18768b04a36f9535187d02fe2935fd47c00cc8f9749387199019b8791e1ca7bc
Instruction Fuzzy Hash: 49729170A147428FD724CF24C4C1B2BB7E1BF89314F148A6DE98A8B392DB75E855CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002D20C0 Relevance: 2.0, Strings: 1, Instructions: 710COMMON

Download Yara Rule

Strings

%s-mj%08X, xrefs: 002D2318

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: %s-mj%08X
API String ID: 0-77246884
Opcode ID: 0c44feec2166013ab208c532e7b8fbbaa4e3a1a9e0cfaba2592b9009f814717c
Instruction ID: e794fdfd68ffc5ac7888b0edbeb09ce7745752f3667d26fd0afb1d588ab9d463
Opcode Fuzzy Hash: 0c44feec2166013ab208c532e7b8fbbaa4e3a1a9e0cfaba2592b9009f814717c
Instruction Fuzzy Hash: 3B428A70A10206DFDB25CFA8D880BAAB7F5BF68304F14806EE819A7351D775ED69CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002E4AE0 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

GD-, xrefs: 002E4F89, 002E4DA7, 002E4BCA

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: GD-
API String ID: 0-1532924963
Opcode ID: 1682868157a21c58a8761361d3859ab34db4e993beeed00948841fca83b97ad1
Instruction ID: 66af197e3409a60d11d8993f547d71812edd4be88069a5511b6254c25e62be45
Opcode Fuzzy Hash: 1682868157a21c58a8761361d3859ab34db4e993beeed00948841fca83b97ad1
Instruction Fuzzy Hash: 40F1B032D692D38FCB159F39C4813EDBFA2AF65300F5C46A6C4958B782D278D925C790

Uniqueness

Uniqueness Score: -1.00%

Function 001E001D Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 001E01A1

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: aaffbfff9d26851b7f1c3a2caa2f508db3fbdf819399eb39b202afd88fb5a0af
Instruction ID: 037c8920575cea964df182ed3effd6a5625c4c2375e7e303a08ce6c03ef143f3
Opcode Fuzzy Hash: aaffbfff9d26851b7f1c3a2caa2f508db3fbdf819399eb39b202afd88fb5a0af
Instruction Fuzzy Hash: 0AB1D734900E8B8BCB2ACF6AC9556BEB7F1AF1C300F14061EE592AB651C7B1D9C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F2E3F Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001E9E32: GetLastError.KERNEL32(00000000,?,001EF819), ref: 001E9E36
Part of subcall function 001E9E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 001E9ED8

EnumSystemLocalesW.KERNEL32(001F2F65,00000001,00000000,?,-00000050,?,001F3599,00000000,?,?,?,00000055,?), ref: 001F2EB1

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 49c092c90ca1393f82040c7018be4924a8bf198c70947c3aeb4eff4f70aa9d93
Instruction ID: 24e3ebd1a988020d312028ae2d30b0560ff6be90849bc99f2409a9ee5a274213
Opcode Fuzzy Hash: 49c092c90ca1393f82040c7018be4924a8bf198c70947c3aeb4eff4f70aa9d93
Instruction Fuzzy Hash: 66110C372107055FDB18DF39D8915BABB91FF84768B14442DEA8687741D771B943CB40

Uniqueness

Uniqueness Score: -1.00%

Function 001F2D4D Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 001E9E32: GetLastError.KERNEL32(00000000,?,001EF819), ref: 001E9E36
Part of subcall function 001E9E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 001E9ED8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 001F2DA1

Strings

utf8, xrefs: 001F2D10

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: fa6bd643d52df3e703348dbdd89a3d290ea3dd2a7585b3f01223859d8d358bc1
Instruction ID: f54afd62e812fd3c44a44577606d900ca4824f6c7e33dfb6a8a0c592e63164b0
Opcode Fuzzy Hash: fa6bd643d52df3e703348dbdd89a3d290ea3dd2a7585b3f01223859d8d358bc1
Instruction Fuzzy Hash: 6EF0A432640209ABC714EB64DC45EBA33A8DB55311F15017AF612D7241DB74AD059750

Uniqueness

Uniqueness Score: -1.00%

Function 001F2DF4 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001E9E32: GetLastError.KERNEL32(00000000,?,001EF819), ref: 001E9E36
Part of subcall function 001E9E32: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 001E9ED8

EnumSystemLocalesW.KERNEL32(001F2D4D,00000001,?,?,?,001F35BB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 001F2E2B

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f197541029864c9e87345b9945f84c0c85ac3cba3593e479e97105bb24aba7e0
Instruction ID: 2f0c37bf0cf9b6040f277854af504a87a605550e4522cc67d41339bf13460b24
Opcode Fuzzy Hash: f197541029864c9e87345b9945f84c0c85ac3cba3593e479e97105bb24aba7e0
Instruction Fuzzy Hash: C4F0E53630020957CB14DF79D85567ABF94EFC1760B564059EF0A8B251C7759C43CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001D4301 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0003430D,001D3BD4), ref: 001D4306

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dd260f6496e4f3ecd66cc3b0b16b857eb85cb0dbb67c81b88dedb4c4d7e13055
Instruction ID: dcb1c6d20f33f3831ee3ba0699697022468e73e02715592531d7a92c67d8678d
Opcode Fuzzy Hash: dd260f6496e4f3ecd66cc3b0b16b857eb85cb0dbb67c81b88dedb4c4d7e13055
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00294CD0 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

