Edit tour

Windows Analysis Report
3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Overview

General Information

Sample name:	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe renamed because original name is a hash value
Original sample name:	3_.pdf.exe
Analysis ID:	1385428
MD5:	075d6c122274cb9226521d3cd298f2f2
SHA1:	6f54d70f39fa28596ef90bfcb0c14278b016db1b
SHA256:	92192af947017c20ad861faf4459fb705e63f7083b34c77c1727891b88091573
Tags:	exeRemoteUtilitiesrurat
Infos:

Detection

RMSRemoteAdmin, Remote Utilities

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remote Utilities RAT

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Connects to many ports of the same IP (likely port scanning)

Initial sample is a PE file and has a suspicious name

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores large binary data to the registry

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected RMS RemoteAdmin tool

Yara signature match

Classification

Process Tree

System is w10x64

3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe (PID: 7316 cmdline: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe MD5: 075D6C122274CB9226521D3CD298F2F2)

msiexec.exe (PID: 7416 cmdline: "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7448 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7528 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9 MD5: 9D09DC1EDA745A5F87553048E57620CF)

rfusclient.exe (PID: 7600 cmdline: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi MD5: 6AAE165F3B1575DB887A0370CFC80083)

rutserv.exe (PID: 7640 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 7676 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 7772 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 7876 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service MD5: 652C2A693B333504A3879460D0AF7224)

rutserv.exe (PID: 8008 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall MD5: 652C2A693B333504A3879460D0AF7224)

rfusclient.exe (PID: 8048 cmdline: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe MD5: 6AAE165F3B1575DB887A0370CFC80083)

rfusclient.exe (PID: 5016 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray MD5: 6AAE165F3B1575DB887A0370CFC80083)

rfusclient.exe (PID: 8068 cmdline: "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray MD5: 6AAE165F3B1575DB887A0370CFC80083)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39d3a4:$s1: rman_message 0x405be0:$s3: rms_host_ 0x40657c:$s3: rms_host_ 0x7a410c:$s4: rman_av_capture_settings 0x3a76cc:$s7: _rms_log.txt 0x45d27c:$s8: rms_internet_id_settings
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a02f0:$s1: rman_message 0x431f3c:$s3: rms_host_ 0x4328e0:$s3: rms_host_ 0x7d1f30:$s4: rman_av_capture_settings 0x83a260:$s5: rman_registry_key 0x83a2ac:$s5: rman_registry_key 0x4e5a1c:$s6: rms_system_information 0x2e6274:$s7: _rms_log.txt 0x4a5efc:$s8: rms_internet_id_settings

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rfusclient.exe PID: 7600	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7640	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 7876	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.rfusclient.exe.650000.0.unpack	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
4.0.rfusclient.exe.650000.0.unpack	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39d3a4:$s1: rman_message 0x405be0:$s3: rms_host_ 0x40657c:$s3: rms_host_ 0x7a410c:$s4: rman_av_capture_settings 0x3a76cc:$s7: _rms_log.txt 0x45d27c:$s8: rms_internet_id_settings

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, CommandLine: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, NewProcessName: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, OriginalFileName: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, ProcessId: 7316, ProcessName: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 101.99.94.54, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Initiated: true, ProcessId: 7876, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Virustotal: Detection: 28%