-, xrefs: 00294D4F

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction ID: 183672f225d26a2ab72ab4c82c3675642d674ededa7743230d931f3502037c63
Opcode Fuzzy Hash: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction Fuzzy Hash: A0817F70951648AEEF219AB8C840BEDFFE0EF05201F1489E9E8D5E3B41D678D64AC761

Uniqueness

Uniqueness Score: -1.00%

Function 002D6B30 Relevance: 1.0, Instructions: 974COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c47df35aef9db653dc125f4598d364437ee5da13477d936da99cbe0161b9c3
Instruction ID: 50b44d8f379dc8753c3fef33dab66cf5d2120f4c09ec38f7c5e3da35f01f7152
Opcode Fuzzy Hash: 22c47df35aef9db653dc125f4598d364437ee5da13477d936da99cbe0161b9c3
Instruction Fuzzy Hash: 78927B70A183528FC715CF29D480A2ABBF5BF88304F15896EE885C7352E735ED56CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00290350 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee7431c590f010c8dd971055f722d67c0935e3dd62132d84c9318ee0f96c0be
Instruction ID: 29829d1fd5735a26e1c786ef65f3414916bb37e2344ba1a6d051ab7c570ff597
Opcode Fuzzy Hash: 6ee7431c590f010c8dd971055f722d67c0935e3dd62132d84c9318ee0f96c0be
Instruction Fuzzy Hash: A3626CB1E1121A9FEF14CF5AC5846ADBBB1BF48308F2481ADD814AB342C775D966CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001E035F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dee24335f5b140262ea974cbff652d8b99dc6530915220cfe40c5ba507cb02
Instruction ID: cb23644039719f9c9e767f06fc8fcd96df1eb23ecf6be8e13a96571028a33a10
Opcode Fuzzy Hash: f6dee24335f5b140262ea974cbff652d8b99dc6530915220cfe40c5ba507cb02
Instruction Fuzzy Hash: A6C1DD70500E8A8FCB2ACF6AC68467EBBB1BF5D300F144619D59697691C3B1ADC5CF11

Uniqueness

Uniqueness Score: -1.00%

Function 001F8BA0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f1546abe87f51e538dcdc7aea23690bb5e6e8375a2d449dcae47cb17df824a
Instruction ID: 4a45562db5ebffc2b94125b706e95fe46fb955bb5bd2fd8741e5cb07347cccd5
Opcode Fuzzy Hash: 88f1546abe87f51e538dcdc7aea23690bb5e6e8375a2d449dcae47cb17df824a
Instruction Fuzzy Hash: 6781F5B5E002898FDB118F98D8917FEFBB5EF2A304F440569DA5997383CB359906C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00294AA0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a67febc048bd5e7bed61c903892d463eae84642cc4542d2051080d3f21be36
Instruction ID: 060fdef2ef2988a0cc373ae7140da81ad21f7d7912cd78565fb5597dc9a0b7cc
Opcode Fuzzy Hash: 21a67febc048bd5e7bed61c903892d463eae84642cc4542d2051080d3f21be36
Instruction Fuzzy Hash: 2C61F630A10605AFDF34DEA8C881FEEBBE5EF44310F208AADE596D3690D271E656C751

Uniqueness

Uniqueness Score: -1.00%

Function 0028CD20 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02335e4d2a8d4efa55073937c7e09a6d3f4857895d4b3488d8d290f7f81c13b0
Instruction ID: 3455b12409594713099682c44e1550328e2e1b505b790e5f24f4086796cfcb58
Opcode Fuzzy Hash: 02335e4d2a8d4efa55073937c7e09a6d3f4857895d4b3488d8d290f7f81c13b0
Instruction Fuzzy Hash: 9A7190316225654FD70DCF1EECE44363356A38A341BC5862BEA81C7295C635EA3ACBE0

Uniqueness

Uniqueness Score: -1.00%

Function 001DA918 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction ID: d7841290abce7f67de5ce50d1c45d9ee4c9b6bb6437f43894e16e5218921d6f2
Opcode Fuzzy Hash: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction Fuzzy Hash: A6518F72D0011AAFDF04CF98C951AEEBBB2FF88304F5A8559E555AB301D734AA40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00286470 Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 423libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,7591E010,?), ref: 00286650
GetProcAddress.KERNEL32(00000000,?), ref: 00286660
GetModuleHandleA.KERNEL32(?), ref: 00286778
GetProcAddress.KERNEL32(00000000,?), ref: 00286782
OpenProcess.KERNEL32(00000040,00000000,?), ref: 0028678E
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000), ref: 002867FD
CloseHandle.KERNEL32(00000000), ref: 00286830
CloseHandle.KERNEL32(00000000), ref: 00286856
CloseHandle.KERNEL32(00000000), ref: 00286876
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 00286A18
ResetEvent.KERNEL32(00000000), ref: 00286A21
CreateThread.KERNEL32(00000000,00000000,00286B50,?,00000000,00000000), ref: 00286A45
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 00286A51
RtlUnicodeStringToAnsiString.NTDLL(?,?,00000001), ref: 00286A97
CloseHandle.KERNEL32(00000000), ref: 00286AD8
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000001), ref: 00286AE4
CloseHandle.KERNEL32(00000000), ref: 00286B03
TerminateThread.KERNEL32(A0DF89F8,00000000), ref: 00286B31

Strings

File, xrefs: 002868A0
v<Ea, xrefs: 0028696C
v<Ea, xrefs: 00286742

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Handle$Close$Process$AddressCreateCurrentEventModuleProcStringThread$AnsiObjectOpenResetSingleTerminateUnicodeWait
String ID: File$v<Ea$v<Ea
API String ID: 3681783469-3478411229
Opcode ID: 4579bfd54a212144c831a09efa6fb8a94aa533f751a5088f20ebab4a5bc2cb30
Instruction ID: 2a4a5b64c36e454b574fccc0216e6060037a8c6519c58ecd2c183a206e8e5c59
Opcode Fuzzy Hash: 4579bfd54a212144c831a09efa6fb8a94aa533f751a5088f20ebab4a5bc2cb30
Instruction Fuzzy Hash: 8222F1B4D002199BDB24CF98D985BEEBBB5FF08310F2041A9E919B7350D7706A84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00272D20 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 372registryCOMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00272D56
IsProcessorFeaturePresent.KERNEL32(00000015), ref: 00272D62
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?), ref: 00272F19
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?), ref: 002730D0
RegCloseKey.ADVAPI32(?), ref: 002730E1
GetComputerNameA.KERNEL32(?,?), ref: 002730FF

Strings

v<Ea, xrefs: 0027326C

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: OpenPresent$CloseComputerDebuggerFeatureNameProcessor
String ID: v<Ea
API String ID: 2393775839-4124759590
Opcode ID: 218d464bd61b0b01c47dac480536c27292075ed189767191a4fc7a41c6e2e782
Instruction ID: 27237ee0d108c1f67d7a23c5c07482066888a7b006b6cdda8f198159c72c1d38
Opcode Fuzzy Hash: 218d464bd61b0b01c47dac480536c27292075ed189767191a4fc7a41c6e2e782
Instruction Fuzzy Hash: 7B12CDB4D0425E8BDB24CF98D985BEEBBB1BF08310F204199D949B7341D7701A85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 001F8013 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,001F808E,001F8237), ref: 001F802A
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 001F8040
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 001F8055

Strings

KERNEL32.DLL, xrefs: 001F8025
``2, xrefs: 001F8066
AcquireSRWLockExclusive, xrefs: 001F803A
ReleaseSRWLockExclusive, xrefs: 001F804A

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive$``2
API String ID: 667068680-307715719
Opcode ID: 4f1dcb743b1d9df7109285b39ca1b652a942b10d7f4ea6aaa371ce314e6cad72
Instruction ID: 70e6dd9f6953454cac87c460d4da61bcb7b2caa8774b040f5303ac61eb914029
Opcode Fuzzy Hash: 4f1dcb743b1d9df7109285b39ca1b652a942b10d7f4ea6aaa371ce314e6cad72
Instruction Fuzzy Hash: F3F0C27175662A5B5B728F646D9A67722DC5E017E4359803DF702E3180EF30CC8AE790

Uniqueness

Uniqueness Score: -1.00%

Function 002E28E0 Relevance: 12.1, APIs: 8, Instructions: 141filesleepCOMMON

Download Yara Rule

APIs

LockFile.KERNEL32(00000000,40000000,00000000,00000001,00000000), ref: 002E2943
Sleep.KERNEL32(00000001), ref: 002E2951
GetLastError.KERNEL32 ref: 002E2968
UnlockFile.KERNEL32(00000000,40000000,00000000,?,00000000), ref: 002E29B3

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: File$ErrorLastLockSleepUnlock
String ID:
API String ID: 3015003838-0
Opcode ID: a941f84c546ab6e2b143b8a190bfde10b085f60f86e57b2fdbd330db90f560f0
Instruction ID: c3d6ff6c78fb6ac771f9dcd1438ce1d7ee08087c4ca9240a36224c801991d407
Opcode Fuzzy Hash: a941f84c546ab6e2b143b8a190bfde10b085f60f86e57b2fdbd330db90f560f0
Instruction Fuzzy Hash: D441E631B91255EBEB308F16ED8576EB769EB44720F709125ED0EAB342C7719C6887C0

Uniqueness

Uniqueness Score: -1.00%

Function 001BA060 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001BA09D
std::_Lockit::_Lockit.LIBCPMT ref: 001BA0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 001BA0E7
__Getctype.LIBCPMT ref: 001BA1C5
std::_Facet_Register.LIBCPMT ref: 001BA1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 001BA223

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: f710a074823c1e0d6d783a78095c3c19685b0ef28aa99c8f3f02df500bf5cf08
Instruction ID: 69e054f9f5ecc7daed03811a26a286f5e58dbbc2bf170d4a7d48270b7ff02b14
Opcode Fuzzy Hash: f710a074823c1e0d6d783a78095c3c19685b0ef28aa99c8f3f02df500bf5cf08
Instruction Fuzzy Hash: 225198B0D01249DBDB21CF58C9417AEBBF4BF21324F24829DE855AB381D774AA45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00274140 Relevance: 9.1, APIs: 6, Instructions: 101COMMON