Perma Link

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002690 CRYPTO_free,	5_2_11002690
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11017100 DES_ecb_encrypt,DES_encrypt1,	5_2_11017100
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002120 CRYPTO_set_mem_ex_functions,	5_2_11002120
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103A120 BN_BLINDING_create_param,CRYPTO_malloc,ERR_put_error,_memset,BN_dup,CRYPTO_THREADID_current,BN_new,BN_new,BN_free,BN_dup,BN_rand_range,BN_mod_inverse,ERR_peek_last_error,ERR_clear_error,BN_rand_range,ERR_put_error,BN_mod_exp,BN_BLINDING_free,	5_2_1103A120
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104C120 DSA_SIG_new,CRYPTO_malloc,	5_2_1104C120
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108C120 ASN1_PCTX_new,CRYPTO_malloc,ERR_put_error,	5_2_1108C120
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046130 RSA_padding_add_PKCS1_OAEP_mgf1,EVP_sha1,EVP_MD_size,ERR_put_error,EVP_Digest,_memset,RAND_bytes,CRYPTO_malloc,PKCS1_MGF1,PKCS1_MGF1,CRYPTO_free,CRYPTO_free,	5_2_11046130
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E130 a2i_ASN1_ENUMERATED,BIO_gets,CRYPTO_malloc,CRYPTO_realloc,BIO_gets,ERR_put_error,CRYPTO_free,	5_2_1108E130
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019150 DES_ofb_encrypt,DES_encrypt1,	5_2_11019150
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11047150 RSA_padding_add_PKCS1_PSS_mgf1,EVP_MD_size,BN_num_bits,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,RAND_bytes,EVP_MD_CTX_init,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,PKCS1_MGF1,CRYPTO_free,	5_2_11047150
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104C150 DSA_SIG_free,BN_free,BN_free,CRYPTO_free,	5_2_1104C150
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E150 ERR_load_ERR_strings,CRYPTO_lock,CRYPTO_lock,	5_2_1106E150
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11068160 BIO_get_accept_socket,BIO_sock_init,BUF_strdup,DSO_global_lookup,DSO_global_lookup,BIO_get_port,htons,BIO_get_host_ip,htonl,socket,setsockopt,bind,WSAGetLastError,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,ERR_put_error,ERR_add_error_data,ERR_put_error,listen,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,CRYPTO_free,closesocket,	5_2_11068160
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C2160 ENGINE_add,ERR_put_error,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,	5_2_110C2160
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F170 idea_cbc_encrypt,idea_encrypt,idea_encrypt,idea_encrypt,idea_encrypt,	5_2_1101F170
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002180 CRYPTO_set_locked_mem_functions,	5_2_11002180
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E180 DSO_new_method,DSO_METHOD_openssl,CRYPTO_malloc,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_free,sk_free,CRYPTO_free,	5_2_1104E180
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072180 EVP_EncryptUpdate,ERR_put_error,	5_2_11072180
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D180 EVP_PKEY_encrypt_init,ERR_put_error,	5_2_1107D180
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053190 EC_POINT_free,CRYPTO_free,	5_2_11053190
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110311A0 CRYPTO_gcm128_encrypt,	5_2_110311A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F1A0 ERR_peek_last_error_line_data,ERR_get_state,CRYPTO_free,CRYPTO_free,	5_2_1106F1A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110811A0 ASN1_item_i2d_bio,ASN1_item_i2d,ERR_put_error,BIO_write,BIO_write,CRYPTO_free,CRYPTO_free,	5_2_110811A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110171B0 DES_cbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,	5_2_110171B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105B1B0 EC_KEY_get_key_method_data,CRYPTO_lock,CRYPTO_lock,	5_2_1105B1B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110021C0 CRYPTO_set_locked_mem_ex_functions,	5_2_110021C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110511C0 BN_dup,BN_free,BN_dup,BN_free,CRYPTO_free,BUF_memdup,	5_2_110511C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110531C0 EC_POINT_clear_free,OPENSSL_cleanse,CRYPTO_free,	5_2_110531C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110031D0 CRYPTO_dbg_realloc,CRYPTO_dbg_malloc,CRYPTO_is_mem_check_on,CRYPTO_mem_ctrl,lh_delete,lh_insert,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	5_2_110031D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110721D0 EVP_EncryptFinal_ex,ERR_put_error,OpenSSLDie,ERR_put_error,_memset,	5_2_110721D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107F1D0 ASN1_UTCTIME_adj,ASN1_STRING_type_new,OPENSSL_gmtime,OPENSSL_gmtime_adj,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,BIO_snprintf,	5_2_1107F1D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110801D0 BN_to_ASN1_INTEGER,ASN1_STRING_type_new,BN_num_bits,CRYPTO_realloc,ERR_put_error,ASN1_STRING_free,BN_bn2bin,	5_2_110801D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108F1D0 BIO_new_NDEF,CRYPTO_malloc,BIO_f_asn1,BIO_new,BIO_push,BIO_asn1_set_prefix,BIO_asn1_set_suffix,BIO_ctrl,BIO_free,CRYPTO_free,ERR_put_error,	5_2_1108F1D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110041E0 CRYPTO_lock,sk_num,sk_num,CRYPTO_get_ex_data,CRYPTO_set_ex_data,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_set_ex_data,CRYPTO_free,	5_2_110041E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110501F0 DH_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,	5_2_110501F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D1F0 EVP_PKEY_encrypt,ERR_put_error,EVP_PKEY_size,ERR_put_error,ERR_put_error,ERR_put_error,	5_2_1107D1F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020000 BF_encrypt,	5_2_11020000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053000 CRYPTO_free,	5_2_11053000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082000 ASN1_item_digest,ASN1_item_i2d,EVP_Digest,CRYPTO_free,CRYPTO_free,	5_2_11082000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11086030 X509_CRL_METHOD_new,CRYPTO_malloc,	5_2_11086030
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11068040 BIO_get_host_ip,ERR_put_error,BIO_sock_init,CRYPTO_lock,gethostbyname,ERR_put_error,ERR_put_error,CRYPTO_lock,ERR_add_error_data,	5_2_11068040
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11070040 OBJ_add_object,lh_new,OBJ_dup,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,CRYPTO_free,ASN1_OBJECT_free,lh_insert,CRYPTO_free,	5_2_11070040
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11083050 i2d_ASN1_TYPE,CRYPTO_malloc,i2d_ASN1_TYPE,CRYPTO_free,	5_2_11083050
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E060 RC2_cfb64_encrypt,RC2_encrypt,RC2_encrypt,	5_2_1101E060
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053060 CRYPTO_free,	5_2_11053060
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004070 CRYPTO_get_ex_data,sk_num,sk_value,	5_2_11004070
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030070 CRYPTO_nistcts128_decrypt_block,CRYPTO_cbc128_decrypt,CRYPTO_cbc128_decrypt,	5_2_11030070
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023080 CAST_ofb64_encrypt,CAST_encrypt,	5_2_11023080
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11050080 DH_new_method,CRYPTO_malloc,ERR_put_error,DH_OpenSSL,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_DH,X509_PURPOSE_get0_name,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,	5_2_11050080
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11080080 ASN1_INTEGER_set,CRYPTO_free,CRYPTO_malloc,ERR_put_error,	5_2_11080080
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082080 ASN1_verify,EVP_MD_CTX_init,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,ERR_put_error,EVP_MD_CTX_cleanup,ERR_put_error,EVP_MD_CTX_cleanup,CRYPTO_malloc,ERR_put_error,EVP_DigestInit_ex,EVP_DigestUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_VerifyFinal,EVP_MD_CTX_cleanup,ERR_put_error,EVP_MD_CTX_cleanup,	5_2_11082080
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110020A0 CRYPTO_set_mem_functions,OPENSSL_init,	5_2_110020A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110040A0 CRYPTO_lock,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_free,	5_2_110040A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110530A0 CRYPTO_free,	5_2_110530A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110310B0 CRYPTO_gcm128_aad,	5_2_110310B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D0B0 EVP_PKEY_asn1_add_alias,CRYPTO_malloc,_memset,EVP_PKEY_asn1_add0,EVP_PKEY_asn1_free,	5_2_1108D0B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103F0C0 BN_MONT_CTX_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,	5_2_1103F0C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110810C0 ASN1_i2d_bio,CRYPTO_malloc,ERR_put_error,BIO_write,BIO_write,CRYPTO_free,CRYPTO_free,	5_2_110810C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110840D0 X509_PUBKEY_set0_param,X509_ALGOR_set0,CRYPTO_free,	5_2_110840D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110030E0 CRYPTO_dbg_free,CRYPTO_is_mem_check_on,CRYPTO_mem_ctrl,lh_delete,CRYPTO_free,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	5_2_110030E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110530E0 EC_POINT_new,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,	5_2_110530E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002300 CRYPTO_get_locked_mem_functions,	5_2_11002300
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022300 CAST_encrypt,	5_2_11022300
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11067300 BIO_vprintf,CRYPTO_push_info_,CRYPTO_free,BIO_write,CRYPTO_free,BIO_write,CRYPTO_pop_info,	5_2_11067300
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11086300 X509_INFO_free,CRYPTO_add_lock,X509_free,X509_CRL_free,X509_PKEY_free,CRYPTO_free,CRYPTO_free,	5_2_11086300
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023310 AES_cfb1_encrypt,AES_encrypt,CRYPTO_cfb128_1_encrypt,	5_2_11023310
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11050310 DH_get_ex_new_index,CRYPTO_get_ex_new_index,	5_2_11050310
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105F310 ECPKParameters_print,BN_CTX_new,EC_GROUP_get_asn1_flag,BIO_indent,ENGINE_get_pkey_asn1_meths,OBJ_nid2sn,BIO_printf,BIO_printf,EC_curve_nid2nist,BIO_indent,BIO_printf,pqueue_peek,X509_TRUST_get_flags,BN_new,BN_new,BN_new,BN_new,BN_new,EC_GROUP_get_curve_GF2m,EC_GROUP_get_curve_GFp,X509_TRUST_get_flags,EC_GROUP_get_order,EC_GROUP_get_cofactor,ENGINE_get_init_function,EC_POINT_point2bn,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,ENGINE_get_finish_function,EVP_MD_block_size,CRYPTO_malloc,BIO_indent,OBJ_nid2sn,BIO_printf,EC_GROUP_get_basis_type,BIO_indent,OBJ_nid2sn,BIO_printf,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ERR_put_error,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_CTX_free,CRYPTO_free,	5_2_1105F310
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11039320 BN_set_word,CRYPTO_malloc,ERR_put_error,__time64,RAND_add,RAND_bytes,RAND_pseudo_bytes,BN_bin2bn,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,	5_2_11039320
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A320 RSA_public_encrypt,	5_2_1104A320
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11057320 ERR_put_error,EC_POINT_set_to_infinity,BN_CTX_new,X509_TRUST_get_flags,ERR_put_error,EC_POINT_cmp,BN_num_bits,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,BN_num_bits,CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_put_error,CRYPTO_free,ERR_put_error,CRYPTO_free,EC_POINT_new,EC_POINT_new,EC_POINT_copy,EC_POINT_dbl,EC_POINT_add,EC_POINTs_make_affine,EC_POINT_dbl,EC_POINT_invert,EC_POINT_copy,EC_POINT_add,EC_POINT_set_to_infinity,EC_POINT_invert,ERR_put_error,BN_CTX_free,EC_POINT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EC_POINT_clear_free,CRYPTO_free,CRYPTO_free,	5_2_11057320
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A330 RSA_private_encrypt,	5_2_1104A330
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081330 ASN1_ENUMERATED_set,CRYPTO_free,CRYPTO_malloc,ERR_put_error,	5_2_11081330
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11085330 X509_get_ex_new_index,CRYPTO_get_ex_new_index,	5_2_11085330
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002340 CRYPTO_get_locked_mem_ex_functions,	5_2_11002340
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A340 RSA_private_decrypt,	5_2_1104A340
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046340 RSA_padding_check_PKCS1_OAEP_mgf1,EVP_sha1,EVP_MD_size,CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,PKCS1_MGF1,PKCS1_MGF1,EVP_Digest,CRYPTO_memcmp,ERR_put_error,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,	5_2_11046340
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11093340 ASN1_STRING_TABLE_add,sk_new,ERR_put_error,ASN1_STRING_TABLE_get,CRYPTO_malloc,ERR_put_error,sk_push,	5_2_11093340
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023350 AES_cfb8_encrypt,AES_encrypt,CRYPTO_cfb128_8_encrypt,	5_2_11023350
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11037350 CRYPTO_malloc,CRYPTO_free,	5_2_11037350
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E350 DSO_up_ref,ERR_put_error,CRYPTO_add_lock,	5_2_1104E350
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045350 RSA_verify_ASN1_OCTET_STRING,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,RSA_public_decrypt,d2i_ASN1_OCTET_STRING,ERR_put_error,ASN1_STRING_free,OPENSSL_cleanse,CRYPTO_free,	5_2_11045350
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A350 RSA_public_decrypt,	5_2_1104A350
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C2350 ENGINE_finish,ERR_put_error,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,	5_2_110C2350
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E360 ERR_clear_error,ERR_get_state,CRYPTO_free,	5_2_1106E360
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E360 a2d_ASN1_OBJECT,ERR_put_error,BN_new,BN_set_word,BN_mul_word,BN_add_word,BN_add_word,BN_num_bits,CRYPTO_free,CRYPTO_malloc,BN_div_word,CRYPTO_free,BN_free,ERR_put_error,CRYPTO_free,BN_free,ERR_put_error,	5_2_1107E360
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D360 EVP_PKEY_decrypt,ERR_put_error,EVP_PKEY_size,ERR_put_error,ERR_put_error,ERR_put_error,	5_2_1107D360
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002370 CRYPTO_get_mem_debug_functions,	5_2_11002370
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004380 CRYPTO_lock,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,CRYPTO_lock,sk_value,CRYPTO_lock,sk_num,sk_value,CRYPTO_free,sk_free,	5_2_11004380
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C380 EVP_PKEY_meth_new,CRYPTO_malloc,_memset,	5_2_1107C380
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023390 AES_ofb128_encrypt,AES_encrypt,CRYPTO_ofb128_encrypt,	5_2_11023390
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F3A0 ERR_load_crypto_strings,ERR_load_BN_strings,ERR_load_RSA_strings,ERR_load_DH_strings,ERR_load_EVP_strings,ERR_load_BUF_strings,ERR_load_OBJ_strings,ERR_load_PEM_strings,ERR_load_DSA_strings,ERR_load_X509_strings,ERR_load_ASN1_strings,ERR_load_CONF_strings,ERR_load_CRYPTO_strings,ERR_load_COMP_strings,ERR_load_EC_strings,ERR_load_ECDSA_strings,ERR_load_ECDH_strings,ERR_load_BIO_strings,ERR_load_PKCS7_strings,ERR_load_X509V3_strings,ERR_load_PKCS12_strings,ERR_load_RAND_strings,ERR_load_DSO_strings,ERR_load_TS_strings,ERR_load_ENGINE_strings,ERR_load_OCSP_strings,ERR_load_UI_strings,	5_2_1106F3A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E3A0 X509_PKEY_free,d2i_NETSCAPE_SPKAC,d2i_NETSCAPE_SPKAC,CRYPTO_add_lock,X509_ALGOR_free,ASN1_STRING_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,	5_2_1108E3A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110633B0 BIO_get_ex_new_index,CRYPTO_get_ex_new_index,	5_2_110633B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108F3B0 sk_num,BIO_write,sk_value,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,BIO_puts,CRYPTO_free,BIO_puts,BIO_puts,sk_num,BIO_puts,	5_2_1108F3B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110233C0 AES_ctr128_encrypt,AES_encrypt,CRYPTO_ctr128_encrypt,	5_2_110233C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F3C0 SEED_ecb_encrypt,SEED_encrypt,SEED_decrypt,	5_2_1102F3C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A3C0 sk_new,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,	5_2_1106A3C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110023D0 CRYPTO_malloc_locked,	5_2_110023D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110303E0 CRYPTO_nistcts128_decrypt,	5_2_110303E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110373E0 BN_clear_free,CRYPTO_free,	5_2_110373E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110413E0 BN_GF2m_mod_solve_quad,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_solve_quad_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,	5_2_110413E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B23EE sk_value,CMS_RecipientEncryptedKey_cert_cmp,sk_num,CMS_RecipientInfo_kari_set0_pkey,CMS_RecipientInfo_kari_decrypt,CMS_RecipientInfo_kari_set0_pkey,	5_2_110B23EE
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E3E0 ERR_get_state,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_1106E3E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F3F0 SEED_cbc_encrypt,	5_2_1102F3F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002200 CRYPTO_set_mem_debug_functions,OPENSSL_init,	5_2_11002200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018200 DES_cfb_encrypt,DES_encrypt1,DES_encrypt1,	5_2_11018200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11025200 AES_encrypt,	5_2_11025200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105B200 EC_KEY_insert_key_method_data,CRYPTO_lock,CRYPTO_lock,	5_2_1105B200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110CA200 UI_new,CRYPTO_malloc,ERR_put_error,UI_OpenSSL,CRYPTO_new_ex_data,	5_2_110CA200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C9200 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_110C9200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032210 CRYPTO_ccm128_encrypt_ccm64,_memset,	5_2_11032210
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11035210 BN_mod_exp_mont_consttime,BN_set_word,BN_set_word,BN_CTX_start,BN_MONT_CTX_new,BN_MONT_CTX_set,CRYPTO_malloc,_memset,BN_value_one,BN_ucmp,BN_div,BN_is_bit_set,BN_is_bit_set,BN_from_montgomery,BN_MONT_CTX_free,OPENSSL_cleanse,CRYPTO_free,BN_CTX_end,ERR_put_error,	5_2_11035210
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022230 CAST_ecb_encrypt,CAST_encrypt,CAST_decrypt,	5_2_11022230
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082230 ASN1_item_verify,ERR_put_error,ERR_put_error,EVP_MD_CTX_init,OBJ_obj2nid,OBJ_find_sigid_algs,ERR_put_error,ERR_put_error,OBJ_nid2sn,EVP_get_digestbyname,ERR_put_error,EVP_PKEY_type,ERR_put_error,EVP_DigestVerifyInit,ASN1_item_i2d,ERR_put_error,EVP_DigestUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_DigestVerifyFinal,ERR_put_error,EVP_MD_CTX_cleanup,	5_2_11082230
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C2240 CRYPTO_lock,CRYPTO_lock,ERR_put_error,	5_2_110C2240
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002250 CRYPTO_get_mem_functions,	5_2_11002250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E250 RC2_ofb64_encrypt,RC2_encrypt,	5_2_1101E250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11027250 private_AES_set_encrypt_key,	5_2_11027250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045250 RSA_sign_ASN1_OCTET_STRING,i2d_ASN1_OCTET_STRING,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,i2d_ASN1_OCTET_STRING,RSA_private_encrypt,OPENSSL_cleanse,CRYPTO_free,	5_2_11045250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E250 DSO_free,ERR_put_error,CRYPTO_add_lock,ERR_put_error,ERR_put_error,sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_1104E250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C9250 UI_free,sk_pop_free,CRYPTO_free_ex_data,CRYPTO_free,	5_2_110C9250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11027260 private_AES_set_decrypt_key,	5_2_11027260
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D260 a2i_ASN1_INTEGER,BIO_gets,CRYPTO_malloc,CRYPTO_realloc_clean,BIO_gets,ERR_put_error,CRYPTO_free,	5_2_1108D260
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053270 EC_POINT_dup,EC_POINT_new,EC_POINT_copy,CRYPTO_free,	5_2_11053270
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E270 ERR_put_error,ERR_get_state,CRYPTO_free,	5_2_1106E270
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108C280 i2s_ASN1_INTEGER,BIO_puts,CRYPTO_free,	5_2_1108C280
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C9280 ERR_put_error,ERR_put_error,CRYPTO_malloc,	5_2_110C9280
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E290 i2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ERR_put_error,ASN1_put_object,	5_2_1107E290
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110232A0 AES_ecb_encrypt,AES_encrypt,AES_decrypt,	5_2_110232A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110712A0 OBJ_add_sigid,sk_new,sk_new,CRYPTO_malloc,sk_push,CRYPTO_free,sk_push,sk_sort,sk_sort,	5_2_110712A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110022B0 CRYPTO_get_mem_ex_functions,	5_2_110022B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110862B0 X509_INFO_new,CRYPTO_malloc,ERR_put_error,	5_2_110862B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110592C0 BN_new,BN_new,pqueue_peek,X509_TRUST_get_flags,EC_GROUP_get_curve_GFp,ERR_put_error,EC_GROUP_get_curve_GF2m,BN_num_bits,BN_num_bits,CRYPTO_malloc,BN_bn2bin,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,ASN1_STRING_set,ASN1_STRING_set,ASN1_BIT_STRING_new,CRYPTO_malloc,BN_bn2bin,ASN1_OCTET_STRING_set,ASN1_BIT_STRING_free,ERR_put_error,	5_2_110592C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110232D0 AES_cfb128_encrypt,AES_encrypt,CRYPTO_cfb128_encrypt,	5_2_110232D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110302D0 CRYPTO_cts128_decrypt,	5_2_110302D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110372D0 bn_dup_expand,BN_new,CRYPTO_free,BN_new,BN_copy,BN_free,	5_2_110372D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C22D0 ENGINE_init,ERR_put_error,CRYPTO_lock,CRYPTO_lock,	5_2_110C22D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110032E0 __localtime64,BIO_snprintf,BIO_snprintf,X509_TRUST_get_flags,BIO_snprintf,BIO_snprintf,BIO_puts,CRYPTO_THREADID_cpy,_memset,X509_TRUST_get_flags,BIO_snprintf,BUF_strlcpy,BIO_snprintf,BIO_puts,CRYPTO_THREADID_cmp,	5_2_110032E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110502E0 DH_up_ref,CRYPTO_add_lock,	5_2_110502E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110722E0 EVP_DecryptUpdate,ERR_put_error,OpenSSLDie,	5_2_110722E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D2F0 EVP_PKEY_decrypt_init,ERR_put_error,	5_2_1107D2F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094500 _strrchr,OBJ_create,CRYPTO_malloc,OBJ_nid2obj,	5_2_11094500
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004510 ERR_load_CRYPTO_strings,ERR_func_error_string,ERR_load_strings,ERR_load_strings,	5_2_11004510
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002510 CRYPTO_strdup,CRYPTO_malloc,	5_2_11002510
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030510 CRYPTO_cfb128_encrypt,	5_2_11030510
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105A520 i2d_ECPrivateKey,ASN1_item_new,ERR_put_error,BN_num_bits,EC_GROUP_get_degree,ERR_put_error,CRYPTO_malloc,BN_bn2bin,_memset,ASN1_STRING_set,ERR_put_error,CRYPTO_free,ASN1_item_free,ASN1_STRING_type_new,EC_POINT_point2oct,CRYPTO_realloc,EC_POINT_point2oct,ASN1_STRING_set,ERR_put_error,	5_2_1105A520
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061520 CRYPTO_malloc,ERR_put_error,ECDSA_OpenSSL,ENGINE_get_default_ECDSA,EVP_PKEY_CTX_get_app_data,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,	5_2_11061520
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092530 ASN1_STRING_set,CRYPTO_malloc,CRYPTO_realloc,ERR_put_error,	5_2_11092530
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003540 CRYPTO_mem_leaks,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,lh_doall_arg,BIO_printf,CRYPTO_lock,lh_free,lh_num_items,lh_free,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	5_2_11003540
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11091540 CONF_parse_list,i2d_ASN1_TYPE,ASN1_TYPE_free,ASN1_get_object,ASN1_object_size,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,ASN1_put_object,d2i_ASN1_TYPE,CRYPTO_free,CRYPTO_free,	5_2_11091540
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B7540 X509_STORE_CTX_get0_policy_tree,EVP_PKEY_derive,EVP_CipherInit_ex,EVP_CipherUpdate,CRYPTO_malloc,EVP_CipherUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_CIPHER_CTX_cleanup,EVP_PKEY_CTX_free,	5_2_110B7540
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103F550 BN_MONT_CTX_new,CRYPTO_malloc,BN_init,BN_init,BN_init,	5_2_1103F550
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002560 CRYPTO_realloc,CRYPTO_malloc,	5_2_11002560
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001580 CRYPTO_num_locks,	5_2_11001580
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001590 CRYPTO_destroy_dynlockid,CRYPTO_lock,sk_num,sk_value,sk_set,CRYPTO_lock,CRYPTO_free,CRYPTO_lock,	5_2_11001590
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11037590 BN_CTX_new,CRYPTO_malloc,ERR_put_error,	5_2_11037590
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107B590 EVP_PBE_alg_add_type,sk_new,CRYPTO_malloc,ERR_put_error,sk_push,	5_2_1107B590