Download Yara Rule

APIs

RmStartSession.RSTRTMGR(?,00000000,?), ref: 0027418E
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 002741D0
RmGetList.RSTRTMGR(?,?,?,?,?), ref: 002741F8
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 00274219
RmEndSession.RSTRTMGR(?), ref: 0027424C
SetLastError.KERNEL32(00000000), ref: 00274253

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Session$ErrorLastListRegisterResourcesShutdownStart
String ID:
API String ID: 3915309458-0
Opcode ID: 6c90e74db903de3ef02c37fe976d7dead5593df9659bc869962bc2bbc18686d7
Instruction ID: fa0bc2abf8da06447740596700f1576386bcff41bc37127453252db11aaef725
Opcode Fuzzy Hash: 6c90e74db903de3ef02c37fe976d7dead5593df9659bc869962bc2bbc18686d7
Instruction Fuzzy Hash: 8A317CB2D01219AFDB11DF94DC45BEFBBB8EF08760F008226F915A3291DB755A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00286B50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00286C7E
GetProcAddress.KERNEL32(00000000,?), ref: 00286C8A
CreateEventA.KERNEL32(00000000,00000001,00000000,?), ref: 00286E05
SetEvent.KERNEL32(00000000), ref: 00286E0C

Strings

v<Ea, xrefs: 00286BCB

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Event$AddressCreateHandleModuleProc
String ID: v<Ea
API String ID: 2341598627-4124759590
Opcode ID: 264d00001aa5f3ae595e92a6822ceb7ba3eec13cd7d85baea958d58fd02be9a8
Instruction ID: 914cb965c45adb32153111c1743c2228d1177fde163d49f684c5e0714fbeb353
Opcode Fuzzy Hash: 264d00001aa5f3ae595e92a6822ceb7ba3eec13cd7d85baea958d58fd02be9a8
Instruction Fuzzy Hash: 2081AEB491C3429FD304CF19D485A5AFBE4BF98790F10891EF89497361D7B0A949CF92

Uniqueness

Uniqueness Score: -1.00%

Function 002E24C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?), ref: 002E2510
GetTempPathW.KERNEL32(000000E6,?,?), ref: 002E2539

Strings

%s\etilqs_, xrefs: 002E25DA
>, xrefs: 002E2618

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: PathTempVersion
String ID: %s\etilqs_$>
API String ID: 261301950-2315843240
Opcode ID: 6451579ebaa1f5ce72e65555fd527c2d3ab48448400ab6dafad72549a974c6bb
Instruction ID: 38c321400c8bbee5128c5fb18ed7573cf33527361fbc32b39a936955352b8365
Opcode Fuzzy Hash: 6451579ebaa1f5ce72e65555fd527c2d3ab48448400ab6dafad72549a974c6bb
Instruction Fuzzy Hash: 105189709151D9DEE726CB268C257FAFBE8AF19300F8805E9D589920C2D7B44F89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001EA6A9 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001EA72E
__alloca_probe_16.LIBCMT ref: 001EA7F7
__freea.LIBCMT ref: 001EA85E

Part of subcall function 001EB086: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,001D4B2F,?,?,76A923A0,?,?,001A3522,?,?), ref: 001EB0B8

__freea.LIBCMT ref: 001EA871
__freea.LIBCMT ref: 001EA87E

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 0f4f1994a430cd0609a411535eaddcde7df500161220a13030335bb44a1a26fb
Instruction ID: 53d31c550500cc2c0aa02df8d6f4f8c4ca6c819d505947331e89265002a45ab5
Opcode Fuzzy Hash: 0f4f1994a430cd0609a411535eaddcde7df500161220a13030335bb44a1a26fb
Instruction Fuzzy Hash: E5512772600A86AFEB205F62CC85EBF3BA9DF94751B550129FC05D6110EB30EC12C762

Uniqueness

Uniqueness Score: -1.00%

Function 001BC430 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001BC45A
std::_Lockit::_Lockit.LIBCPMT ref: 001BC47C
std::_Lockit::~_Lockit.LIBCPMT ref: 001BC4A4
std::_Facet_Register.LIBCPMT ref: 001BC59A
std::_Lockit::~_Lockit.LIBCPMT ref: 001BC5C4

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: e0b165b433a4a7b35752091740ea6927895f165330bb4e0c95ced4285076cdb7
Instruction ID: c5cd1b13ef5be886850027ec6ff853e510b4f3691ebffe13814cd5927dbde2b5
Opcode Fuzzy Hash: e0b165b433a4a7b35752091740ea6927895f165330bb4e0c95ced4285076cdb7
Instruction Fuzzy Hash: 8B51A9B0A00249DBDB21DF98C855BAEBBF4FF10314F24819DE855AB381D7B5AA05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 001D2BB8 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001D2BCC
AcquireSRWLockExclusive.KERNEL32(00000008), ref: 001D2BEB
AcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 001D2C19
TryAcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 001D2C74
TryAcquireSRWLockExclusive.KERNEL32(00000008,00000000), ref: 001D2C8B