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E5A0 DSO_set_filename,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,CRYPTO_free,ERR_put_error,	5_2_1104E5A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D5A0 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,_strerror,_strncpy,CRYPTO_lock,	5_2_1106D5A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103F5B0 BN_MONT_CTX_set_locked,CRYPTO_lock,CRYPTO_lock,BN_MONT_CTX_new,BN_MONT_CTX_set,BN_MONT_CTX_free,CRYPTO_lock,BN_MONT_CTX_free,CRYPTO_lock,	5_2_1103F5B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110775B0 EVP_OpenInit,EVP_CIPHER_CTX_init,EVP_DecryptInit_ex,ERR_put_error,CRYPTO_free,RSA_size,CRYPTO_malloc,ERR_put_error,EVP_PKEY_decrypt_old,EVP_CIPHER_CTX_set_key_length,EVP_DecryptInit_ex,OPENSSL_cleanse,CRYPTO_free,	5_2_110775B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110325C0 CRYPTO_ccm128_tag,	5_2_110325C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110725C0 EVP_CIPHER_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,ENGINE_finish,_memset,	5_2_110725C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D5C0 a2i_ASN1_STRING,BIO_gets,CRYPTO_malloc,CRYPTO_realloc,BIO_gets,ERR_put_error,CRYPTO_free,	5_2_1108D5C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108F5C0 BUF_strdup,BUF_strdup,CRYPTO_malloc,sk_push,	5_2_1108F5C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B95D0 CRYPTO_malloc,BUF_strdup,BUF_strdup,sk_new_null,sk_push,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_110B95D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110025E0 CRYPTO_realloc_clean,CRYPTO_malloc,OPENSSL_cleanse,	5_2_110025E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110595E0 BN_new,ERR_put_error,ASN1_item_new,X509_TRUST_get_flags,ENGINE_get_init_function,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,ASN1_OCTET_STRING_new,ASN1_OCTET_STRING_set,EC_GROUP_get_order,BN_to_ASN1_INTEGER,EC_GROUP_get_cofactor,BN_to_ASN1_INTEGER,ERR_put_error,ASN1_item_free,BN_free,CRYPTO_free,	5_2_110595E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110175F0 DES_ecb3_encrypt,DES_encrypt3,DES_decrypt3,	5_2_110175F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110375F0 BN_CTX_free,CRYPTO_free,CRYPTO_free,	5_2_110375F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110925F0 ASN1_STRING_set0,CRYPTO_free,	5_2_110925F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023400 AES_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,	5_2_11023400
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031410 CRYPTO_gcm128_decrypt,	5_2_11031410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032410 CRYPTO_ccm128_decrypt_ccm64,_memset,	5_2_11032410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11078410 EVP_PKEY_free,CRYPTO_add_lock,ENGINE_finish,X509_ATTRIBUTE_free,sk_pop_free,CRYPTO_free,	5_2_11078410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108B410 asn1_do_lock,CRYPTO_add_lock,	5_2_1108B410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020420 BF_decrypt,	5_2_11020420
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F420 SEED_cfb128_encrypt,SEED_encrypt,CRYPTO_cfb128_encrypt,	5_2_1102F420
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11063420 BIO_new,CRYPTO_malloc,ERR_put_error,BIO_set,CRYPTO_free,	5_2_11063420
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E420 X509_PKEY_new,CRYPTO_malloc,X509_ALGOR_new,ASN1_STRING_type_new,X509_PKEY_free,ERR_put_error,	5_2_1108E420
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F430 ERR_print_errors_cb,CRYPTO_THREADID_current,X509_TRUST_get_flags,ERR_get_error_line_data,ERR_error_string_n,BIO_snprintf,ERR_get_error_line_data,	5_2_1106F430
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C440 DES_fcrypt,_memset,DES_set_key_unchecked,	5_2_1101C440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11066440 CRYPTO_malloc,CRYPTO_realloc,	5_2_11066440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A440 sk_insert,CRYPTO_realloc,	5_2_1106A440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072440 EVP_DecryptFinal_ex,ERR_put_error,ERR_put_error,OpenSSLDie,ERR_put_error,ERR_put_error,	5_2_11072440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002450 CRYPTO_free_locked,	5_2_11002450
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F460 SEED_ofb128_encrypt,SEED_encrypt,CRYPTO_ofb128_encrypt,	5_2_1102F460
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081470 BN_to_ASN1_ENUMERATED,ASN1_STRING_type_new,BN_num_bits,CRYPTO_realloc,ERR_put_error,ASN1_STRING_free,BN_bn2bin,	5_2_11081470
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11037480 CRYPTO_malloc,BN_init,	5_2_11037480
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A480 RSA_setup_blinding,BN_CTX_new,BN_CTX_start,BN_CTX_get,ERR_put_error,ERR_put_error,RAND_status,RAND_add,BN_BLINDING_create_param,ERR_put_error,BN_BLINDING_thread_id,CRYPTO_THREADID_current,BN_CTX_end,BN_CTX_free,BN_free,	5_2_1104A480
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B7480 CMS_RecipientEncryptedKey_cert_cmp,	5_2_110B7480
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002490 CRYPTO_malloc,	5_2_11002490
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F490 CRYPTO_cbc128_encrypt,	5_2_1102F490
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11038490 bn_expand2,CRYPTO_malloc,bn_sub_words,CRYPTO_free,	5_2_11038490
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11078490 EVP_PKEY_encrypt_old,ERR_put_error,RSA_public_encrypt,	5_2_11078490
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108B4A0 asn1_enc_free,CRYPTO_free,	5_2_1108B4A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110854A0 i2d_X509_AUX,ASN1_item_i2d,i2d_X509_CERT_AUX,CRYPTO_malloc,CRYPTO_free,	5_2_110854A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B94B0 sk_new_null,CRYPTO_malloc,BUF_strdup,sk_push,CRYPTO_free,	5_2_110B94B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108A4C0 ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,BUF_MEM_grow_clean,ERR_put_error,ERR_put_error,ERR_put_error,asn1_ex_c2i,CRYPTO_free,	5_2_1108A4C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110704D0 OBJ_create,a2d_ASN1_OBJECT,CRYPTO_malloc,ERR_put_error,a2d_ASN1_OBJECT,ASN1_OBJECT_create,OBJ_add_object,ASN1_OBJECT_free,CRYPTO_free,	5_2_110704D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107D4D0 EVP_PKEY_derive_set_peer,ERR_put_error,EVP_PKEY_missing_parameters,EVP_PKEY_cmp_parameters,ERR_put_error,EVP_PKEY_free,CRYPTO_add_lock,ERR_put_error,	5_2_1107D4D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110014E0 CRYPTO_get_new_lockid,sk_new_null,ERR_put_error,BUF_strdup,sk_push,CRYPTO_free,	5_2_110014E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106C4E0 GetVersion,OPENSSL_isservice,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,GetObjectA,CRYPTO_malloc,GetDIBits,EVP_sha1,EVP_Digest,RAND_add,CRYPTO_free,DeleteObject,ReleaseDC,	5_2_1106C4E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110784E0 EVP_PKEY_decrypt_old,ERR_put_error,RSA_private_decrypt,	5_2_110784E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110634F0 BIO_dup_chain,CRYPTO_malloc,BIO_set,BIO_ctrl,CRYPTO_dup_ex_data,BIO_push,CRYPTO_free,ERR_put_error,BIO_free,BIO_free,	5_2_110634F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C4F0 EVP_PKEY_CTX_free,EVP_PKEY_free,EVP_PKEY_free,ENGINE_finish,CRYPTO_free,	5_2_1107C4F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108B4F0 asn1_enc_save,CRYPTO_free,CRYPTO_malloc,	5_2_1108B4F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001700 CRYPTO_get_dynlock_destroy_callback,	5_2_11001700
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A700 sk_dup,sk_new,CRYPTO_realloc,CRYPTO_free,CRYPTO_free,	5_2_1106A700
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11077700 EVP_SealInit,EVP_CIPHER_CTX_init,EVP_EncryptInit_ex,EVP_CIPHER_CTX_rand_key,X509_get_issuer_name,X509_get_issuer_name,RAND_bytes,EVP_EncryptInit_ex,X509_STORE_CTX_get0_policy_tree,EVP_PKEY_encrypt_old,	5_2_11077700
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B9700 CONF_get1_default_config_file,ossl_safe_getenv,BUF_strdup,X509_get_default_cert_area,CRYPTO_malloc,X509_get_default_cert_area,BUF_strlcpy,BUF_strlcat,BUF_strlcat,	5_2_110B9700
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001710 CRYPTO_set_dynlock_create_callback,	5_2_11001710
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101D710 RC2_ecb_encrypt,RC2_encrypt,RC2_decrypt,	5_2_1101D710
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094710 PEM_SignFinal,EVP_PKEY_size,CRYPTO_malloc,ERR_put_error,EVP_SignFinal,EVP_EncodeBlock,CRYPTO_free,	5_2_11094710
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C4710 ENGINE_pkey_asn1_find_str,CRYPTO_lock,CRYPTO_lock,	5_2_110C4710
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002720 CRYPTO_set_mem_debug_options,	5_2_11002720
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001720 CRYPTO_set_dynlock_lock_callback,	5_2_11001720
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A720 Camellia_ctr128_encrypt,Camellia_encrypt,CRYPTO_ctr128_encrypt,	5_2_1102A720
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036720 ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,	5_2_11036720
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045720 RSA_padding_check_PKCS1_type_2,CRYPTO_malloc,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,ERR_put_error,	5_2_11045720
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002730 CRYPTO_get_mem_debug_options,	5_2_11002730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001730 CRYPTO_set_dynlock_destroy_callback,	5_2_11001730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044730 RSA_new_method,CRYPTO_malloc,ERR_put_error,_memset,RSA_PKCS1_SSLeay,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_RSA,UI_get0_user_data,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,	5_2_11044730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052730 CMS_SharedInfo_encode,CRYPTO_memcmp,	5_2_11052730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072730 EVP_CIPHER_CTX_copy,ENGINE_init,ERR_put_error,EVP_CIPHER_CTX_cleanup,CRYPTO_malloc,ERR_put_error,ERR_put_error,	5_2_11072730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11082730 ASN1_mbstring_ncopy,UTF8_getc,ERR_put_error,BIO_snprintf,ERR_add_error_data,ERR_put_error,BIO_snprintf,ERR_add_error_data,CRYPTO_free,ASN1_STRING_type_new,ASN1_STRING_set,CRYPTO_malloc,ASN1_STRING_free,ERR_put_error,	5_2_11082730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002740 CRYPTO_free,	5_2_11002740
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001740 CRYPTO_get_locking_callback,	5_2_11001740
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001750 CRYPTO_get_add_lock_callback,	5_2_11001750
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088750 ASN1_template_new,ASN1_primitive_new,CRYPTO_malloc,_memset,asn1_set_choice_selector,CRYPTO_malloc,_memset,asn1_do_lock,asn1_enc_init,asn1_get_field_ptr,ASN1_template_new,ERR_put_error,ERR_put_error,	5_2_11088750
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C1750 ERR_put_error,CRYPTO_add_lock,CRYPTO_free_ex_data,CRYPTO_free,	5_2_110C1750
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003760 CRYPTO_mem_leaks_fp,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,BIO_s_file,BIO_new,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,BIO_ctrl,CRYPTO_mem_leaks,BIO_free,	5_2_11003760
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001760 CRYPTO_set_locking_callback,	5_2_11001760
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D760 ERR_free_strings,CRYPTO_lock,CRYPTO_lock,	5_2_1106D760
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E760 i2a_ASN1_OBJECT,OBJ_obj2txt,CRYPTO_malloc,OBJ_obj2txt,BIO_write,BIO_write,CRYPTO_free,BIO_write,	5_2_1107E760
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110A6760 string_to_hex,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,CRYPTO_free,CRYPTO_free,ERR_put_error,	5_2_110A6760
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002770 CRYPTO_mem_ctrl,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,	5_2_11002770
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001770 CRYPTO_set_add_lock_callback,	5_2_11001770
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11040770 BN_GF2m_mod_mul,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_mul_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,	5_2_11040770
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001780 CRYPTO_THREADID_set_numeric,	5_2_11001780
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062780 BUF_MEM_new,CRYPTO_malloc,ERR_put_error,	5_2_11062780
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001790 CRYPTO_THREADID_set_pointer,	5_2_11001790
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061790 ECDSA_get_ex_new_index,CRYPTO_get_ex_new_index,	5_2_11061790
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A790 sk_deep_copy,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_1106A790
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F790 OBJ_NAME_remove,lh_delete,sk_num,sk_value,CRYPTO_free,	5_2_1106F790
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110017A0 CRYPTO_THREADID_set_callback,	5_2_110017A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110227B0 CAST_decrypt,	5_2_110227B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110947B0 PEM_SealInit,RSA_size,CRYPTO_malloc,ERR_put_error,ERR_put_error,EVP_EncodeInit,EVP_MD_CTX_init,EVP_DigestInit,EVP_CIPHER_CTX_init,EVP_SealInit,RSA_size,EVP_EncodeBlock,CRYPTO_free,OPENSSL_cleanse,	5_2_110947B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110017C0 CRYPTO_THREADID_get_callback,	5_2_110017C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110627C0 BUF_MEM_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	5_2_110627C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D7C0 ERR_get_string_table,CRYPTO_lock,CRYPTO_lock,	5_2_1106D7C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110017D0 CRYPTO_THREADID_current,GetCurrentThreadId,	5_2_110017D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110897E0 sk_num,sk_num,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,sk_num,sk_value,ASN1_item_ex_i2d,sk_num,sk_num,sk_value,ASN1_item_ex_i2d,sk_num,sk_num,sk_num,sk_num,sk_num,sk_set,sk_num,CRYPTO_free,CRYPTO_free,	5_2_110897E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110707F0 OBJ_obj2txt,OBJ_obj2nid,OBJ_nid2ln,OBJ_nid2sn,BUF_strlcpy,BN_add_word,BN_new,BN_set_word,BN_lshift,BN_sub_word,BN_bn2dec,BUF_strlcpy,CRYPTO_free,BIO_snprintf,BUF_strlcpy,BN_free,BN_free,	5_2_110707F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A600 Camellia_ecb_encrypt,Camellia_encrypt,Camellia_decrypt,	5_2_1102A600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102E600 SEED_decrypt,	5_2_1102E600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032600 CRYPTO_xts128_encrypt,	5_2_11032600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061600 ENGINE_finish,CRYPTO_free_ex_data,OPENSSL_cleanse,CRYPTO_free,	5_2_11061600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F600 OBJ_NAME_new_index,CRYPTO_mem_ctrl,sk_new_null,CRYPTO_mem_ctrl,sk_num,CRYPTO_mem_ctrl,CRYPTO_malloc,CRYPTO_mem_ctrl,CRYPTO_mem_ctrl,sk_push,CRYPTO_mem_ctrl,sk_value,ERR_put_error,	5_2_1106F600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C610 DES_crypt,DES_fcrypt,	5_2_1101C610
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036610 BN_clear_free,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	5_2_11036610
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A610 sk_free,CRYPTO_free,CRYPTO_free,	5_2_1106A610
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088610 ASN1_primitive_new,OBJ_nid2obj,CRYPTO_malloc,ASN1_STRING_type_new,	5_2_11088610
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11095620 PEM_do_header,PEM_def_callback,ERR_put_error,d2i_X509,EVP_md5,EVP_BytesToKey,EVP_CIPHER_CTX_init,EVP_DecryptInit_ex,EVP_DecryptUpdate,EVP_DecryptFinal_ex,EVP_CIPHER_CTX_cleanup,OPENSSL_cleanse,OPENSSL_cleanse,ERR_put_error,	5_2_11095620
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C630 DES_xcbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,	5_2_1101C630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A630 Camellia_ofb128_encrypt,Camellia_encrypt,CRYPTO_ofb128_encrypt,	5_2_1102A630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F630 CRYPTO_cbc128_decrypt,	5_2_1102F630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062630 ECDSA_verify,ECDSA_SIG_new,d2i_ECDSA_SIG,i2d_ECDSA_SIG,OPENSSL_cleanse,CRYPTO_free,ECDSA_SIG_free,	5_2_11062630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092630 ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,	5_2_11092630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1109B650 X509_NAME_oneline,BUF_MEM_new,BUF_MEM_grow,CRYPTO_free,_strncpy,sk_num,CRYPTO_free,sk_value,OBJ_obj2nid,OBJ_nid2sn,i2t_ASN1_OBJECT,BUF_MEM_grow,sk_num,ERR_put_error,BUF_MEM_free,ERR_put_error,BUF_MEM_free,	5_2_1109B650
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001660 CRYPTO_get_dynlock_value,CRYPTO_lock,sk_num,sk_value,CRYPTO_lock,	5_2_11001660
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F660 idea_cfb64_encrypt,idea_encrypt,idea_encrypt,	5_2_1101F660
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A660 Camellia_cfb128_encrypt,Camellia_encrypt,CRYPTO_cfb128_encrypt,	5_2_1102A660
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036670 BN_free,CRYPTO_free,CRYPTO_free,	5_2_11036670
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031670 CRYPTO_gcm128_encrypt_ctr32,	5_2_11031670
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092680 ASN1_STRING_free,CRYPTO_free,CRYPTO_free,	5_2_11092680
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107F690 ASN1_GENERALIZEDTIME_adj,ASN1_STRING_type_new,OPENSSL_gmtime,OPENSSL_gmtime_adj,CRYPTO_malloc,ERR_put_error,CRYPTO_free,BIO_snprintf,	5_2_1107F690
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B7690 CMS_RecipientInfo_kari_decrypt,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	5_2_110B7690
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110196A0 DES_pcbc_encrypt,DES_encrypt1,DES_encrypt1,	5_2_110196A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A6A0 Camellia_cfb1_encrypt,Camellia_encrypt,CRYPTO_cfb128_1_encrypt,	5_2_1102A6A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110586A0 pqueue_peek,ENGINE_get_pkey_asn1_meths,X509_TRUST_get_flags,EVP_MD_block_size,ENGINE_get_finish_function,BN_CTX_start,BN_num_bits,BN_num_bits,CRYPTO_malloc,BN_CTX_get,X509_TRUST_get_flags,EC_GROUP_get_order,CRYPTO_free,BN_CTX_end,	5_2_110586A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D6A0 CRYPTO_free,	5_2_1106D6A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108E6A0 i2d_ASN1_BOOLEAN,ASN1_object_size,CRYPTO_malloc,ERR_put_error,ASN1_put_object,	5_2_1108E6A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110806B0 i2d_ASN1_SET,sk_num,sk_value,sk_value,ASN1_object_size,ASN1_put_object,sk_num,sk_num,CRYPTO_malloc,sk_num,sk_value,sk_num,sk_num,CRYPTO_malloc,ERR_put_error,sk_num,sk_num,CRYPTO_free,CRYPTO_free,sk_num,sk_value,sk_num,	5_2_110806B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110876B0 X509_NAME_print,X509_NAME_oneline,CRYPTO_free,BIO_write,BIO_write,ERR_put_error,CRYPTO_free,	5_2_110876B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110926B0 ASN1_STRING_clear_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	5_2_110926B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C16B0 ENGINE_new,CRYPTO_malloc,ERR_put_error,_memset,CRYPTO_new_ex_data,	5_2_110C16B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110026D0 CRYPTO_remalloc,CRYPTO_malloc,	5_2_110026D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110176D0 DES_cfb64_encrypt,DES_encrypt1,DES_encrypt1,	5_2_110176D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110366D0 BN_new,CRYPTO_malloc,ERR_put_error,	5_2_110366D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110776D0 EVP_OpenFinal,EVP_DecryptFinal_ex,EVP_DecryptInit_ex,	5_2_110776D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110016E0 CRYPTO_get_dynlock_create_callback,	5_2_110016E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A6E0 Camellia_cfb8_encrypt,Camellia_encrypt,CRYPTO_cfb128_8_encrypt,	5_2_1102A6E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110966E0 PEM_ASN1_write_bio,pqueue_peek,OBJ_nid2sn,X509_TRUST_get0_name,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,PEM_def_callback,ERR_put_error,RAND_add,OpenSSLDie,RAND_bytes,EVP_md5,EVP_BytesToKey,OPENSSL_cleanse,OpenSSLDie,PEM_proc_type,PEM_dek_info,EVP_CIPHER_CTX_init,EVP_EncryptInit_ex,EVP_EncryptUpdate,EVP_EncryptFinal_ex,EVP_CIPHER_CTX_cleanup,PEM_write_bio,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_free,	5_2_110966E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110016F0 CRYPTO_get_dynlock_lock_callback,	5_2_110016F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E6F0 DSO_convert_filename,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,	5_2_1104E6F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003900 CRYPTO_mem_leaks_cb,CRYPTO_lock,lh_doall_arg,CRYPTO_lock,	5_2_11003900
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F900 CRYPTO_ctr128_encrypt,	5_2_1102F900
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11067900 BIO_get_port,ERR_put_error,CRYPTO_lock,getservbyname,htons,CRYPTO_lock,WSAGetLastError,ERR_put_error,ERR_add_error_data,	5_2_11067900
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E910 idea_encrypt,	5_2_1101E910
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030910 CRYPTO_cfb128_1_encrypt,	5_2_11030910
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053910 EC_GROUP_precompute_mult,X509_TRUST_get_flags,BN_CTX_new,BN_CTX_start,BN_CTX_get,EC_GROUP_get_order,BN_num_bits,CRYPTO_malloc,EC_POINT_new,EC_POINT_new,EC_POINT_new,EC_POINT_copy,EC_POINT_dbl,EC_POINT_copy,EC_POINT_add,EC_POINT_dbl,EC_POINT_dbl,EC_POINTs_make_affine,ERR_put_error,BN_CTX_end,BN_CTX_free,EC_POINT_free,CRYPTO_free,EC_POINT_free,EC_POINT_free,	5_2_11053910
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11059920 BN_bin2bn,ERR_put_error,BN_bin2bn,OBJ_obj2nid,ERR_put_error,BN_new,ERR_put_error,OBJ_obj2nid,ERR_put_error,ASN1_INTEGER_get,BN_set_bit,ERR_put_error,ERR_put_error,BN_set_bit,BN_set_bit,BN_set_bit,BN_set_bit,BN_set_bit,EC_GROUP_new_curve_GF2m,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ASN1_INTEGER_to_BN,ERR_put_error,BN_num_bits,ERR_put_error,EC_GROUP_new_curve_GFp,ERR_put_error,CRYPTO_free,CRYPTO_malloc,EC_POINT_new,EC_GROUP_set_point_conversion_form,EC_POINT_oct2point,ASN1_INTEGER_to_BN,BN_num_bits,ERR_put_error,EC_GROUP_free,EC_GROUP_free,BN_free,BN_free,BN_free,EC_POINT_free,BN_CTX_free,BN_free,EC_GROUP_set_generator,ASN1_INTEGER_to_BN,BN_CTX_new,EC_GROUP_dup,EC_GROUP_set_seed,EC_GROUP_set_generator,EC_GROUP_new_by_curve_name,EC_GROUP_free,EC_GROUP_set_asn1_flag,EC_GROUP_set_seed,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,	5_2_11059920
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11014940 CMAC_CTX_new,CRYPTO_malloc,EVP_CIPHER_CTX_init,	5_2_11014940
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002950 CRYPTO_dbg_set_options,	5_2_11002950
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002960 CRYPTO_dbg_get_options,	5_2_11002960
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D960 ERR_func_error_string,CRYPTO_lock,CRYPTO_lock,	5_2_1106D960
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E980 c2i_ASN1_OBJECT,ASN1_OBJECT_new,ERR_put_error,CRYPTO_free,CRYPTO_malloc,ERR_put_error,ASN1_OBJECT_free,	5_2_1107E980
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094980 PEM_SealUpdate,EVP_DigestUpdate,EVP_EncryptUpdate,EVP_EncodeUpdate,	5_2_11094980
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110039A0 CRYPTO_get_ex_data_implementation,CRYPTO_lock,CRYPTO_lock,	5_2_110039A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110309B0 CRYPTO_cfb128_8_encrypt,	5_2_110309B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110329B0 CRYPTO_128_wrap,	5_2_110329B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101A9C0 DES_encrypt1,	5_2_1101A9C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104B9C0 DSA_new_method,CRYPTO_malloc,ERR_put_error,DSA_OpenSSL,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_DSA,X509_TRUST_get0_name,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,	5_2_1104B9C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C9C0 EVP_PKEY_meth_get_encrypt,	5_2_1107C9C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110369D0 BN_set_word,CRYPTO_free,	5_2_110369D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106A9D0 sk_pop_free,CRYPTO_free,CRYPTO_free,	5_2_1106A9D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110719D0 EVP_MD_CTX_create,CRYPTO_malloc,	5_2_110719D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110939D0 ASN1_pack_string,ASN1_STRING_new,ERR_put_error,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,	5_2_110939D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110149E0 CMAC_CTX_free,CMAC_CTX_cleanup,CRYPTO_free,	5_2_110149E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C9E0 EVP_PKEY_meth_get_decrypt,	5_2_1107C9E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110899E0 ASN1_item_ex_i2d,CRYPTO_malloc,ASN1_item_ex_i2d,ASN1_item_ex_i2d,	5_2_110899E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110029F0 CRYPTO_THREADID_current,lh_delete,lh_insert,CRYPTO_free,	5_2_110029F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110039F0 CRYPTO_set_ex_data_implementation,CRYPTO_lock,CRYPTO_lock,	5_2_110039F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110449F0 RSA_up_ref,CRYPTO_add_lock,	5_2_110449F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D9F0 ERR_reason_error_string,CRYPTO_lock,CRYPTO_lock,	5_2_1106D9F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110819F0 ASN1_sign,EVP_MD_CTX_init,ASN1_TYPE_free,ASN1_TYPE_free,ASN1_TYPE_new,ASN1_OBJECT_free,OBJ_nid2obj,CRYPTO_malloc,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_SignFinal,CRYPTO_free,ERR_put_error,EVP_MD_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	5_2_110819F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11061800 ECDSA_METHOD_new,CRYPTO_malloc,ERR_put_error,	5_2_11061800
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062800 BUF_MEM_grow,_memset,ERR_put_error,CRYPTO_malloc,CRYPTO_realloc,ERR_put_error,_memset,	5_2_11062800
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11091800 sk_new_null,X509V3_get_section,sk_num,sk_value,sk_push,sk_num,i2d_ASN1_SET_ANY,i2d_ASN1_SEQUENCE_ANY,ASN1_TYPE_new,ASN1_STRING_type_new,CRYPTO_free,ASN1_TYPE_free,sk_pop_free,X509V3_section_free,	5_2_11091800