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 454333b4785e453dc241e61a230cf1dc06f979b49b17105264116ba3efbdf2b7
Instruction ID: deef6fdef992abb3a63e017eb21a173e0f6f20047f35e266fb14098c4706eb91
Opcode Fuzzy Hash: 454333b4785e453dc241e61a230cf1dc06f979b49b17105264116ba3efbdf2b7
Instruction Fuzzy Hash: 41413971A2060ADBCB24CF65D4949AEB3B4FF28361B20492BE46AD7740D730FD85DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00282BA0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000000,00000000), ref: 00282C3F
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00282F4B

Strings

b', xrefs: 00282BAD
v<Ea, xrefs: 00282FC6

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID: b'$v<Ea
API String ID: 3487004747-1729473818
Opcode ID: 860bf1a8c6fa07b6e1b961abbcecceaeccb75782a9af9345285a4dcc09fb2ae1
Instruction ID: 8aa46ed5649da581551b99f6d4c9823e433209c2336986fab3896fecb3d5d0b5
Opcode Fuzzy Hash: 860bf1a8c6fa07b6e1b961abbcecceaeccb75782a9af9345285a4dcc09fb2ae1
Instruction Fuzzy Hash: D3F146B4D102499BDB15CFA8C985BEEFBB1BF09304F244259E544BB381E7716A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00264420 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 325fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00284870: __fread_nolock.LIBCMT ref: 002849B9

DeleteFileA.KERNEL32(?), ref: 0026449B

Strings

default, xrefs: 00264521, 0026453A
2586, xrefs: 002644E5, 002644FE
v<Ea, xrefs: 0026477D

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: DeleteFile__fread_nolock
String ID: 2586$default$v<Ea
API String ID: 3901365830-3378637742
Opcode ID: 168a8920a18664be08bc6c955ef2df90bdbbecc1de9ee7f70cef9334aac30ef1
Instruction ID: bacbf26e439dcf6d7784614471a6bcea704e98e93ca43cd21416b97250b25e9a
Opcode Fuzzy Hash: 168a8920a18664be08bc6c955ef2df90bdbbecc1de9ee7f70cef9334aac30ef1
Instruction Fuzzy Hash: 34E1BAB4D00249CFCB01DFA8C945BAEBBB5BF59304F244159E945BB382D770AE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00272A20 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00272A40
IsProcessorFeaturePresent.KERNEL32(00000015), ref: 00272A4C
GetVolumeInformationA.KERNEL32(?,?,00000105,?,?,?,?,00000105), ref: 00272AF6

Strings

v<Ea, xrefs: 00272CA5

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Present$DebuggerFeatureInformationProcessorVolume
String ID: v<Ea
API String ID: 3535182753-4124759590
Opcode ID: c4f80a937cb3cec245b03b06f733e948b08f2d702258fdf4a8bef315d3341af2
Instruction ID: aec10f3a22fb880fb16c339e25cfb0419ee2148881fd95110a7d265a82cc89b6
Opcode Fuzzy Hash: c4f80a937cb3cec245b03b06f733e948b08f2d702258fdf4a8bef315d3341af2
Instruction Fuzzy Hash: D6A110B5D1424DEBDB11CFA8D985AEDBBB5BF09304F248199D889BB300E7315B88DB40

Uniqueness

Uniqueness Score: -1.00%

Function 002842D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 002843D8
GetProcAddress.KERNEL32(00000000,?), ref: 002843E3
GetVersionExA.KERNEL32(?), ref: 002843FF

Strings

v<Ea, xrefs: 002843AB

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: v<Ea
API String ID: 3310240892-4124759590
Opcode ID: b2891f550ed549a686dab0a1fb96280a7e21962eb45cc5a9b0aa9d59977cc38b
Instruction ID: d93e3f4a5426ffc4520564ffd975015cad9076fbb357d50ea167b60c3b48d973
Opcode Fuzzy Hash: b2891f550ed549a686dab0a1fb96280a7e21962eb45cc5a9b0aa9d59977cc38b
Instruction Fuzzy Hash: 3D51BCB9D1524DEBCB14DF98E985AEDBBB0FB08310F208199E855B3340E7306B90DB56

Uniqueness

Uniqueness Score: -1.00%

Function 001A4900 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 001A499F

Part of subcall function 001D51EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,76A923A0,?,001D1CF9,?,003169D8,76A923A0,?,76A923A0,-00326880), ref: 001D524B

Strings

ios_base::eofbit set, xrefs: 001A4946
ios_base::failbit set, xrefs: 001A4828, 001A4941
ios_base::badbit set, xrefs: 001A4937, 001A4962

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-1866435925
Opcode ID: d0f9f333641f5727dfd210a82b337e69ccb00f729850ed7a928f058fcb59a403
Instruction ID: b8666b23c010ce08352a4f7e3aa4b22ae65551dbef832b4e90b18b78322cb66a
Opcode Fuzzy Hash: d0f9f333641f5727dfd210a82b337e69ccb00f729850ed7a928f058fcb59a403
Instruction Fuzzy Hash: AF118CB69446446BC714DF5CCC03BA77398D74A724F04462AFE68873C2EB74A910C792

Uniqueness

Uniqueness Score: -1.00%

Function 001D8577 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,001D8528,00000000,?,00325904,?,?,?,001D86CB,00000004,InitializeCriticalSectionEx,002FC640,InitializeCriticalSectionEx), ref: 001D8584
GetLastError.KERNEL32(?,001D8528,00000000,?,00325904,?,?,?,001D86CB,00000004,InitializeCriticalSectionEx,002FC640,InitializeCriticalSectionEx,00000000,?,001D8312), ref: 001D858E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 001D85B6