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001810 CRYPTO_THREADID_cmp,	5_2_11001810
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A820 Camellia_encrypt,	5_2_1102A820
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11036820 bn_expand2,CRYPTO_free,	5_2_11036820
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11040820 BN_GF2m_mod_sqr,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_sqr_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,	5_2_11040820
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D820 ERR_get_err_state_table,CRYPTO_lock,CRYPTO_lock,	5_2_1106D820
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C830 EVP_PKEY_meth_set_encrypt,	5_2_1107C830
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018840 DES_ede3_ofb64_encrypt,DES_encrypt3,	5_2_11018840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020840 BF_cbc_encrypt,BF_encrypt,BF_decrypt,BF_decrypt,	5_2_11020840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11026840 AES_decrypt,	5_2_11026840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102D840 SEED_encrypt,	5_2_1102D840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110C1840 sk_new_null,CRYPTO_malloc,sk_push,CRYPTO_free,	5_2_110C1840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052850 DH_KDF_X9_42,EVP_MD_size,EVP_MD_CTX_init,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestFinal,OPENSSL_cleanse,CRYPTO_free,EVP_MD_CTX_cleanup,	5_2_11052850
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072850 EVP_CipherInit_ex,EVP_CIPHER_CTX_cleanup,ENGINE_init,ERR_put_error,ENGINE_get_cipher_engine,ENGINE_get_cipher,CRYPTO_malloc,ERR_put_error,EVP_CIPHER_CTX_ctrl,ERR_put_error,OpenSSLDie,EVP_CIPHER_CTX_flags,ERR_put_error,EVP_CIPHER_CTX_flags,EVP_CIPHER_CTX_flags,X509_get_issuer_name,OpenSSLDie,X509_get_issuer_name,X509_get_issuer_name,X509_get_issuer_name,	5_2_11072850
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107C850 EVP_PKEY_meth_set_decrypt,	5_2_1107C850
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F860 idea_ofb64_encrypt,idea_encrypt,	5_2_1101F860
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001870 CRYPTO_THREADID_cpy,	5_2_11001870
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031870 CRYPTO_gcm128_decrypt_ctr32,	5_2_11031870
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104F870 d2i_DHxparams,DH_new,ASN1_item_d2i,DH_free,DH_free,ASN1_BIT_STRING_free,CRYPTO_free,CRYPTO_free,	5_2_1104F870
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E870 ASN1_OBJECT_new,CRYPTO_malloc,ERR_put_error,	5_2_1107E870
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11077870 EVP_SealFinal,EVP_EncryptFinal_ex,EVP_EncryptInit_ex,	5_2_11077870
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D880 ERR_release_err_state_table,CRYPTO_lock,CRYPTO_lock,	5_2_1106D880
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001890 CRYPTO_get_id_callback,	5_2_11001890
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110018A0 CRYPTO_set_id_callback,	5_2_110018A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110238A0 AES_bi_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,	5_2_110238A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110018B0 CRYPTO_thread_id,GetCurrentThreadId,	5_2_110018B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106E8B0 ERR_peek_error,ERR_get_state,CRYPTO_free,CRYPTO_free,	5_2_1106E8B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108D8B0 i2d_RSA_NET,EVP_CIPHER_CTX_init,ASN1_item_new,ASN1_item_new,OBJ_nid2obj,ASN1_TYPE_new,i2d_RSAPrivateKey,ASN1_item_i2d,OBJ_nid2obj,ASN1_TYPE_new,CRYPTO_malloc,ERR_put_error,i2d_RSAPrivateKey,CRYPTO_malloc,ASN1_STRING_set,OPENSSL_cleanse,ERR_put_error,EVP_md5,EVP_Digest,EVP_md5,EVP_rc4,EVP_BytesToKey,OPENSSL_cleanse,EVP_rc4,EVP_EncryptInit_ex,EVP_EncryptUpdate,EVP_EncryptFinal_ex,EVP_CIPHER_CTX_cleanup,ASN1_item_free,ASN1_item_free,	5_2_1108D8B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110178C0 DES_ede3_cfb64_encrypt,DES_encrypt3,DES_encrypt3,	5_2_110178C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E8C0 ASN1_OBJECT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_1107E8C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110028D0 CRYPTO_is_mem_check_on,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_THREADID_cmp,CRYPTO_lock,	5_2_110028D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110018D0 CRYPTO_get_lock_name,sk_num,sk_value,	5_2_110018D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110448D0 RSA_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_BLINDING_free,BN_BLINDING_free,CRYPTO_free_locked,CRYPTO_free,	5_2_110448D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110938D0 ASN1_seq_pack,i2d_ASN1_SET,ERR_put_error,CRYPTO_malloc,ERR_put_error,i2d_ASN1_SET,	5_2_110938D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110958D0 PEM_write_bio,EVP_EncodeInit,BIO_write,BIO_write,BIO_write,BIO_write,BIO_write,CRYPTO_malloc,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,EVP_EncodeUpdate,BIO_write,EVP_EncodeFinal,BIO_write,OPENSSL_cleanse,CRYPTO_free,BIO_write,BIO_write,BIO_write,	5_2_110958D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101D8E0 RC2_encrypt,	5_2_1101D8E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106D8E0 ERR_lib_error_string,CRYPTO_lock,CRYPTO_lock,	5_2_1106D8E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110628E0 BUF_MEM_grow_clean,_memset,_memset,ERR_put_error,CRYPTO_malloc,CRYPTO_realloc_clean,ERR_put_error,_memset,	5_2_110628E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110268F0 AES_cbc_encrypt,	5_2_110268F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106F8F0 OBJ_NAME_do_all_sorted,lh_num_items,CRYPTO_malloc,lh_doall_arg,CRYPTO_free,	5_2_1106F8F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103EB00 BN_RECP_CTX_free,BN_free,BN_free,CRYPTO_free,	5_2_1103EB00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11013B10 DES_set_odd_parity,DES_set_key_unchecked,DES_encrypt1,DES_set_odd_parity,DES_set_key_unchecked,DES_encrypt1,	5_2_11013B10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101FB10 idea_set_encrypt_key,	5_2_1101FB10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AB10 EC_KEY_new,CRYPTO_malloc,ERR_put_error,	5_2_1105AB10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1108FB10 BUF_strdup,BUF_strdup,CRYPTO_malloc,sk_new,	5_2_1108FB10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AB20 DES_encrypt3,DES_encrypt2,DES_encrypt2,DES_encrypt2,	5_2_1101AB20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104BB20 DSA_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,CRYPTO_free,	5_2_1104BB20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053B30 EC_GROUP_clear_free,BN_MONT_CTX_free,EC_POINT_clear_free,BN_clear_free,BN_clear_free,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	5_2_11053B30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DB30 ERR_remove_state,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_lock,	5_2_1106DB30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072B30 EVP_CipherUpdate,EVP_DecryptUpdate,	5_2_11072B30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088B30 ASN1_primitive_free,ASN1_OBJECT_free,ASN1_primitive_free,CRYPTO_free,ASN1_STRING_free,	5_2_11088B30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11038B40 BN_bn2hex,CRYPTO_strdup,CRYPTO_malloc,ERR_put_error,	5_2_11038B40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031B40 CRYPTO_gcm128_tag,CRYPTO_gcm128_finish,	5_2_11031B40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AB40 CRYPTO_realloc,_memset,	5_2_1106AB40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11095B40 PEM_read_bio,BUF_MEM_new,BUF_MEM_new,BUF_MEM_new,BIO_gets,_strncmp,_strncmp,BIO_gets,BUF_MEM_grow,BUF_MEM_grow,BIO_gets,BUF_MEM_grow,_strncmp,BIO_gets,BUF_MEM_grow,BIO_gets,_strncmp,BUF_MEM_grow_clean,BIO_gets,BIO_gets,_strncmp,_strncmp,_strncmp,EVP_DecodeInit,EVP_DecodeUpdate,EVP_DecodeFinal,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_put_error,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,BUF_MEM_free,ERR_put_error,	5_2_11095B40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11080B50 ASN1_dup,CRYPTO_malloc,ERR_put_error,CRYPTO_free,	5_2_11080B50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11058B60 EC_POINT_point2bn,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,CRYPTO_free,BN_bin2bn,CRYPTO_free,	5_2_11058B60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AB70 EC_KEY_free,CRYPTO_add_lock,EC_GROUP_free,EC_POINT_free,BN_clear_free,OPENSSL_cleanse,CRYPTO_free,	5_2_1105AB70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101DB80 RC2_cbc_encrypt,RC2_encrypt,RC2_encrypt,RC2_decrypt,RC2_decrypt,	5_2_1101DB80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031B80 CRYPTO_gcm128_new,CRYPTO_malloc,CRYPTO_gcm128_init,	5_2_11031B80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072B80 EVP_EncryptInit_ex,EVP_CipherInit_ex,	5_2_11072B80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FB90 CRYPTO_cts128_encrypt_block,CRYPTO_cbc128_encrypt,	5_2_1102FB90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107CB90 EVP_PKEY_CTX_new,ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,	5_2_1107CB90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092BA0 d2i_ASN1_type_bytes,ASN1_get_object,ASN1_tag2bit,d2i_ASN1_BIT_STRING,ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	5_2_11092BA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DBB0 ERR_get_state,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cpy,CRYPTO_malloc,CRYPTO_THREADID_cpy,	5_2_1106DBB0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072BB0 EVP_DecryptInit_ex,EVP_CipherInit_ex,	5_2_11072BB0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094BB0 PEM_X509_INFO_read_bio,sk_new_null,ERR_put_error,X509_INFO_new,PEM_read_bio,sk_push,X509_INFO_new,X509_PKEY_new,X509_PKEY_new,X509_PKEY_new,PEM_get_EVP_CIPHER_INFO,PEM_do_header,d2i_PrivateKey,d2i_X509,ERR_put_error,X509_INFO_free,sk_num,sk_value,X509_INFO_free,sk_num,sk_free,PEM_get_EVP_CIPHER_INFO,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_last_error,ERR_clear_error,sk_push,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_11094BB0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003BC0 CRYPTO_malloc,ERR_put_error,CRYPTO_lock,sk_num,sk_push,sk_num,sk_set,CRYPTO_lock,ERR_put_error,CRYPTO_free,	5_2_11003BC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031BC0 CRYPTO_gcm128_release,OPENSSL_cleanse,CRYPTO_free,	5_2_11031BC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044BC0 RSA_sign,ERR_put_error,OBJ_nid2obj,ERR_put_error,ERR_put_error,i2d_X509_SIG,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,i2d_X509_SIG,RSA_private_encrypt,OPENSSL_cleanse,CRYPTO_free,	5_2_11044BC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031BE0 CRYPTO_ccm128_init,	5_2_11031BE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053BE0 EC_GROUP_copy,ERR_put_error,ERR_put_error,BN_MONT_CTX_new,BN_MONT_CTX_copy,BN_MONT_CTX_free,EC_POINT_new,EC_POINT_copy,EC_POINT_clear_free,BN_copy,BN_copy,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,	5_2_11053BE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106FBE0 OBJ_NAME_add,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,CRYPTO_malloc,lh_insert,sk_num,sk_value,CRYPTO_free,CRYPTO_free,	5_2_1106FBE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11080BE0 ASN1_item_dup,ASN1_item_i2d,ERR_put_error,ASN1_item_d2i,CRYPTO_free,	5_2_11080BE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11083BE0 X509_PUBKEY_get,CRYPTO_add_lock,EVP_PKEY_new,OBJ_obj2nid,EVP_PKEY_set_type,CRYPTO_lock,CRYPTO_lock,EVP_PKEY_free,CRYPTO_lock,CRYPTO_add_lock,ERR_put_error,EVP_PKEY_free,	5_2_11083BE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CBF0 DES_cbc_cksum,DES_encrypt1,	5_2_1101CBF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11056BF0 CRYPTO_malloc,ERR_put_error,	5_2_11056BF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11058BF0 EC_POINT_bn2point,BN_num_bits,CRYPTO_malloc,BN_bn2bin,CRYPTO_free,EC_POINT_new,EC_POINT_oct2point,EC_POINT_clear_free,CRYPTO_free,CRYPTO_free,	5_2_11058BF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102CA00 Camellia_cbc_encrypt,	5_2_1102CA00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030A00 CRYPTO_ofb128_encrypt,	5_2_11030A00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AA00 i2o_ECPublicKey,ERR_put_error,EC_POINT_point2oct,CRYPTO_malloc,ERR_put_error,EC_POINT_point2oct,ERR_put_error,CRYPTO_free,	5_2_1105AA00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11071A00 EVP_DigestInit_ex,EVP_MD_CTX_clear_flags,ENGINE_finish,ENGINE_init,ERR_put_error,ENGINE_get_digest_engine,ENGINE_get_digest,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,	5_2_11071A00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101DA20 RC2_decrypt,	5_2_1101DA20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044A20 RSA_get_ex_new_index,CRYPTO_get_ex_new_index,	5_2_11044A20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AA20 lh_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_1106AA20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003A40 CRYPTO_lock,pqueue_peek,lh_new,CRYPTO_lock,	5_2_11003A40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107CA40 ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,	5_2_1107CA40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FA50 CRYPTO_ctr128_encrypt_ctr32,	5_2_1102FA50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052A50 EC_GROUP_new,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BN_init,BN_init,CRYPTO_free,	5_2_11052A50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106EA50 ERR_peek_error_line,ERR_get_state,CRYPTO_free,CRYPTO_free,	5_2_1106EA50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101FA60 idea_ecb_encrypt,idea_encrypt,	5_2_1101FA60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062A60 BUF_strndup,CRYPTO_malloc,ERR_put_error,	5_2_11062A60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11094A60 PEM_SealFinal,ERR_put_error,RSA_size,CRYPTO_malloc,ERR_put_error,EVP_EncryptFinal_ex,EVP_EncodeUpdate,EVP_EncodeFinal,EVP_SignFinal,EVP_EncodeBlock,EVP_MD_CTX_cleanup,EVP_CIPHER_CTX_cleanup,CRYPTO_free,	5_2_11094A60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002A70 CRYPTO_push_info_,CRYPTO_is_mem_check_on,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_malloc,lh_new,CRYPTO_free,CRYPTO_THREADID_current,lh_insert,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	5_2_11002A70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018A70 DES_enc_read,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,__read,__read,DES_pcbc_encrypt,DES_cbc_encrypt,DES_pcbc_encrypt,DES_cbc_encrypt,DES_pcbc_encrypt,DES_cbc_encrypt,	5_2_11018A70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031A70 CRYPTO_gcm128_finish,CRYPTO_memcmp,	5_2_11031A70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044A70 RSA_memory_lock,CRYPTO_malloc_locked,ERR_put_error,BN_clear_free,	5_2_11044A70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020A80 BF_cfb64_encrypt,BF_encrypt,BF_encrypt,	5_2_11020A80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11053A90 EC_GROUP_free,BN_MONT_CTX_free,CRYPTO_free,BN_free,BN_free,CRYPTO_free,CRYPTO_free,	5_2_11053A90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003AA0 ASN1_PCTX_free,sk_pop_free,CRYPTO_free,	5_2_11003AA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11014AA0 CMAC_Init,EVP_EncryptInit_ex,X509_get_serialNumber,_memset,EVP_EncryptInit_ex,pqueue_peek,EVP_CIPHER_CTX_set_key_length,EVP_EncryptInit_ex,X509_get_serialNumber,EVP_Cipher,OPENSSL_cleanse,EVP_EncryptInit_ex,_memset,	5_2_11014AA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DAA0 ERR_remove_thread_state,CRYPTO_THREADID_cpy,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_lock,	5_2_1106DAA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11093AA0 ASN1_item_pack,ASN1_STRING_new,ERR_put_error,CRYPTO_free,ASN1_item_i2d,ERR_put_error,	5_2_11093AA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103EAB0 BN_RECP_CTX_new,CRYPTO_malloc,BN_init,BN_init,	5_2_1103EAB0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003AC0 CRYPTO_lock,lh_retrieve,CRYPTO_malloc,sk_new_null,CRYPTO_free,lh_insert,lh_retrieve,sk_free,CRYPTO_free,CRYPTO_lock,ERR_put_error,	5_2_11003AC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AAC0 DES_encrypt2,	5_2_1101AAC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092AD0 ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,	5_2_11092AD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D3AD0 CRYPTO_malloc,BUF_strdup,BN_bin2bn,CRYPTO_free,CRYPTO_free,	5_2_110D3AD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11017AE0 DES_ede3_cfb_encrypt,DES_encrypt3,DES_encrypt3,	5_2_11017AE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062AE0 BUF_memdup,CRYPTO_malloc,ERR_put_error,	5_2_11062AE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11089AE0 asn1_ex_c2i,ASN1_TYPE_new,ASN1_TYPE_set,c2i_ASN1_OBJECT,ERR_put_error,ASN1_TYPE_free,c2i_ASN1_BIT_STRING,c2i_ASN1_INTEGER,ASN1_STRING_type_new,CRYPTO_free,ASN1_STRING_set,ERR_put_error,ASN1_STRING_free,	5_2_11089AE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032AF0 CRYPTO_128_unwrap,OPENSSL_cleanse,	5_2_11032AF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045AF0 RSA_padding_check_SSLv23,CRYPTO_malloc,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,ERR_put_error,	5_2_11045AF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106FAF0 OBJ_NAME_init,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,	5_2_1106FAF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072D20 EVP_DecryptInit,_memset,EVP_CipherInit_ex,	5_2_11072D20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11070D30 OBJ_txt2obj,OBJ_sn2nid,OBJ_ln2nid,OBJ_nid2obj,a2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,a2d_ASN1_OBJECT,d2i_ASN1_OBJECT,CRYPTO_free,	5_2_11070D30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11052D40 EC_GROUP_set_seed,CRYPTO_free,CRYPTO_malloc,	5_2_11052D40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DD40 ERR_set_error_data,ERR_get_state,CRYPTO_free,	5_2_1106DD40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11077D40 EVP_PKEY_new,CRYPTO_malloc,ERR_put_error,	5_2_11077D40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11071D50 EVP_MD_CTX_copy_ex,ENGINE_init,ERR_put_error,EVP_MD_CTX_set_flags,EVP_MD_CTX_cleanup,EVP_PKEY_CTX_dup,EVP_MD_CTX_cleanup,CRYPTO_malloc,ERR_put_error,ERR_put_error,	5_2_11071D50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018D60 DES_enc_write,CRYPTO_malloc,DES_enc_write,RAND_bytes,_shadow_DES_rw_mode,DES_pcbc_encrypt,DES_cbc_encrypt,__locking,	5_2_11018D60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031D60 CRYPTO_ccm128_encrypt,_memset,	5_2_11031D60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11056D60 CRYPTO_malloc,BN_num_bits,CRYPTO_malloc,BN_is_bit_set,ERR_put_error,CRYPTO_free,	5_2_11056D60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1105AD70 EC_KEY_up_ref,CRYPTO_add_lock,	5_2_1105AD70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11084D70 CRYPTO_free,sk_num,sk_new_null,sk_num,sk_value,sk_new_null,sk_push,ASN1_item_new,OBJ_dup,sk_push,sk_num,CRYPTO_malloc,sk_free,ASN1_item_free,sk_pop_free,	5_2_11084D70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11096D70 PEM_bytes_read_bio,PEM_read_bio,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_error,ERR_add_error_data,PEM_get_EVP_CIPHER_INFO,PEM_do_header,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_11096D70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AD80 DES_ncbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,	5_2_1101AD80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101FD80 BF_set_key,BF_encrypt,BF_encrypt,	5_2_1101FD80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023D80 AES_wrap_key,AES_encrypt,CRYPTO_128_wrap,	5_2_11023D80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107ED80 ASN1_BIT_STRING_set_bit,CRYPTO_malloc,CRYPTO_realloc_clean,ERR_put_error,_memset,	5_2_1107ED80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001D90 CRYPTO_memcmp,	5_2_11001D90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002D90 CRYPTO_remove_all_info,CRYPTO_is_mem_check_on,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	5_2_11002D90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003D90 CRYPTO_ex_data_new_class,CRYPTO_lock,CRYPTO_lock,	5_2_11003D90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AD90 lh_new,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,	5_2_1106AD90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11067D90 BIO_accept,accept,BIO_sock_should_retry,WSAGetLastError,ERR_put_error,ERR_put_error,DSO_global_lookup,htonl,htons,CRYPTO_malloc,ERR_put_error,BIO_snprintf,CRYPTO_realloc,CRYPTO_malloc,BIO_snprintf,	5_2_11067D90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FDA0 CRYPTO_nistcts128_encrypt,	5_2_1102FDA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046DA0 RSA_verify_PKCS1_PSS_mgf1,EVP_MD_CTX_init,EVP_MD_size,BN_num_bits,RSA_size,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,PKCS1_MGF1,ERR_put_error,ERR_put_error,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,ERR_put_error,CRYPTO_free,EVP_MD_CTX_cleanup,	5_2_11046DA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106DDA0 ERR_add_error_vdata,CRYPTO_malloc,CRYPTO_realloc,BUF_strlcat,ERR_get_state,CRYPTO_free,CRYPTO_free,	5_2_1106DDA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023DB0 AES_unwrap_key,AES_decrypt,CRYPTO_128_unwrap,	5_2_11023DB0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11060DB0 ENGINE_finish,CRYPTO_free_ex_data,OPENSSL_cleanse,CRYPTO_free,	5_2_11060DB0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107FDB0 c2i_ASN1_INTEGER,ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	5_2_1107FDB0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11001DC0 CRYPTO_lock,CRYPTO_get_dynlock_value,CRYPTO_destroy_dynlockid,OpenSSLDie,	5_2_11001DC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CDC0 DES_ede3_cbcm_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,	5_2_1101CDC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11014DC0 CMAC_resume,EVP_EncryptInit_ex,	5_2_11014DC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11092DC0 ASN1_STRING_new,ASN1_get_object,CRYPTO_malloc,ASN1_STRING_free,CRYPTO_free,CRYPTO_free,	5_2_11092DC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11044DD0 i2d_X509_SIG,OPENSSL_cleanse,CRYPTO_free,	5_2_11044DD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11003DF0 CRYPTO_cleanup_all_ex_data,CRYPTO_lock,CRYPTO_lock,	5_2_11003DF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104BC00 DSA_up_ref,CRYPTO_add_lock,	5_2_1104BC00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11072C00 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_cleanup,CRYPTO_free,	5_2_11072C00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11088C10 ASN1_template_free,ASN1_primitive_free,asn1_get_choice_selector,asn1_get_field_ptr,ASN1_template_free,asn1_do_lock,asn1_enc_free,asn1_do_adb,asn1_get_field_ptr,ASN1_template_free,CRYPTO_free,	5_2_11088C10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11038C20 BN_bn2dec,BN_num_bits,CRYPTO_malloc,CRYPTO_malloc,BN_dup,BN_div_word,BIO_snprintf,BIO_snprintf,CRYPTO_free,BN_free,CRYPTO_free,ERR_put_error,	5_2_11038C20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110A0C2E sk_value,sk_num,CRYPTO_malloc,sk_push,CRYPTO_free,	5_2_110A0C2E
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106AC20 CRYPTO_realloc,	5_2_1106AC20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110A5C20 X509V3_EXT_print,X509V3_EXT_get,ASN1_item_d2i,BIO_printf,X509V3_EXT_val_prn,X509V3_conf_free,sk_pop_free,CRYPTO_free,ASN1_item_free,	5_2_110A5C20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102FC30 CRYPTO_nistcts128_encrypt_block,CRYPTO_cbc128_encrypt,	5_2_1102FC30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031C30 CRYPTO_ccm128_setiv,	5_2_11031C30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D3C3E sk_value,sk_num,sk_insert,CRYPTO_free,BN_free,CRYPTO_free,	5_2_110D3C3E
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1106EC30 ERR_peek_error_line_data,ERR_get_state,CRYPTO_free,CRYPTO_free,	5_2_1106EC30
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11002C40 CRYPTO_pop_info,CRYPTO_is_mem_check_on,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	5_2_11002C40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11062C40 BIO_set,CRYPTO_new_ex_data,CRYPTO_free_ex_data,	5_2_11062C40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11071C40 EVP_MD_CTX_cleanup,EVP_MD_CTX_test_flags,EVP_MD_CTX_test_flags,OPENSSL_cleanse,CRYPTO_free,EVP_PKEY_CTX_free,ENGINE_finish,	5_2_11071C40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081C40 ASN1_item_sign_ctx,X509_NAME_ENTRY_get_object,UI_get0_user_data,EVP_MD_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,pqueue_peek,OBJ_find_sigid_by_algs,OBJ_nid2obj,X509_ALGOR_set0,OBJ_nid2obj,X509_ALGOR_set0,ASN1_item_i2d,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestUpdate,EVP_DigestSignFinal,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,	5_2_11081C40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B9C40 CONF_modules_load_file,NCONF_new,CONF_get1_default_config_file,NCONF_load,ERR_peek_last_error,ERR_clear_error,CONF_modules_load,CRYPTO_free,NCONF_free,	5_2_110B9C40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AC50 DES_decrypt3,DES_encrypt2,DES_encrypt2,DES_encrypt2,	5_2_1101AC50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022C50 CAST_cbc_encrypt,CAST_encrypt,CAST_decrypt,CAST_decrypt,	5_2_11022C50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102AC50 Camellia_decrypt,	5_2_1102AC50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107EC50 c2i_ASN1_BIT_STRING,ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	5_2_1107EC50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020C80 BF_ofb64_encrypt,BF_encrypt,	5_2_11020C80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104BC90 DSA_get_ex_new_index,CRYPTO_get_ex_new_index,	5_2_1104BC90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11056C90 CRYPTO_add_lock,EC_POINT_free,CRYPTO_free,CRYPTO_free,	5_2_11056C90