Strings

api-ms-, xrefs: 001D859B

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6e8553cb92a28a364cd4efeb498bf9df3c3b717e8f0ca7974e0d86d1a67d5907
Instruction ID: 589a7b1d53a4fc24316b690a3781311b8d0f66fb111338a227ece6bff06c7301
Opcode Fuzzy Hash: 6e8553cb92a28a364cd4efeb498bf9df3c3b717e8f0ca7974e0d86d1a67d5907
Instruction Fuzzy Hash: 4EE01A7028020CB7EE111F61FC0AB683F55AB10BA4F140031FD0CA85A1EB62BAA09946

Uniqueness

Uniqueness Score: -1.00%

Function 00282950 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 002829DF
MultiByteToWideChar.KERNEL32(0000000F,00000000,?,000000FF,00000000,0000000F), ref: 00282A14
WideCharToMultiByte.KERNEL32(000004E3,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00282A3B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 00282A69

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 1f11f9232ed43d3f43ace6c5d707e1fbf15fec710302c43ce945a90ad3fcfde3
Instruction ID: bb805dbe48daae7460b5c2431ec3a1eae7882038aade27496c353d70d678a6f7
Opcode Fuzzy Hash: 1f11f9232ed43d3f43ace6c5d707e1fbf15fec710302c43ce945a90ad3fcfde3
Instruction Fuzzy Hash: F941C370900316ABDB25DF64DC05FAE7AB8AF45710F104269F814BB2D1D7B99A04C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 002E26B0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 002E26D6

Part of subcall function 002E30A0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,002E2705), ref: 002E30B6

AreFileApisANSI.KERNEL32 ref: 002E2712
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 002E272B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 002E2751

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ByteCharMultiWide$ApisFileVersion
String ID:
API String ID: 928063719-0
Opcode ID: e8fcaa0430c502af39a69937f6aa70e8de3cd787380246752a9a9876fbf6b6d1
Instruction ID: b327cc74f45c99be467657c3a05b0e35c6589ec5d397d5922c2856e8cb57b81c
Opcode Fuzzy Hash: e8fcaa0430c502af39a69937f6aa70e8de3cd787380246752a9a9876fbf6b6d1
Instruction Fuzzy Hash: 07115C72A502246AE730AB797C8AB7B739C9B05774F200275F90DD32C0DE7459548792

Uniqueness

Uniqueness Score: -1.00%

Function 002E2CA0 Relevance: 6.1, APIs: 4, Instructions: 76fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,?,00000000), ref: 002E2CC9
GetLastError.KERNEL32 ref: 002E2CD6
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 002E2D0E
GetLastError.KERNEL32 ref: 002E2D3F

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorFileLast$PointerWrite
String ID:
API String ID: 2977825765-0
Opcode ID: 2e73c52ed1a0a64e88811b302977e912fd76211ef137e1d7497ace2d776d8ea5
Instruction ID: 351b80db7d1efed622181868eefc08cc631cd7d6e72494156a908e1cc4eb75f5
Opcode Fuzzy Hash: 2e73c52ed1a0a64e88811b302977e912fd76211ef137e1d7497ace2d776d8ea5
Instruction Fuzzy Hash: A021A43364024AEFCB20DFA9EC44BAA7BECEB08360F544166EE1DD7240DA31DD148B90

Uniqueness

Uniqueness Score: -1.00%

Function 00284050 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840AC
GetLastError.KERNEL32(?,?,00000006,00000005,00000005,?), ref: 002840B7
std::_Throw_Cpp_error.LIBCPMT ref: 002840FF
std::_Throw_Cpp_error.LIBCPMT ref: 00284110

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 783213d9cf8c4ebbc4962d07aad1bfb30ae6cac8ba66b1ff53e6dd7737e11ee7
Instruction ID: 9c1d41b86557a39bf65611e584be07f401775389146866c044679791634421fd
Opcode Fuzzy Hash: 783213d9cf8c4ebbc4962d07aad1bfb30ae6cac8ba66b1ff53e6dd7737e11ee7
Instruction Fuzzy Hash: A2115B755022479FCB397F28AC457AAB768AB23731F240329E5359B7C0DB3358788752

Uniqueness

Uniqueness Score: -1.00%

Function 001F097B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001F0983

Part of subcall function 001EEC43: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001EA854,?,00000000,-00000008), ref: 001EECA4

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001F09BB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001F09DB

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 771b719db4deb6f15e54fae6e7fc1145f180fdc0ed10cc115508bdca9e6d7e04
Instruction ID: 52dba5f3e5517a1275230aadff14b473f5f1617359847e479a6891e4763d6a71
Opcode Fuzzy Hash: 771b719db4deb6f15e54fae6e7fc1145f180fdc0ed10cc115508bdca9e6d7e04
Instruction Fuzzy Hash: 881104F1905A4DBEA62267726CCDCBF2A7CEE993E87110024F609D2103FB619D0085B1