Source: rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_ac61599e-6

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Unpacked PE file: 4.2.rfusclient.exe.650000.0.unpack

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

File created: C:\ProgramData\Remote Utilities\install.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

Jump to behavior

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000000.1646535165.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB240CC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6CDB240CC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3B070 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6CDB3B070
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4FB80 FindFirstFileExA,	0_2_00007FF6CDB4FB80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004940 OPENSSL_DIR_read,_malloc,_memset,_malloc,FindFirstFileA,FindNextFileA,_strncpy,	5_2_11004940
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D9950 __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	5_2_110D9950

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winspool.drv	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winmm.dll	Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

5_2_1103CBB0

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 101.99.94.54 ports 5651,1,465,5,6,80

Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 185.70.104.90:5651
Source: global traffic	TCP traffic: 192.168.2.4:49735 -> 101.99.94.54:5651
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 77.105.132.70:5651
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 64.20.61.146:5655
Source: global traffic	TCP traffic: 192.168.2.4:49818 -> 66.23.226.254:5655

Source: Joe Sandbox View	IP Address: 77.105.132.70 77.105.132.70
Source: Joe Sandbox View	IP Address: 64.20.61.146 64.20.61.146
Source: Joe Sandbox View	IP Address: 185.70.104.90 185.70.104.90
Source: Joe Sandbox View	IP Address: 66.23.226.254 66.23.226.254

Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.70.104.90
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.132.70
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54
Source: unknown	TCP traffic detected without corresponding DNS query: 101.99.94.54

Source: unknown

DNS traffic detected: queries for: id72.remoteutilities.com

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001FD2000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001FD2000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0=
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://madExcept.comU
Source: rutserv.exe, 00000009.00000002.2987513831.00000000066C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: rutserv.exe, 00000009.00000003.1919101620.0000000006708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/
Source: rutserv.exe, 00000009.00000003.1919101620.00000000066E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/G
Source: rutserv.exe, 00000009.00000003.2512955936.00000000066CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSE67Nbq3jfQQg8yXEpbmqLTNn7XwQUm1%2BwNrqdBq4ZJ
Source: rutserv.exe, 00000009.00000003.1921331716.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2511488577.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuN
Source: rutserv.exe, 00000009.00000002.2987878555.00000000066EB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919101620.00000000066E8000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.00000000066EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/O
Source: rutserv.exe, 00000009.00000003.1919101620.0000000006708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/p
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0W
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2909220661.0000000002286000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001FD2000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006732000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: rutserv.exe, 00000009.00000002.2987513831.00000000066C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.coma
Source: rutserv.exe, 00000009.00000003.1919901189.0000000002036000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2704405939.0000000002026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crlhttp
Source: rutserv.exe, 00000009.00000002.2902670220.0000000001FFF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1921331716.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2511488577.0000000001FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG3.crl
Source: rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade.ini
Source: rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade_beta.ini
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2102000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2987878555.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.00000000066FD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2902670220.0000000001FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.flexerasoftware.com0
Source: rfusclient.exe, 00000004.00000003.1728446387.00000000033EC000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000004.00000000.1714769466.0000000000E4E000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.000000000122A000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000002.2909594242.0000000002675000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: rutserv.exe, 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/index.php?src=app
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/index.php?src=app?src=app
Source: rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/index.php?src=appx.php?src=app0
Source: rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs
Source: rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/0
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/a0
Source: rutserv.exe, 00000009.00000002.2971300777.000000000503E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/connecting-over-the-internet/
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/e
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/o0
Source: rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/rt/docs/
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/rt/docs/r
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/s0
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/t0
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php.
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php...
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.php1
Source: rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpB
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpdo?
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpes.
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpet
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpet
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpum
Source: rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.remoteutilities.com/tell-me-more.phpken

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3			Jump to dropped file
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.rfusclient.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB1C300: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6CDB1C300

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\49a7b6.msi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIAB6F.tmp

Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB31E00	0_2_00007FF6CDB31E00
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB15E2C	0_2_00007FF6CDB15E2C
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3CD68	0_2_00007FF6CDB3CD68
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3B070	0_2_00007FF6CDB3B070
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB24938	0_2_00007FF6CDB24938
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB40634	0_2_00007FF6CDB40634
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1F8E8	0_2_00007FF6CDB1F8E8
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2A45C	0_2_00007FF6CDB2A45C
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB33364	0_2_00007FF6CDB33364
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2AEC4	0_2_00007FF6CDB2AEC4
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2F0F0	0_2_00007FF6CDB2F0F0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB320B0	0_2_00007FF6CDB320B0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB51F60	0_2_00007FF6CDB51F60
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB48AFC	0_2_00007FF6CDB48AFC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB34A78	0_2_00007FF6CDB34A78
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB11AA4	0_2_00007FF6CDB11AA4
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB21A54	0_2_00007FF6CDB21A54
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB559D8	0_2_00007FF6CDB559D8
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB32990	0_2_00007FF6CDB32990
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4F974	0_2_00007FF6CDB4F974
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB40634	0_2_00007FF6CDB40634
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB38CD4	0_2_00007FF6CDB38CD4
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB32C38	0_2_00007FF6CDB32C38
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2BB3C	0_2_00007FF6CDB2BB3C
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB25B70	0_2_00007FF6CDB25B70
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4C718	0_2_00007FF6CDB4C718
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB176C0	0_2_00007FF6CDB176C0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1A664	0_2_00007FF6CDB1A664
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2C918	0_2_00007FF6CDB2C918
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB48880	0_2_00007FF6CDB48880
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB14840	0_2_00007FF6CDB14840
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB33844	0_2_00007FF6CDB33844
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1A2FC	0_2_00007FF6CDB1A2FC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB1C300	0_2_00007FF6CDB1C300
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB352D0	0_2_00007FF6CDB352D0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB17288	0_2_00007FF6CDB17288
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB211CC	0_2_00007FF6CDB211CC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB2B4E0	0_2_00007FF6CDB2B4E0
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB52430	0_2_00007FF6CDB52430
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019150	5_2_11019150
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11024160	5_2_11024160
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F170	5_2_1101F170
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11040170	5_2_11040170
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110311A0	5_2_110311A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110171B0	5_2_110171B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020000	5_2_11020000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E000	5_2_1103E000
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005050	5_2_11005050
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E060	5_2_1101E060
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023080	5_2_11023080
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110370E0	5_2_110370E0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022300	5_2_11022300
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11046340	5_2_11046340
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1107E360	5_2_1107E360
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11024370	5_2_11024370
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018200	5_2_11018200
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032210	5_2_11032210
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11035210	5_2_11035210
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E250	5_2_1101E250
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11027260	5_2_11027260
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11015270	5_2_11015270
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101A2A0	5_2_1101A2A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110252B0	5_2_110252B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E9507	5_2_110E9507
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030510	5_2_11030510
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019540	5_2_11019540
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11008560	5_2_11008560
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E858B	5_2_110E858B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023400	5_2_11023400
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E740B	5_2_110E740B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031410	5_2_11031410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032410	5_2_11032410
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020420	5_2_11020420
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019440	5_2_11019440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C440	5_2_1101C440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E440	5_2_1101E440
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110364A0	5_2_110364A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045720	5_2_11045720
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11025730	5_2_11025730
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E780	5_2_1103E780
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110227B0	5_2_110227B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102E600	5_2_1102E600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032600	5_2_11032600
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E0610	5_2_110E0610
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101C630	5_2_1101C630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102F630	5_2_1102F630
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103D640	5_2_1103D640
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E640	5_2_1103E640
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F660	5_2_1101F660
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104A680	5_2_1104A680
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110196A0	5_2_110196A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110176D0	5_2_110176D0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103E900	5_2_1103E900
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11026906	5_2_11026906
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101E910	5_2_1101E910
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11007940	5_2_11007940
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E794F	5_2_110E794F
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101B980	5_2_1101B980
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110329B0	5_2_110329B0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101A9C0	5_2_1101A9C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110339DD	5_2_110339DD
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005820	5_2_11005820
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018840	5_2_11018840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102D840	5_2_1102D840
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11081850	5_2_11081850
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101F860	5_2_1101F860
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110238A0	5_2_110238A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102A8A0	5_2_1102A8A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110178C0	5_2_110178C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11013B10	5_2_11013B10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11030B10	5_2_11030B10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AB20	5_2_1101AB20
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11019B80	5_2_11019B80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101DB80	5_2_1101DB80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11007B90	5_2_11007B90
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103DBD0	5_2_1103DBD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CBF0	5_2_1101CBF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11025A00	5_2_11025A00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AA2C	5_2_1101AA2C
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11016A40	5_2_11016A40
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102CA5F	5_2_1102CA5F
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020A80	5_2_11020A80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005AC0	5_2_11005AC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11017AE0	5_2_11017AE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11032AF0	5_2_11032AF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11045AF0	5_2_11045AF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031D60	5_2_11031D60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102CD70	5_2_1102CD70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101CDC0	5_2_1101CDC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1101AC50	5_2_1101AC50
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11005C80	5_2_11005C80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11020C80	5_2_11020C80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11008C89	5_2_11008C89
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031CA0	5_2_11031CA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1102ACD0	5_2_1102ACD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1103FF10	5_2_1103FF10
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11018F60	5_2_11018F60
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110DDF75	5_2_110DDF75
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11026FA9	5_2_11026FA9
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11007FC0	5_2_11007FC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11031FC0	5_2_11031FC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11034FE0	5_2_11034FE0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11023E00	5_2_11023E00
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11022E80	5_2_11022E80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E7E93	5_2_110E7E93
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12011220	5_2_12011220
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12014290	5_2_12014290
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1201E2A0	5_2_1201E2A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12010BD0	5_2_12010BD0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203E0A2	5_2_1203E0A2
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203B947	5_2_1203B947
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203BE8B	5_2_1203BE8B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12010E8B	5_2_12010E8B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1201177E	5_2_1201177E
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203B403	5_2_1203B403
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12002CC0	5_2_12002CC0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_120124C0	5_2_120124C0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_120394ED	5_2_120394ED
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12010D70	5_2_12010D70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12011578	5_2_12011578
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203C583	5_2_1203C583
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1200EDA0	5_2_1200EDA0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_00481183	9_2_00481183

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11002490 appears 200 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 12031BA4 appears 39 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 1106FBE0 appears 40 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11067450 appears 116 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11063420 appears 31 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 12031898 appears 72 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11088AF0 appears 48 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 12032150 appears 149 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11001DC0 appears 145 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 11088E80 appears 50 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 110D46A0 appears 468 times
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: String function: 110DF348 appears 45 times

Source: rutserv.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rfusclient.exe.2.dr	Static PE information: Resource name: MAD type: DOS executable (COM, 0x8C-variant)
Source: rfusclient.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: unires_vpd.dll.2.dr	Static PE information: Resource name: None type: COM executable for DOS
Source: unidrvui_rupd.dll0.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unires_vpd.dll0.2.dr	Static PE information: Resource name: None type: COM executable for DOS

Source: rutserv.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: rfusclient.exe.2.dr	Static PE information: Number of sections : 11 > 10

Source: unires_vpd.dll0.2.dr	Static PE information: No import functions for PE file found
Source: unires_vpd.dll.2.dr	Static PE information: No import functions for PE file found

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A211F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: libeay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: ssleay32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Section loaded: profapi.dll

Source: 4.0.rfusclient.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT

Source: unires_vpd.dll0.2.dr	Static PE information: Section .rsrc
Source: unires_vpd.dll.2.dr	Static PE information: Section .rsrc

Source: classification engine

Classification label: mal100.troj.evad.winEXE@23/88@2/5

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB1B6E8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF6CDB1B6E8

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_1106C670 RAND_poll,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,RAND_add,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,RAND_add,FreeLibrary,GetVersion,OPENSSL_isservice,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,GetVersion,GetVersion,RAND_add,RAND_add,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,RAND_add,Heap32First,RAND_add,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,Process32First,RAND_add,GetTickCount,GetTickCount,GetTickCount,RAND_add,GetTickCount,GetTickCount,RAND_add,GetTickCount,FindCloseChangeNotification,FreeLibrary,GlobalMemoryStatus,RAND_add,GetCurrentProcessId,RAND_add,

5_2_1106C670

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB38504 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF6CDB38504

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 9_2_007F4CA4 StartServiceCtrlDispatcherW,

9_2_007F4CA4

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 9_2_007F4CA4 StartServiceCtrlDispatcherW,

9_2_007F4CA4

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Utilities - Host

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1f70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \BaseNamedObjects\HookTThread$1ec4
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSTray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1f84
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1dfc
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1ec4
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1f84
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSLocal
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1f70
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1dd8
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$1f48
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1e5c
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1398
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1db0

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4825296

Jump to behavior

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File read: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static file information: File size 20949417 > 1048576

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\libeay32.pdb source: rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2u-x32\out32dll\ssleay32.pdb@W source: rutserv.exe, 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000000.1646535165.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmp

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Unpacked PE file: 4.2.rfusclient.exe.650000.0.unpack

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

5_2_1106C670

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4825296

Jump to behavior

Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: section name: .didat
Source: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Static PE information: section name: _RDATA
Source: vp8decoder.dll.2.dr	Static PE information: section name: .rodata
Source: vp8encoder.dll.2.dr	Static PE information: section name: .rodata
Source: webmvorbisdecoder.dll.2.dr	Static PE information: section name: _RDATA
Source: webmvorbisencoder.dll.2.dr	Static PE information: section name: _RDATA
Source: vccorlib120.dll.2.dr	Static PE information: section name: minATL
Source: rutserv.exe.2.dr	Static PE information: section name: .didata
Source: rfusclient.exe.2.dr	Static PE information: section name: .didata
Source: eventmsg.dll.2.dr	Static PE information: section name: .didata
Source: vccorlib120.dll0.2.dr	Static PE information: section name: minATL

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110DF38D push ecx; ret	5_2_110DF3A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12035721 push ecx; ret	5_2_12035734
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CBF79 push 34007CC2h; retn 007Ch	9_2_007CC035
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC270 push 34007CC2h; retn 007Ch	9_2_007CC34D
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CCA5F pushfd ; retf 007Ch	9_2_007CCA6B
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC554 push 34007CC2h; retn 007Ch	9_2_007CC611
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC2B0 push 34007CC2h; retn 007Ch	9_2_007CC34D
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CCBA9 pushfd ; retf 007Ch	9_2_007CCBAA
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 9_2_007CC2A0 push eax; ret	9_2_007CC2A5

Source: msvcr120.dll.2.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: VPDAgent.exe.2.dr	Static PE information: section name: .text entropy: 6.812931691200469

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAB6F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAB6F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	Jump to dropped file

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

File created: C:\ProgramData\Remote Utilities\install.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 9_2_007F4CA4 StartServiceCtrlDispatcherW,

9_2_007F4CA4

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

5_2_1106C670

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer Security

Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rutserv.exe, 00000005.00000000.1736259820.0000000000D41000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEC
Source: rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEE0
Source: rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXET
Source: rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEW

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_11004DE0 rdtsc

5_2_11004DE0

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

5_2_1106C670

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Window / User API: threadDelayed 5772	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Window / User API: threadDelayed 1371	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Window / User API: threadDelayed 5216
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Window / User API: threadDelayed 4281

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAB6F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	Jump to dropped file

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

API coverage: 0.4 %

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 7952	Thread sleep count: 5772 > 30	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 7952	Thread sleep time: -5772000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8004	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8032	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8076	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8084	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8088	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8044	Thread sleep count: 1371 > 30	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8092	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 8188	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe TID: 7892	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe TID: 7356	Thread sleep time: -2608000s >= -30000s
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe TID: 7356	Thread sleep time: -2140500s >= -30000s

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB240CC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6CDB240CC
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB3B070 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6CDB3B070
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB4FB80 FindFirstFileExA,	0_2_00007FF6CDB4FB80
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11004940 OPENSSL_DIR_read,_malloc,_memset,_malloc,FindFirstFileA,FindNextFileA,_strncpy,	5_2_11004940
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D9950 __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	5_2_110D9950

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB41584 VirtualQuery,GetSystemInfo,

0_2_00007FF6CDB41584

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Thread delayed: delay time: 40000	Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winspool.drv	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	File opened: C:\Windows\SysWOW64\winmm.dll	Jump to behavior

Source: rutserv.exe, 00000009.00000003.1919101620.0000000006700000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2508934964.0000000006705000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.2705508739.0000000006705000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rutserv.exe, 00000009.00000003.2513140485.0000000001F9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: rfusclient.exe, 00000004.00000002.1733215838.00000000017D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_11004DE0 rdtsc

5_2_11004DE0

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB43050 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6CDB43050

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

5_2_1106C670

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

5_2_1106C670

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB50C00 GetProcessHeap,

0_2_00007FF6CDB50C00

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start

Jump to behavior

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB43050 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6CDB43050
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB475B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6CDB475B8
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB43234 SetUnhandledExceptionFilter,	0_2_00007FF6CDB43234
Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: 0_2_00007FF6CDB423F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6CDB423F0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110DC073 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_110DC073
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110E5AA7 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_110E5AA7
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110D4D22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_110D4D22
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_12032EF0 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_12032EF0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_120324E5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_120324E5
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1203558C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_1203558C

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB3B070 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6CDB3B070

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i Exel.msi /qn	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall	Jump to behavior

Source: rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp

Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB2DBDC cpuid

0_2_00007FF6CDB2DBDC

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	0_2_00007FF6CDB3A1AC
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: GetLocaleInfoA,	5_2_110E71A3
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: GetLocaleInfoA,	5_2_1203DE54

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB40634 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6CDB40634

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Code function: 5_2_110E0E32 __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

5_2_110E0E32

Source: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Code function: 0_2_00007FF6CDB24EC0 GetVersionExW,

0_2_00007FF6CDB24EC0

Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: rutserv.exe, 00000005.00000000.1736259820.0000000000D41000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000002.1774897369.0000000001858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000008.00000002.1914436857.0000000001EF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Remote Access Functionality

Detected Remote Utilities RAT

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters notification	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters Security	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters General	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters CallbackSettings	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters FUSClientPath	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters InternetId	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters Certificates	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters CalendarRecordSettings	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe "C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray	Jump to behavior
Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray

Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_11068160 BIO_get_accept_socket,BIO_sock_init,BUF_strdup,DSO_global_lookup,DSO_global_lookup,BIO_get_port,htons,BIO_get_host_ip,htonl,socket,setsockopt,bind,WSAGetLastError,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,ERR_put_error,ERR_add_error_data,ERR_put_error,listen,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,CRYPTO_free,closesocket,	5_2_11068160
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E3A0 DSO_bind_var,ERR_put_error,ERR_put_error,ERR_put_error,	5_2_1104E3A0
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_1104E420 DSO_bind_func,ERR_put_error,ERR_put_error,ERR_put_error,	5_2_1104E420
Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe	Code function: 5_2_110B9870 NCONF_get_string,ERR_clear_error,DSO_load,DSO_bind_func,DSO_bind_func,DSO_free,ERR_put_error,ERR_add_error_data,	5_2_110B9870

Source: Yara match	File source: 4.0.rfusclient.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rfusclient.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	3 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	3 Windows Service	14 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	12 Software Packing	NTDS	56 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	111 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe	28%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.flexerasoftware.com0	0%	URL Reputation	safe
http://update.remoteutilities.net/upgrade_beta.ini	0%	Avira URL Cloud	safe
http://update.remoteutilities.net/upgrade.ini	0%	Virustotal		Browse
http://update.remoteutilities.net/upgrade.ini	0%	Avira URL Cloud	safe
http://madExcept.comU	0%	Avira URL Cloud	safe
http://update.remoteutilities.net/upgrade_beta.ini	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
id.remoteutilities.com	64.20.61.146	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
id72.remoteutilities.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.remoteutilities.com/support/docs/e	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/	rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpet	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/V	rutserv.exe, 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.remoteutilities.com/support/docs/s0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://madExcept.comU	rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remoteutilities.com/support/docs/o0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/rt/docs/r	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	rfusclient.exe, 00000004.00000000.1714769466.0000000000651000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1849563793.000000007B8C0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000003.1859762685.000000007CCF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpet	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	rfusclient.exe, 00000004.00000003.1728446387.00000000033EC000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000004.00000000.1714769466.0000000000E4E000.00000020.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1736259820.000000000122A000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000002.2909594242.0000000002675000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.remoteutilities.com/support/docs/0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpB	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rmansys.ru/internet-id/	rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.php...	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	rutserv.exe, 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.remoteutilities.com/index.php?src=app?src=app	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/index.php?src=appx.php?src=app0	rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://update.remoteutilities.net/upgrade.ini	rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.remoteutilities.com/tell-me-more.php1	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.php.	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/index.php?src=app	rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/t0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpes.	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/connecting-over-the-internet/	rutserv.exe, 00000009.00000002.2971300777.000000000503E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000009.00000002.2971300777.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/rt/docs/	rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.php	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://update.remoteutilities.net/upgrade_beta.ini	rutserv.exe, 00000005.00000000.1736259820.0000000000341000.00000020.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1869888513.000000007E7E0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.remoteutilities.com/tell-me-more.phpdo?	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpken	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.flexerasoftware.com0	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A21A0000.00000004.00000020.00020000.00000000.sdmp, 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, 00000000.00000003.1657719455.000001A6A2162000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.inkscape.org/namespaces/inkscape	rfusclient.exe, 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, rutserv.exe, 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, rutserv.exe, 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs/a0	rutserv.exe, 00000009.00000002.2977873306.0000000005720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/support/docs	rutserv.exe, 00000009.00000002.2909594242.000000000269A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpum	rutserv.exe, 00000009.00000002.2909594242.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
77.105.132.70	unknown	Russian Federation	42031	PLUSTELECOM-ASRU	false
64.20.61.146	id.remoteutilities.com	United States	19318	IS-AS-1US	false
185.70.104.90	unknown	Russian Federation	49335	NCONNECT-ASRU	false
66.23.226.254	unknown	United States	19318	IS-AS-1US	false
101.99.94.54	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1385428
Start date and time:	2024-02-02 09:36:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe renamed because original name is a hash value
Original Sample Name:	3_.pdf.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@23/88@2/5
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 192.229.211.108
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:37:16	API Interceptor	466522x Sleep call for process: rutserv.exe modified
09:37:24	API Interceptor	105497x Sleep call for process: rfusclient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
77.105.132.70	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	install.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	hostcr.exe	Get hash	malicious	Remcos	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	0442.EXE.exe	Get hash	malicious	Quasar	Browse
	gbquas.exe	Get hash	malicious	Quasar	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
64.20.61.146	WEXTRACT.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	WX2.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	WEXTRACT.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	WX2.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
185.70.104.90	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	install.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	hostcr.exe	Get hash	malicious	Remcos	Browse
	#U0417#U0430#U043f#U0438#U0442 #U0434#U043e#U043a#U0443#U043c#U0435#U043d#U0442#U0456#U0432.exe	Get hash	malicious	Babadeda, Remcos	Browse
	#U0417#U0430#U043f#U0438#U0442 #U0434#U043e#U043a#U0443#U043c#U0435#U043d#U0442#U0456#U0432.exe	Get hash	malicious	Babadeda, Remcos	Browse
	#U0417#U0430#U043f#U0438#U0442 #U0434#U043e#U043a#U0443#U043c#U0435#U043d#U0442#U0456#U0432.zip	Get hash	malicious	Remcos	Browse
66.23.226.254	WX2.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	akt-sverka_PDF.exe	Get hash	malicious	RMSRemoteAdmin, RedLine	Browse
	BUILD.bin.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	w89kTa93Aw.exe	Get hash	malicious	RMSRemoteAdmin	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader, Socks5Systemz, zgRAT	Browse	192.229.211.108
	https://buly.kr/FWQBDMH	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://culrosha.net	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.redwingsfactoryoutlet.com/0.4552917875246032	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.alphaleteromania.com/collections/dama-c-0.html?&gender=1	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.trapstarisrael.co.il/collections/clothing-tracksuits-c-1_3.html	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.josefseibelfactoryoutlet.com/400.shtml	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.camperturkiye.com.tr/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.alphaleteromania.com/shopping_cart.html	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.bottegavenetahr.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
id.remoteutilities.com	WEXTRACT.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse	64.20.61.146
	WX2.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse	64.20.61.146
	WEXTRACT.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse	64.20.61.146
	WX2.EXE.exe	Get hash	malicious	RMSRemoteAdmin	Browse	64.20.61.146
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	64.20.61.146
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	64.20.61.146
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	64.20.61.146
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	64.20.61.146
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	64.20.61.146
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	64.20.61.146

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLUSTELECOM-ASRU	file.exe	Get hash	malicious	Unknown	Browse	185.225.200.120
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.70
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.70
	install.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	http://jerryposter.com	Get hash	malicious	Unknown	Browse	77.105.140.181
	hostcr.exe	Get hash	malicious	Remcos	Browse	77.105.132.70
	file.exe	Get hash	malicious	PrivateLoader	Browse	77.105.147.130
	p1vNyPdVh2.exe	Get hash	malicious	Stealc, Vidar, zgRAT	Browse	77.105.132.229
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	77.105.132.124
IS-AS-1US	De0RycaUHH.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	67.217.62.48
	SecuriteInfo.com.Win64.Evo-gen.20834.11238.exe	Get hash	malicious	Unknown	Browse	67.217.58.242
	SQfJLT4jnm.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	kVQs7ONDHM.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	UuBCOKkRJD.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	S6I8E5c6Vo.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	MpoA7XN3B6.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	z24a4Xr7H5.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	4ezGurnR0i.elf	Get hash	malicious	Mirai	Browse	162.250.123.61
	ATT65793.htm	Get hash	malicious	Unknown	Browse	192.64.85.182
IS-AS-1US	De0RycaUHH.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	67.217.62.48
	SecuriteInfo.com.Win64.Evo-gen.20834.11238.exe	Get hash	malicious	Unknown	Browse	67.217.58.242
	SQfJLT4jnm.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	kVQs7ONDHM.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	UuBCOKkRJD.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	S6I8E5c6Vo.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	MpoA7XN3B6.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	z24a4Xr7H5.elf	Get hash	malicious	Unknown	Browse	162.250.123.61
	4ezGurnR0i.elf	Get hash	malicious	Mirai	Browse	162.250.123.61
	ATT65793.htm	Get hash	malicious	Unknown	Browse	192.64.85.182
NCONNECT-ASRU	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	185.70.104.112
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	185.70.104.112
	install.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse	185.70.104.112
	hostcr.exe	Get hash	malicious	Remcos	Browse	185.70.104.90
	#U0417#U0430#U043f#U0438#U0442 #U0434#U043e#U043a#U0443#U043c#U0435#U043d#U0442#U0456#U0432.exe	Get hash	malicious	Babadeda, Remcos	Browse	185.70.104.90
	#U0417#U0430#U043f#U0438#U0442 #U0434#U043e#U043a#U0443#U043c#U0435#U043d#U0442#U0456#U0432.exe	Get hash	malicious	Babadeda, Remcos	Browse	185.70.104.90
	#U0417#U0430#U043f#U0438#U0442 #U0434#U043e#U043a#U0443#U043c#U0435#U043d#U0442#U0456#U0432.zip	Get hash	malicious	Remcos	Browse	185.70.104.90
	SWIFT_COPY.xls	Get hash	malicious	Unknown	Browse	31.192.107.164
	SWIFT_COPY.xls	Get hash	malicious	Unknown	Browse	31.192.107.164
	JTT_4240101203000.xls	Get hash	malicious	GuLoader	Browse	31.192.107.163

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	install.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	CCleaner.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	install.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	Judicial request.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	c_unpack.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	42 Medoc.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse

Created / dropped Files

C:\Config.Msi\49a7b8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	32359
Entropy (8bit):	5.221077217292647
Encrypted:	false
SSDEEP:	768:fltototxA6rSrBjp1kyUXGiM01HuECIQcQpeQn6mPaUaqBt6M+pG57:YGsBjpKyUXGeHuECIQcQkQ6mPaUaqBtD
MD5:	68206233254021EE853F27ADA734D571
SHA1:	E39BBFE2F243F5DA81FF44D7F3F7F4304635A8D6
SHA-256:	70B973BF6109792A708B02D6EE011540F39C6EE73B4C7E2FBA20B23E9D4D8E7D
SHA-512:	4E6FAD6664F3D6FC8DF295BE51C5D07286EBF591AA849E57C39D781879F7D4C4EC111FB727DA2BABCD2D21B2E9E6ED286D2D08D1C350263E37E6BF0434468E9F
Malicious:	false
Preview:	...@IXOS.@.....@.LBX.@.....@.....@.....@.....@.....@......&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}..Remote Utilities - Host..Exel.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{BFB6CB81-8A2D-41FC-A737-5CF8EB370093}.....@.....@.....@.....@.......@.....@.....@.......@......Remote Utilities - Host......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{3244CDE6-6414-4399-B0D5-424562747210}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{197F692B-7CCA-4D79-85A5-ED04202D08D0}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{E79AC184-AD38-4B26-89D0-75B7CEA19FA2}&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}.@......&.{BDFF180E-29DE-4951-A6

C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252
Category:	dropped
Size (bytes):	15975
Entropy (8bit):	4.971311456641861
Encrypted:	false
SSDEEP:	384:Akc9TI9T+FCnjK71n5yqmOxSCH/Cu37gFpBukSVb5R:AkcuoCnjK7Rh5Cu3U/W
MD5:	9B0E600EB09E7A86199F7BA245D1CD2B
SHA1:	E3E52B3E04B08E59AAE74300F7D30C3D0AA27148
SHA-256:	879180116B82210292648709982F405EAE84B05E6F2FF324A6A5CC7CD512D3E7
SHA-512:	DD1622474C48ECF5C95E7585FB30B5279CF45DFC89332531758838B05F73499F536F7CADAF529AA4FA5AE0808E30A455465829DB7D13F2EE2E7D9B7BD12E17E5
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\cocoartf2638.\cocoatextscaling0\cocoaplatform0{\fonttbl\f0\fswiss\fcharset0 ArialMT;\f1\ftech\fcharset77 Symbol;}.{\colortbl;\red255\green255\blue255;\red51\green51\blue51;}.{\\expandedcolortbl;;\csgenericrgb\c20000\c20000\c20000;}.{\\listtable{\list\listtemplateid1\listhybrid{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace360\levelindent0{\\levelmarker \{disc\}}{\leveltext\leveltemplateid1\'01\uc0\u8226 ;}{\levelnumbers;}\fi-360\li720\lin720 }{\listname ;}\listid1}.{\list\listtemplateid2\listhybrid{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace360\levelindent0{\\levelmarker \{disc\}}{\leveltext\leveltemplateid101\'01\uc0\u8226 ;}{\levelnumbers;}\fi-360\li720\lin720 }{\listname ;}\listid2}}.{\*\listoverridetable{\listoverride\listid1\listoverridecount0\ls1}{\listoverride\listid2\listoverridecount0\ls2}}.{\info.{\author Marat}}\margl1440\margr1440\vieww12540\viewh15120\view