Uniqueness

Uniqueness Score: -1.00%

Function 002E2D60 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 002E2D7F
GetLastError.KERNEL32 ref: 002E2D8A
ReadFile.KERNEL32(?,?,?,?,00000000), ref: 002E2DB2
GetLastError.KERNEL32 ref: 002E2DBC

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: 094dddee3a64fa2b5445b0b8cb3149e6197904643032d42af693facc555c0755
Instruction ID: 9a1ede4bd2f91c9e90f19b4f72f7950176d711b543500aaa9bc9188102018f4e
Opcode Fuzzy Hash: 094dddee3a64fa2b5445b0b8cb3149e6197904643032d42af693facc555c0755
Instruction Fuzzy Hash: C5119172640109ABCB108FA9FC05FAABBACEF55371F008266FD1CC6250D771D8608BD1

Uniqueness

Uniqueness Score: -1.00%

Function 002E2AF0 Relevance: 6.1, APIs: 4, Instructions: 61fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,?), ref: 002E2B17
LockFileEx.KERNEL32(?,00000001,00000000,000001FE,00000000,?,00000000,?), ref: 002E2B5B
LockFile.KERNEL32(?,?,00000000,00000001,00000000,00000000,?), ref: 002E2B98
GetLastError.KERNEL32 ref: 002E2BA4

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: FileLock$ErrorLastVersion
String ID:
API String ID: 1561719237-0
Opcode ID: 4214fb4ce69f034e3050a6d9675a58f86b6c7bf11b79d644754fd44693f2dd0d
Instruction ID: 56c216ab7ade2b8189c985f0f76f758378b2c44673fbf645e476ee58ba62da70
Opcode Fuzzy Hash: 4214fb4ce69f034e3050a6d9675a58f86b6c7bf11b79d644754fd44693f2dd0d
Instruction Fuzzy Hash: D711E2B0A50315EFE7208F65EC0ABAAB7B9EF04364F114169E509E62D0D7B89D148F91

Uniqueness

Uniqueness Score: -1.00%

Function 001D2719 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001D2720
std::_Lockit::_Lockit.LIBCPMT ref: 001D272B
std::_Lockit::~_Lockit.LIBCPMT ref: 001D2799

Part of subcall function 001D287C: std::locale::_Locimp::_Locimp.LIBCPMT ref: 001D2894

std::locale::_Setgloballocale.LIBCPMT ref: 001D2746

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: bad1594db04b1b6ef1d672596186c509e4a8c4cc05a2dab8f3a9b0e179617cb6
Instruction ID: 79844ae8b935431e99b94665a01ea1457a1d30b84f4d94c9b516d6895bcaf6ff
Opcode Fuzzy Hash: bad1594db04b1b6ef1d672596186c509e4a8c4cc05a2dab8f3a9b0e179617cb6
Instruction Fuzzy Hash: FB01BC75A006149BCB06EB30D84567D77A5BFA4790B08004AE82217381CF74AA02DBC2

Uniqueness

Uniqueness Score: -1.00%

Function 002E2C40 Relevance: 6.0, APIs: 4, Instructions: 35fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 002E2C5F
GetLastError.KERNEL32 ref: 002E2C6A
SetEndOfFile.KERNEL32(?), ref: 002E2C77
GetLastError.KERNEL32 ref: 002E2C81

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID:
API String ID: 1697706070-0
Opcode ID: 9c75f7c4e5149bdb5b9bd6baf87ee3029fafb8a639c772330a31070650c30b50
Instruction ID: 2f9b94db04d33a1317b1ded1fe7ea7fe14af563f7d9c4fd1ff4877b50152f402
Opcode Fuzzy Hash: 9c75f7c4e5149bdb5b9bd6baf87ee3029fafb8a639c772330a31070650c30b50
Instruction Fuzzy Hash: 41F03671554209DFCB119F75FD05AAA77ACEB05370F10436AF82DD2250DB31DD249B81

Uniqueness

Uniqueness Score: -1.00%

Function 001F6D22 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,001DD537,00000000,00000000,?,001F3DBC,00000000,00000001,?,?,?,001E9281,?,00000000,00000000), ref: 001F6D39
GetLastError.KERNEL32(?,001F3DBC,00000000,00000001,?,?,?,001E9281,?,00000000,00000000,?,?,?,001E985B,00000000), ref: 001F6D45

Part of subcall function 001F6D0B: CloseHandle.KERNEL32(FFFFFFFE,001F6D55,?,001F3DBC,00000000,00000001,?,?,?,001E9281,?,00000000,00000000,?,?), ref: 001F6D1B

___initconout.LIBCMT ref: 001F6D55

Part of subcall function 001F6CCD: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001F6CFC,001F3DA9,?,?,001E9281,?,00000000,00000000,?), ref: 001F6CE0

WriteConsoleW.KERNEL32(00000000,00000000,001DD537,00000000,?,001F3DBC,00000000,00000001,?,?,?,001E9281,?,00000000,00000000,?), ref: 001F6D6A

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7b1900d6752ffd9bea48b1d356564641a3de9060293217b8dca3f7f1bed3a556
Instruction ID: d1cc5df5e8142de01501bce7028617a39d5caf822aa403694c66044996f25f7c
Opcode Fuzzy Hash: 7b1900d6752ffd9bea48b1d356564641a3de9060293217b8dca3f7f1bed3a556
Instruction Fuzzy Hash: 23F01C36101158BBCF231FD5EC08AAA3F6AFB083E0F014024FA4C85220C7328D20DB91