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16352
Entropy (8bit):	6.54052527746532
Encrypted:	false
SSDEEP:	192:IxgSABvdm4Yy3EA39QKH5EDZSZuc2+huLdALWwsUJZscF8Bd1LPK6CYHB5K:Ix0FmW3EaHiDZSZwJdLSZsHLPK6jHG
MD5:	73E40D762BA0B67027B8A489E5161821
SHA1:	F4D9B83EC23C6226C20C39F1B996894992707124
SHA-256:	37E3F9B5D5B95A47EB44E72E1E587C553BCAB7981DFF5D108FDE86B702E1A858
SHA-512:	8F9FC3533433AF5B44B1E19B377D184FCA51A95B6289B9D80628998802FB1ACEC488F22FFC563E1CC413DFD8FFEF2E097E882C29029BC29CFA11F9434A8DF002
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: CCleaner.exe, Detection: malicious, Browse Filename: CCleaner.exe, Detection: malicious, Browse Filename: install.msi, Detection: malicious, Browse Filename: Judicial request.exe, Detection: malicious, Browse Filename: Judicial request.exe, Detection: malicious, Browse Filename: c_unpack.exe, Detection: malicious, Browse Filename: c_unpack.exe, Detection: malicious, Browse Filename: 42 Medoc.exe, Detection: malicious, Browse Filename: 42 Medoc.exe, Detection: malicious, Browse Filename: 42 Medoc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3.j.]Oj.]Oj.]Og..Oh.]Og..Oh.]Og..Oy.]Og..Oh.]Oc..Oc.]Oj.\OY.]O..Ok.]Og..Ok.]O..Ok.]ORichj.]O........................PE..L......S..................................... ....@..........................`.......k....@.................................."..x....@...................!...P..\|....!..8............................!..@............ ...............................text...2........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2674656
Entropy (8bit):	6.865564996943119
Encrypted:	false
SSDEEP:	49152:dE8JxHX5r9sDQl7wDSMSFxvQ/qpyr0k0ha5XLDaDMPNw2x8pWTUKA76AeFG:dE8XHX5riUl7wDP6vQ/qpyr0kR5XLWD/
MD5:	D47B1FBDAE6406EC50110A3C59F685F4
SHA1:	B242609CB05CA8F5BFD08306274D10AC6E22E20C
SHA-256:	B03A3AD0C77DD9FD4DE0CB1FF938074ACCFBB8AC413524B1158DFA5014A26CE2
SHA-512:	E2601392D9615138B32F33295CBACF1C54A7DDD04FF4BE70800190CC55F1FD6EE8A8400913E103FC74C0C57D18B1A94B81E9E5EC9AE9182BA03D413B87DD7E0E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: CCleaner.exe, Detection: malicious, Browse Filename: CCleaner.exe, Detection: malicious, Browse Filename: install.msi, Detection: malicious, Browse Filename: Judicial request.exe, Detection: malicious, Browse Filename: Judicial request.exe, Detection: malicious, Browse Filename: c_unpack.exe, Detection: malicious, Browse Filename: c_unpack.exe, Detection: malicious, Browse Filename: 42 Medoc.exe, Detection: malicious, Browse Filename: 42 Medoc.exe, Detection: malicious, Browse Filename: 42 Medoc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zz..zz..zz.M...zz.+...zz.+...zz.+...zz.+...zz.f...zz..zz..zz.f..Oxz..z{..{z......zz.f...zz..(...zz..z...zz.f...zz.Rich.zz.........PE..L..../.\............................5u............@.......................... )......9)...@.................................<.&.......'.H.............(..!....'..n..................................0:&.@............................................text...5........................... ..`.rdata..............................@..@.data...<.....&..d....&.............@....rsrc...H.....'......8'.............@..@.reloc...n....'..p...>'.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1111520
Entropy (8bit):	6.491611255996076
Encrypted:	false
SSDEEP:	24576:UqSQS800orApz53PI2GVqH7kpf/V57GGcP6T5m+moXafzz:SQSX0oAtkpf/bfcyTTmoozz
MD5:	829AB21444204D50C64B805FE7897433
SHA1:	8540A93A2376B4B3EA447830775FFA69AB089A63
SHA-256:	2FE3D65C4CB5CB2DBB73AA0C05392230F7B52A7482C80A531B2E4C7DC42C16D9
SHA-512:	E5FF3639B275B6849FF0E974E4A921ED9461B4257684F088E651D32080C07F09394B19FB75E5EAA69C250CFAA682F6E3740CD0BA65F16B0FFBD81F01183FF2A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........[.:..:..:....l.:....n.7:....o.:..d..:..d...:..d..:..u.V.:..?d...:..?d..:..?d..:..:..T:..?d..:..?d..:..:db.:..?d..:..Rich.:..........................PE..L......\...........!......................................................................@.............................\|....&..d........................!.......l......p...............................@............................................text............................... ..`.rdata..p;.......<..................@..@.data...H;...@...*..................@....gfids..$............X..............@..@.rsrc................d..............@..@.reloc...l.......n...f..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23520
Entropy (8bit):	6.440740836511924
Encrypted:	false
SSDEEP:	384:Bb57Gk7g+iy218DTK9jkrtpgjKMp+fZSZwJdLSZsHLPK6jHvCg:h/218DTVrtsKMsBpPKgP1
MD5:	99B4B661886B0E7B480FEA0847ABD1B0
SHA1:	397EBD9B25DB33B20E5FECA257BDFA69424D8693
SHA-256:	0168F614579F7EFDE386DF3C6F63A3804DBB5EC37ED954859B4CEE3D82065617
SHA-512:	9F150CDA46349401984BA11F3E88FD379A36006CC403AD78DF02A6BFE4D9EC49043A343A49B7349C19D2391ED84D9B27E6BCF374322E76F4EA6E237852A97157
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Gf.}&.I}&.I}&.I;w.I\|&.I;w.In&.I;w.Iy&.I;w.Iy&.It^.Ix&.I}&.I?&.I..I\|&.Ipt.I\|&.I}&.I\|&.I..I\|&.IRich}&.I................PE..L..../.\.....................8......e".......0....@.......................................@.................................49..d....`..@............:...!...p......@1..8............................5..@............0...............................text...k........................... ..`.rdata..:....0......................@..@.data........@......................@....rsrc...@....`.......0..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4006368
Entropy (8bit):	6.80959441986422
Encrypted:	false
SSDEEP:	98304:ZbR+lDT6t58JcKdTG57M06POn9rvBAUZLM8FA8:5R+lDOt5kgFvVwmr
MD5:	545F1581B2486E834B8FA676A5F7A8EA
SHA1:	2AB6F0B7D1FC4CE98CAE89B0DC04D7972CC67D77
SHA-256:	21E0FEBE30F53D63985ACA992A1BCF2B6853B6B23808BD910C4EE54979B271EE
SHA-512:	1DF88C03CB89845C484767897FA6CAD1C6412B10C67363E597BFC80BD0798F99D2C47A84FAF6A07B721D81CA0F3D0D5A7F3F7BDD2B179819A468F9DDA07F5826
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.............3.......3.......3.............................fP8.............,......,.......,...Z...,.......).......,.......Rich....................PE..L......\...........!.....b"..0................"...............................=.......>...@.........................pA:......p:.d.....;...............=..!....;.$.....6.p.....................6.....p.6.@.............".d............................text...9a"......b"................. ..`.rdata..(....."......f".............@..@.data.........:..j...f:.............@....gfids........;.......:.............@..@.tls..........;.......:.............@....rsrc.........;.......:.............@..@.reloc..$.....;.. ....:.............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40416
Entropy (8bit):	6.363657503806742
Encrypted:	false
SSDEEP:	384:ZkzqOI138e1y6JMKxTrAogoAoaP7+qFXYiLxjdQMUQ9LSk3E0gTSsn2TkhI3K0Tz:ZLqokSaddQMUNk3EXSsn2Tk4j3pPKgz
MD5:	65BE96DA02367532D8ED15F1300850CF
SHA1:	A8105BB2B6759450726539831AB646209C3EA51C
SHA-256:	5ABD11523B355CEF76D32DF24D9E82ED148B1A6DC3CA7C2FD7197FFED45D74E3
SHA-512:	F336974A176120AD7453144548CD01CFFF71F91CCE6E146F99F1ACFA488A57CBBDC436DACA54F1FD04254E48BD86C54C90D990A33761BF1C4874621C31C513D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b..b..b..3...b..3+..b..3*..b..3...b.Z....b...X..b..b..b.Z....b..0...b..b\..b.Z....b.Rich.b.................PE..L..../.\.................D...8.......I.......`....@..................................~....@..................................s.......................\|...!...........b..8............................j..@............`...............................text....C.......D.................. ..`.rdata.......`... ...H..............@..@.data................h..............@....rsrc................l..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180192
Entropy (8bit):	5.245276621355164
Encrypted:	false
SSDEEP:	1536:zvQtL1VQPsuMC7Wsb5o5/mXOMzZ52NyoGCIfb0wk7UAjKQpmArUaDZqxw+:E/i97Wao5eDaNvGCIj0w+mArBZk
MD5:	1589EAD8B5B00AE5E574FA6F005256C4
SHA1:	894D1EB249155F9383870F754B745321EA924473
SHA-256:	6D4939FD651AF68DB82784425A2B6805F1169376B5CA9C5821E5C8CFB81C549C
SHA-512:	86252A061E102E87933CEFA53F31F1AD459A91AB555D1847F10583D9096542E2912AA7230E90DCFB3ED8EA5E8F2D232AC81C203E943DBF2E690AC8D500EB24AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z............X.1....X......X.3....X........m......}....D3.........D.......5......y....D0....Rich...........................PE..L..../.\.................\..........8........p....@..........................0............@.................................,5.......`..V................!...........z..8...............................@............0..,............................text....[.......\.................. ..`.rdata..(E...p...F...`..............@..@.data....l..........................@....idata...$...0...&..................@..@.rsrc...V....`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53728
Entropy (8bit):	6.5571910635788635
Encrypted:	false
SSDEEP:	768:jqfYiEXOtlk4SgVg1pQtfVuTsxxSzELKoZeepPKg3:ZiEXYq2g1pC9uToxkiZ/x1
MD5:	A810FC0F499E254375FB1FA9116E2CCF
SHA1:	CBD73834170A05A8D47846B255E02A2C7778C06A
SHA-256:	966EF76FE3476D530B1B97A6F40947ED14ADA378F13E44ECFE774EDC998CD0B0
SHA-512:	59D0855636E25C0F41A5401184C7CA16082A25FF72CAAD2D2C183E3977FBF60AE50C2E6A9F686681F1F19067225BB68C6FB3AEA808E7E5982C49B08E2095A669
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3..3..3..uO..1..uO.. ..uO,.7..uO..6..3..S..:fb.4.....1..>L*.2..3.f.2.../.2..Rich3..........................PE..L..../.\.................v...:......Ez............@.......................................@.....................................x.......@................!..............8...............................@...............\|............................text....u.......v.................. ..`.rdata...!......."...z..............@..@.data...............................@....rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772960
Entropy (8bit):	6.917269583439067
Encrypted:	false
SSDEEP:	49152:QuZqJvz7GHYFVw8vfMVDpaLGtH3uSvQ/qpyr0kiU6HoCPLG5gzyUxChReb0:QuZqJvz7GHGVfvfMVDNNxvQ/qpyr0kpn
MD5:	E608CE332F016026E3D3B62E606192CA
SHA1:	0A5FB826AC299D4D086AF8BF1391184A15976571
SHA-256:	57AB69CBCB0DA76BD70D897514AEAE6858F52BD391B955D5C3A980A19F1DDE58
SHA-512:	53E4E647D43910D15158EF61445A77F80D72F7A63001C220D8A53853DCF04918B849532305180347A230D70E61992C034C48CEE2DAB8247BEE113FEB5AF1ACAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.&.1fH.1fH.1fH....8fH.w7..<fH.w7..<fH.w7..5fH.w7..6fH.8..$fH.1fI.^gH.1fH.&fH......dH......fH.....,fH.....0fH.<4..0fH.....0fH.Rich1fH.................PE..L...,..[...........!.........j......#......... .........................................@.........................p.'..:..T.(.......)...............*..!....).8\|..0. .8............................8'.@............. .h............................text............................... ..`.rdata...-.... ....... .............@..@.data........@(..~...0(.............@....rsrc.........).......(.............@..@.reloc..8\|....)..~....(.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpdisp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2992096
Entropy (8bit):	6.789893578257523
Encrypted:	false
SSDEEP:	49152:kN1BAW/tsUJX4JIHl3LhI2NnmTYH2RXoSrB/KYtvQ/qpyr0kyaTGjEawEP1vsB9u:kN1BaFY3FI29mTYH2JRwovQ/qpyr0ksD
MD5:	45D5F1B29B1B40B232D662DACF07D0DC
SHA1:	822E821E261B385FA7300530AA633A2E0C7D7914
SHA-256:	F224CDCDE4A049C4F471CC2C50E75FB55E4C0A540FEA4AD24A4C57E97DE48780
SHA-512:	1ADBB3D83107DCDE018EC41902FEF7C5E3AF3D6A7BC11AA6C71D23FB23F02ED36E9D6317631523D7B837FD19D934C0DCE73345B5DF0E82C2BE4B0A831C6A8282
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............j...j...j..V.u..j...;m..j...;R..j...;o..j...;S..j....!..j..}.o..j...j...j..}.R.3h..}.S..j.._4...j...j..Ah..}.W..j..}.n..j...8i..j...j%..j..}.l..j..Rich.j..........................PE..L..../.\..................!...........!......."...@...........................-...........@..........................+.+.....+.......,.@.............-..!....,..C...................................x+.@............."..............................text...g.!.......!................. ..`.rdata..T.....".......".............@..@.data....~....,..N....+.............@....rsrc...@.....,......<,.............@..@.reloc...C....,..D...B,.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130279
Encrypted:	false
SSDEEP:	3:z8ANyq3jIZc:z8cy2wc
MD5:	610DFCD7FF61B76DAAC9DDC3CDAA64A9
SHA1:	343A63A7E2B0617F30B94E15E236DF7892FE722D
SHA-256:	7BA0ACE1E899C38CB5E8BF303868C0AB4B9890D536009CF21C958B114888DFA3
SHA-512:	D8095398ACC9DE610E42EAB655145BBACB09AE2D460906F9B490E48947EA802795C00CBFA3C674CDCC344D8A64FD63961D2D4A8999E0F0BADAFD3E367FE8B495
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rupdui.dll ..

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36320
Entropy (8bit):	6.363095921735073
Encrypted:	false
SSDEEP:	768:/ek2AuDHuROuyVrGWngM328PAh8bWgs5fLutlfpPKgPH:foebh8bRs5zutJx5
MD5:	DA9CC6631ECEDCF3819332552F1EB449
SHA1:	161B227A23E87E4D7A7F59CF12AB87CB8D5D41A9
SHA-256:	363C85F73AD85F041BBAFB141B8EF1B7BD7A1268DA6B39F96D81582303C9ABE3
SHA-512:	29262D594D4112577F60CAB26698731381FB19BC0AF28BAAF1A2F07951617FE71F8BC7AF30E330F7A936BC3531CF9BCC58B00C0AA86B8C28AB558DA845E62EE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....................i'......i1......i6.........z....i!.............i ......i;..............i&......i#.....Rich............PE..d...O0.\.........." .....V...........P....................................................@..........................................d..W....[..................`....l...!.......... ................................................................................text...GU.......V.................. ..`.data...4....p.......Z..............@....pdata..`............b..............@..@.rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\rupdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204768
Entropy (8bit):	5.825387232540853
Encrypted:	false
SSDEEP:	3072:pZN5YrUYkIih2FJ5tmN8DNWcpQOw9Tsk1n1WOA6uBgmW:pZNhfxh2FTpWO2T/1WOA6uc
MD5:	75C636087E541A9524752F1DF66AAB99
SHA1:	C33E55AF6F92D48BE994F1999193CCD9F1C586BE
SHA-256:	EA37728ABE1401F32F01C113701EAA447380B65E58934AB0360113CA86CA1FF6
SHA-512:	9A871DF80660DA09F7297D69ECAADAC13F03DDCD298F5300E83C194A394EEC990743FCE5B6B3554BC0123CE96D1F3D5F124344B7E5247D282D540D853BC11C3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$................dD....\....c....^....b..........R.......5Zf...5Zb...5Z_....X........5Z]...Rich...........................PE..d...80.\.........." .................~....................................................`.........................................@H..l....H..........(.......<........!..............................................p............................................text...=........................... ..`.rdata..............................@..@.data...ph...`.......@..............@....pdata..<............X..............@..@.rsrc...(............n..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102880
Entropy (8bit):	6.071756563190581
Encrypted:	false
SSDEEP:	1536:PFqz35CEMCZFwsbn60NhoBGO9otLJx39aHXI0OYWusz+xn:9wJ3MGimnrhoAOkNa3I0OYWtzu
MD5:	D0F22AFD5EAD9FFF432BE5746F2F989A
SHA1:	D83187AAAFD3BE638457E79961E54F22AFAD81F3
SHA-256:	C57FC5CFD1FA1241849AB423B49CE04D2EC361D2972204A2A9D7039D7100A8D7
SHA-512:	F2B0B06FB47775DFA448034953B4E5B97770F384978112FBAA7F1F1EF2EB37875634F963DB2E9515B4678DF63E314FBCE26D1A6A958C3DBC5C57E1CD32593D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.."..."..."..+.l.."...st.."...sK.."...sv.."...sJ.."...Z8.."..."..."....N.."...pp.."..."<.."....u.."..Rich."..................PE..d...H0.\.........."............................@..........................................`..................................................[..........\|............p...!..............8............................8..p...............P............................text...=........................... ..`.rdata..&g.......h..................@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc................d..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	487904
Entropy (8bit):	6.3408335931113395
Encrypted:	false
SSDEEP:	6144:EgjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvm:EglSTPaRxFdLXyJ/ebEEkx0rqJduw
MD5:	CF36C1CFF0210B423921398E8AEF1C59
SHA1:	85F694BAC2B4E2D724542AB518C7BF6C5361AD3E
SHA-256:	45230CA1752B1FD2901708A45E7CC6F1370F65C495D30B08D9F1CE4C8BEAF6FA
SHA-512:	925067AD750F6A01FA0C31DBD876088BB65C36AB8C0889A3A52F0D452154D2BE8284E1077BA1553E06DEAE2181F437E077F13D5FAFD8AD5A3F6C9FC417CB774F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................&.....7.......W.... .....0.....!.....:...d......'....."....Rich............................PE..d...w.[J.........." .........8......d..........t..........................................@..........................................4..........x....p.......@...(...P...!...........!..8............................................0...............................text...O........................... ..`.rdata.......0......................@..@.data...x.... ......................@....pdata...(...@...*..................@..@.rsrc........p.......B..............@..@.reloc...............F..............@..B..[J@...+.[JK.....[JU.....[Jb...+.[JK.....[Jo.....[Jy...........msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.ole32.dll.GDI32.dll..............................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrv_rupd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unidrvui_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	892896
Entropy (8bit):	6.044545103599267
Encrypted:	false
SSDEEP:	12288:hpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so7:JZ5F/bYogxJUB9cwtHFMD0
MD5:	D77628FCE2A09AD76889E3300150F99C
SHA1:	2280483371D679437901EDBCDEC0D11F057AF5E8
SHA-256:	9E1BE3FFE0AB8B8D3B6AA964AA9F752E850304A212BCE124C50AB08F1259CC0B
SHA-512:	BB8A28BB61321E5B414E1BC2C9267D38E2676AC1BE8DF27A9A747CB7F7CFE97C1DBFF6C723DC958BE594BE38312172DAF7243B47C25AF2C1D377EA76C423A0A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y'..I...I...I..`...I..`...I...H.R.I..`...I..`...I..`...I..`...I...7...I..`...I..`...I.Rich..I.................PE..d.....[J.........." .....$...V.................v....................................G.....@........................................../..{.... .................../...~...!..........`...................................................0............................text...[".......$.................. ..`.data....5...@...0...(..............@....pdata.../.......0...X..............@..@.rsrc...............................@..@.reloc..0............j..............@..B..[J`...+.[Jk...5.[Ju.....[J......[J......[J....+.[Jk.....[J......[J......[J......[J............msvcrt.dll.NTDLL.DLL.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll...............................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	771040
Entropy (8bit):	5.631799273811714
Encrypted:	false
SSDEEP:	12288:rkozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLC:dzBEGbL4Np84TQazCSiRC
MD5:	2AC9DA11C87F558D785924C5E814A6C2
SHA1:	6EDF8B0224B9D2F666E2DB4E093703508DABF512
SHA-256:	4CC04BFD8ED79191FAF1520B3ABA80B45E2EEB653D7C48A960CD18A59C04E001
SHA-512:	C4DA961C9C6A3AB586B8FDAFDF8D4C59A48D902E4300925B28E275DF1168E6FC1C2D51E4EB1E07429401090ABB4FD97AC7AC96E78DE50EBAC887B6007C1F4D3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d.....[J.........." ..........................@...........................................@.............................................................0................!...........................................................................................rsrc...............................@..@........................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Utilities - Host\Printer\x64\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.917051105867173
Encrypted:	false
SSDEEP:	6144:0g5dgFfqaKFJyHrByeUIRAHq0KzS9OAgfVgYCDlSv:0OdcUIRAHqAeX0a
MD5:	BDD8AE768DBF3E6C65D741CB3880B8A7
SHA1:	91B01FD48A586822C1D81CA80B950F8639CCE78C
SHA-256:	602ADD77CBD807D02306DE1D0179CB71A908EECB11677116FC206A7E714AB6D6
SHA-512:	7840554A66F033E556CF02772B8B3749C593657CA254E0F2DBD93B05F4600E11BA821EBA8FC038115C038B5E5AF2F8D2CF0A5AE1F1362E813CF0B5041BBBFF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.@.'.@.'.@....!.@.a...#.@.....&.@.a...%.@.a...*.@.a.../.@..P.. .@.'.A.T.@.a...6.@.a...&.@.a...&.@.a...&.@.Rich'.@.........PE..d...}.OR.........." .....n...........L...................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130279
Encrypted:	false
SSDEEP:	3:z8ANyq3jIZc:z8cy2wc
MD5:	610DFCD7FF61B76DAAC9DDC3CDAA64A9
SHA1:	343A63A7E2B0617F30B94E15E236DF7892FE722D
SHA-256:	7BA0ACE1E899C38CB5E8BF303868C0AB4B9890D536009CF21C958B114888DFA3
SHA-512:	D8095398ACC9DE610E42EAB655145BBACB09AE2D460906F9B490E48947EA802795C00CBFA3C674CDCC344D8A64FD63961D2D4A8999E0F0BADAFD3E367FE8B495
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rupdui.dll ..

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34272
Entropy (8bit):	6.279189104394536
Encrypted:	false
SSDEEP:	384:sPE2+V5RqtDLvnmQ67I+Ud26uiGKjjAVAjXzjrMishb8pL4g2t4Qh5ZSZwJdLSZb:s2gnH6sDGuB3jrRpLr2t4QhvpPKgCv
MD5:	52B7FE7D8EB30DB65D821F513C99532A
SHA1:	2D29A4B71DA3992352AFD2C49E0234C93DD993AC
SHA-256:	49898528597E2423086D53F9639068AF46D060EB2ABDFEEE7D28CE069CF86F91
SHA-512:	7EF81871AF993327792EBFE5920E464120F9088E9E55971ABE04B77FA4E75365B24898954B27972A6A74DA622CD1088094E3952E5939CB844AC9A063DF3BD703
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pZ.Y4;..4;..4;...4..:;..=C'.<;..=C6.9;..4;...;..=C!.7;..=C .5;..=C1.q;......5;..=C&.5;..=C#.5;..Rich4;..........PE..L...L0.\...........!.....F...........D.......`......................................Uz....@..........................U..W....M.......p...............d...!..........................................@...@...............t............................text....E.......F.................. ..`.data...\....`.......J..............@....rsrc........p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\rupdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	160224
Entropy (8bit):	6.183469966253267
Encrypted:	false
SSDEEP:	3072:TYmfMb3REEgw5ojOfC0ZV1AxNjwE0cqR4n2AMNR0wmlmo+W+DAeU:Xfso0ZV12Njwhcqy2AMNxwzEA1
MD5:	91EF01D7DFB11B218B67DB346562161F
SHA1:	F27B8A35BA7630C6AA26E21872CA1EE706642D1B
SHA-256:	48BA5C22A72132A140A881A62B20CE778DDB1B6E495BCD23FAAFC43FB01FB3B1
SHA-512:	FE3AC0AF8822780CA36F1BB9A9E1F5E4168E61415E4CCE8CC20F8E402D9E5EA9F53E5B2F0680C65213D81C04A3193BF2D85C0BAF3256009549D01319B18D9247
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.q.\.q.\.q..h..].q....._.q.....P.q.....X.q.....T.q.U...].q.\.p..q.U...K.q..V..V.q..V..D.q..V..].q.Q...].q.\...].q..V..].q.Rich\.q.........PE..L....0.\...........!.....L...N.......0.......`.......................................^....@.............................l...............(............P...!......@ ..................................Xz..@............`...............................text....J.......L.................. ..`.rdata..DC...`...D...P..............@..@.data....\..........................@....rsrc...(...........................@..@.reloc..@ ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88032
Entropy (8bit):	6.425120133434353
Encrypted:	false
SSDEEP:	1536:Df1NQO+vd2nRnm4Mxcdn/2hYN7ZOdrkgUzinLnx9oxGcZ:Jo2nRmxcFe5xNUz8D8
MD5:	243C54EF85CA15238782BE036632E0C5
SHA1:	93358BA47E32F9B7513ACD2A27E3F86C9F037497
SHA-256:	00ED874B46999FC5E48F145B9DF3792EA7204FFF3DB28EE035BAF2EFB8DD9902
SHA-512:	C9EE7E75F4BBB5934D1A0344375C68AE8B2A229857E7A3B0D1AED0A7CFFCD074F4D502B7D1B13928E793FE69A6ACC056D3CF98011FABE3B21E513D2E9D943B2D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&...&...&....^..&...wF..&...wy..&...wD..&...wx..&...^...&...&..0&..$.\|..&...tB..&...&...&..$.G..&..Rich.&..........PE..L...C0.\.....................n....................@..........................p............@.................................t........@..\|............6...!...P..........8...........................`...@............................................text............................... ..`.rdata...F.......H..................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383968
Entropy (8bit):	6.6511922978509315
Encrypted:	false
SSDEEP:	6144:9plBo/TK5C+psQzJzCSX6hjg+4GRr3CoA7f3j5G+hinZ5P31uGX7Zum8oyk7lAT8:Z0/djgEUhWnJ2UlxqOttoICvPn/318SW
MD5:	49A0A7C3E3F5DF3DDE7121109F1C9C21
SHA1:	716DA115C392CA06379A33079A54722800C13054
SHA-256:	CA38185341294720808A389C34D45FAF2EF7962A7D45AC7696823A6D05B45072
SHA-512:	9BBD8C585E42EC50D6FA9A38BCD39720F7A4F4730A1C8EECC3C5ECBADAFDFD6120D7FCAFA9A319F8D94FC962F537BD0B50EB7CAE614F5116B55D330F7FCE0118
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3g..3g..3g..:.;.4g..3g...g..:.=.8g..:.<.2g..:.-..g..:.*.sg.....2g..:.:.2g..:.?.2g..Rich3g..........................PE..L...$.[J...........!................-..............m................................].....@....................................x........................!..............8............................t..@.......\|.......`............................text...k........................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..Bo.[J8...K.[JC.....[JP.....[J].....[Jg.....[Jq...........msvcrt.dll.WINSPOOL.DRV.KERNEL32.dll.NTDLL.DLL.ole32.dll.GDI32.dll..............................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrv_rupd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unidrvui_rupd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756192
Entropy (8bit):	6.198619685669809
Encrypted:	false
SSDEEP:	12288:llIoM3g2e9Bg7Lg3yfKDPc97QpAxuKdwSGnZGxS:lvM36KkyCLW7QCwSGoS
MD5:	D66F58A5DF5AADDD348CB06B9326B84D
SHA1:	56B390BBB29DAEFE3171491D5697986A7D7AA0B3
SHA-256:	30D2605C283885C99E3F97D876989DE9E34380B20CF01D24DFDBE4CB50C92603
SHA-512:	5F0BF8698AE8809AF13D7E1504C1BF50BCDEC5C146A0AFA9F78174448E2D9A61AA83589C7836B452F3F9029FFBAAB8902138791EBFAD0EEB31B687A9EF7716BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..wf..$f..$f..$o.%$n..$f..$...$o.#$u..$o.3$8..$o."$g..$o.4$...$AZ.$g..$o.$$g..$o.!$g..$Richf..$................PE..L......L...........!.....2...2......e........@....(p................................K$....@.............................{....3.......p...............h...!...`...0...@..8...............................@............................................text...E1.......2.................. ..`.data........P.......6..............@....rsrc........p.......T..............@..@.reloc...0...`...2...6..............@..B..LX......Lc...o..Ln...&..Lx.....L....n..L....%..L....K..L.......L....r..L............msvcrt.dll.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll.......................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771040
Entropy (8bit):	5.630737263013527
Encrypted:	false
SSDEEP:	12288:UkoGBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLz:kGBEGbL4Np84TQazCSiRz
MD5:	41933A3BF1A30E05DC81ACCDA893E2B9
SHA1:	3C99CC28A6DB76000E3A31DC93C76AE18E2CD20D
SHA-256:	9C5CDC7BE14F3D404423EF9A8EA5A3EDC0157AA5F96F428FE7D857CE5F312FA2
SHA-512:	C5101249DB23080D76264505BF2DFCD636D99509E2DAA0CF601D5E997D145BF71721C2CFDB05AE0AFFD64317F7585040B2F7B48467367542C89D0F1F40F41D03
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L......L...........!..............................@.......................................@.............................................................!...........................................................................................rsrc...............................@..@........................................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247984
Entropy (8bit):	6.601853231729306
Encrypted:	false
SSDEEP:	6144:+SsS5fv6EATwqlGwyfDyodYI3ZubfW5nb2PQuW0x:+I5fv6EATwqlGwyfDyodYI3Zv1C
MD5:	69837E50C50561A083A72A5F8EA1F6A2
SHA1:	1A4B4C6C3CB6A5164CC1018AC72D0300455B3D8F
SHA-256:	9C9D4E421C55F7EF4E455E75B58A6639428CCD75C76E5717F448AFE4C21C52BC
SHA-512:	FD20C6B4EEC972C775681AD7322769D5074108D730727051EF77D779A277D77B12419E1FEE1E2EC0CF376A235573A85AD37975245DBF078DE467953AFD02164A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0p..Q..Q..Q..)..Q......Q......Q......Q......Q..P...Q..Q...Q......Q......Q......Q......Q..Rich.Q..........PE..L....OR.........."!.................4...............................................:....@.............................e=...A.......`...................>...p...R..0................................/..@............@...............................text............................... ..`.data...xp.......n..................@....idata.......@......."..............@..@minATL.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc...R...p...T...6..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\eventmsg.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53560
Entropy (8bit):	6.504835643855465
Encrypted:	false
SSDEEP:	768:wsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYqSwCpRAMxkE1:wza/pu/TKJ/OMpTryYfwc5x5
MD5:	B2E6147F97DAE696265A089F98CE8106
SHA1:	418F20EC486B7A9368CEFF183E7CEBAE9BA52101
SHA-256:	44917B2C260FEA3A0F4691F6E986C25E31B3F9FF22DCD055526199B4D8A54051
SHA-512:	789DD02281B71FAB54F42B92B5C0C76C0266C40100DBE532AD3EBBF968E8A9E674F0BE57E2FFDB10EB4A6B4FAA15A6A6A92907C020C6CD2990427D890D7F5026
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...q.7`.....................$...................@..........................`......i................................ ..q............P..................8!...@..................................................................$....................text............................... ..`.itext.............................. ..`.data...<...........................@....bss.....5...............................idata..............................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc.......@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\Program Files (x86)\Remote Utilities - Host\libeay32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1389368
Entropy (8bit):	6.858641353727598
Encrypted:	false
SSDEEP:	24576:2NaU+KpPikndiNfzN4jH3PlMQzMjYpOtJqTp/kqg1:+lUfzN4jH3PlyjYpOLqd/kP1
MD5:	B0433711581916700978618558131929
SHA1:	6513C7C14F19FA37C73926FC098A9DA678621E04
SHA-256:	26B24DCD9CB7AB8761AE7FB597704F81E2A6EDE6572A247C39A969960DBBA539
SHA-512:	A1D8BCD4B641B5E54A4435A70E19A56ECCE6DC9C7D9B6FC28F7829DE96D139C9CFD10F35F096529F8D33583BEA8FFE1B6C2636F2710D9D01F1A7513F77DB8589
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lU.(4.y(4.y(4.y!L<y.4.y!L-y34.y(4.y.4.y...y#4.y(4.y=4.y!L;y.6.y!Ly)4.y!L,y)4.y!L)y)4.yRich(4.y................PE..L...#..]...........!.................................................................d...............................A.......6..x.......0...............8!..........p...................................@...............(............................text............................... ..`.rdata..XY.......Z..................@..@.data............t..................@....rsrc...0............Z..............@..@.reloc..,............`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10931000
Entropy (8bit):	6.790449999326776
Encrypted:	false
SSDEEP:	196608:mY28xa5k15O2/w9DcmIHsZYk3BL5tksbmd:mY28xZh/xcY6LtbA
MD5:	6AAE165F3B1575DB887A0370CFC80083
SHA1:	18BC72662B4366035932719EF131417AACF9C184
SHA-256:	0C89262A283C80121BA1176345B230D0ADE61CFCF682B92E555A48206FB4074A
SHA-512:	666F1A5C6B0C7A5315D70EB0D75DA6232105E5673B44F6137BE4B10377B8D07C21720D05360CC653F543657478B08EEE1D95DB5FB1CB8D82D5C2A0F2FF68E7C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...,.9e.................z...,&...................@................................7.....@......@...................p..........W.....d...............8!.......D.....................................................8.......Dt...................text............ .................. ..`.itext...X...0...Z...$.............. ..`.data...p<.......>...~..............@....bss....................................idata..W.......X..................@....didata.Dt.......v..................@....edata.......p......................@..@.tls....h................................rdata..]...........................@..@.reloc...D.......F..................@..B.rsrc...d.........................@..@.....................p..............@..@................

C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21148984
Entropy (8bit):	6.620129778488873
Encrypted:	false
SSDEEP:	196608:Sd9U0CaHFxbNvfkPrWcrKZPYOrnnGdDoFI0wb6AIALUKyL5w2kEdyMZNAxa:Sd9U0HxxUPzoPGUAIALUKy/L
MD5:	652C2A693B333504A3879460D0AF7224
SHA1:	235BA3847DF3F39AD445B5B912CB2FB5224D9E59
SHA-256:	760E2FD3E57186B597D40B996811768E6C4A28CA54685E029104FCF82F68238D
SHA-512:	A717E916E9D881970694856F79F0E571B95C350F0B771027188DC9B27AB99C193149D4FE0E32CB4638C840340EB1DBD7FBF7458A58985A3E5BE7DA3345CD86C6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...8.9e.................&...jR......>.......@....@...........................O......HC...@......@..............................._......T.9...........B.8!......0...................................................(................................text...`........................... ..`.itext..4........................... ..`.data...$G...@...H...*..............@....bss.... ................................idata..._.......`...r..............@....didata.............................@....edata...............V..............@..@.tls....h................................rdata..]............X..............@..@.reloc..0............Z..............@..B.rsrc...T.9.......9..x..............@..@..............?.......2.............@..@................

C:\Program Files (x86)\Remote Utilities - Host\ssleay32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346424
Entropy (8bit):	6.566551582367787
Encrypted:	false
SSDEEP:	6144:f6MNzVTEz1LgXCpfoaDRQHojjYkARhcPL0U2pHGS5VdQ/TOEzrqArrpA1riT1PiH:f6MNzVgz1LgXCpfoaDqHojjYkARqPL0Z
MD5:	74F9696BE4B46F04A1263C3181405C35
SHA1:	CF66B349BEAA2BC25ED5807763E32018E4304C7B
SHA-256:	D6E8BEE1A9476ED3BE229F4BE81CC1154F1ED425E50E74FD1ABCD76C56EA062C
SHA-512:	F122E00B795476809994733028346D82945566CE4C2BE26444F02E077658CCB1BA0F3FE221CEF37837941054FE4B3B54B3F9A74861F890E56544D1453823FD68
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`...3...3...3...3...3..f3...3..w3...3..q3...3...3i..3..a3...3..p3...3..v3...3..s3...3Rich...3........PE..L...#..]...........!.........l......i5..............................................y...............................@....).....<....0..0............(..8!...@...,..@...............................@...@............................................text...j........................... ..`.rdata..............................@..@.data....[.......@..................@....rsrc...0....0......................@..@.reloc...3...@...4..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\vp8decoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389936
Entropy (8bit):	6.646719638285826
Encrypted:	false
SSDEEP:	6144:EIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwck:EI8tiDOzyH9H8Tu6h04fZMZoMPuvf6d
MD5:	C14000F68306F1CF0EC799DF9568AE01
SHA1:	788D8D7A0BA86BA6C7EF4F7AE50CDC65DDB348FF
SHA-256:	53B040341CE80F246C8437A99DF5252A48801E2154EB94DC50AF54A75D8D85AC
SHA-512:	2D4769949832794CE310474F843B696EA8EEB819554ECD72C449981988A6F8FBC5155D84A97D8A4C015348B3DFE6708F88C64B257D4A4D0D4A03DD068DDA4113
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g......"............#.O...T8.....T8..................T8.....'....................Rich............................PE..L...v..T...........!..... ...........2.......0......................................................................@q.......q..........................0!.......(...1..8............................U..@............0...............................text............ .................. ..`.rdata...J...0...L...$..............@..@.data...H>...........p..............@....rodata.............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\vp8encoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641784
Entropy (8bit):	6.688224632605251
Encrypted:	false
SSDEEP:	49152:vSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwW:vSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSg
MD5:	30448DB0AAC5AC16D7AD789011BF8D20
SHA1:	457A43F6D2A0120C138DD9D57BCB64B21F84D9D7
SHA-256:	D781088435617CA1FACF74C1304F82AFCB388813A75C8CB32213541D35B21832
SHA-512:	300E3AE2AC133E2494C449354582AD9BE51731D3