Uniqueness

Uniqueness Score: -1.00%

Function 001A6180 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 353COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001A6587

Strings

", ", xrefs: 001A63D8
: ", xrefs: 001A63AE

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: ", "$: "
API String ID: 4194217158-747220369
Opcode ID: 5eeb5c3212586f244332853f7ce479bab7d06dbeffc0e2184a29e135df7e9b0d
Instruction ID: 94cd22dd2145b40cf490f7d40b8aba8ebf727f0bbe23057771ea79f2e11b591e
Opcode Fuzzy Hash: 5eeb5c3212586f244332853f7ce479bab7d06dbeffc0e2184a29e135df7e9b0d
Instruction Fuzzy Hash: ECD1D174E00204DFCB24DFA8C845AAEBBF5FF55700F24462EE465A7381DB70AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001A6B10 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 001A6CF0
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 001A6D3E

Strings

., xrefs: 001A6D10

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 2440dcc1ec848f90b3706ef17d3ad674f2bd5f261ff5f723278d60daeefecd7d
Instruction ID: 4e636f0d21ac2a0eee7871e713e2c3e33833f9fc9755eec5cccca5b8b6019399
Opcode Fuzzy Hash: 2440dcc1ec848f90b3706ef17d3ad674f2bd5f261ff5f723278d60daeefecd7d
Instruction Fuzzy Hash: 2691167AA00626ABCB34DF68C4846B9B3B4FF16320F180259E895D7690D731FD55CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 001A47F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 001A499F

Part of subcall function 001D51EB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,76A923A0,?,001D1CF9,?,003169D8,76A923A0,?,76A923A0,-00326880), ref: 001D524B

Strings

ios_base::failbit set, xrefs: 001A4828
ios_base::badbit set, xrefs: 001A4937, 001A4962

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 1903096808-1240500531
Opcode ID: 99540de8f328a8f0413c68eea87fa45eca2ce59630e1ecc2f35c19496bced564
Instruction ID: a3cf3ad0dd9ece538064922b47ebd0273d8980ba96b37b2a60a19d430ec16be8
Opcode Fuzzy Hash: 99540de8f328a8f0413c68eea87fa45eca2ce59630e1ecc2f35c19496bced564
Instruction Fuzzy Hash: DC4106B5D00248AFCB04DF58CC45BAEF7B8EB4A710F14826DF514A7382D7B56A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001A4040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001A4061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001A40C4

Strings

bad locale name, xrefs: 001A40E6

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 2860d29a2bca3f09cb58369a7f6775a5f6b6cc8434b7650f74826752bf91346e
Instruction ID: e6300df942a33353a4b281da49de1cd33c4f90db547dae757df399582e6be483
Opcode Fuzzy Hash: 2860d29a2bca3f09cb58369a7f6775a5f6b6cc8434b7650f74826752bf91346e
Instruction Fuzzy Hash: 6811D370805BC4EED321CF68C50478BBFF4AF25714F14868DE49597B81D3B59A04C791

Uniqueness

Uniqueness Score: -1.00%

Function 001D463B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001D4646
___raise_securityfailure.LIBCMT ref: 001D4703

Strings

xU2, xrefs: 001D46FE

Memory Dump Source

Source File: 00000000.00000002.3253687321.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.3253664682.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253798896.00000000002FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253824729.0000000000322000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253840895.0000000000324000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253858872.0000000000325000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000327000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.000000000032D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3253871364.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_ZtQY1K6aTi.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: xU2
API String ID: 3761405300-2864191595
Opcode ID: cd1ffa396ad368d5d99d2631eb7e95c49ed4adb7830138632d9f0fb8a2594772
Instruction ID: 7395d5168f6080ae01fb15321494850eb4ab8da886247975ebfc5c7f7dca8d50
Opcode Fuzzy Hash: cd1ffa396ad368d5d99d2631eb7e95c49ed4adb7830138632d9f0fb8a2594772
Instruction Fuzzy Hash: 1711E3B4511A04DFE722CF25F8896547BADFB18364F90612EE8098B360E7749786CF45

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZtQY1K6aTi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SysWOW64\GroupPolicy\gpt.ini

C:\Windows\System32\GroupPolicy\GPT.INI

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
ZtQY1K6aTi.exe

Function 001FA082 Relevance: 56.5, APIs: 16, Strings: 16, Instructions: 502
sleepthreadCOMMON

Function 001F9588 Relevance: 32.2, APIs: 9, Strings: 9, Instructions: 702
librarythreadloaderCOMMON

Function 001FDA50 Relevance: 7.7, APIs: 5, Instructions: 156
sleepCOMMON

Function 00264CE0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 351
networkCOMMON

Function 00264EB0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 279
networksleepCOMMON

Function 001E2CC3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Function 001E8900 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292
COMMONLIBRARYCODE

Function 00265940 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Function 001D3C23 Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Function 00273430 Relevance: 4.5, APIs: 3, Instructions: 28
sleepCOMMON

Function 002846E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122
COMMON

Function 001E8DEF Relevance: 3.1, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Function 001E250C Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Function 001D8DF2 Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Function 001EAC71 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON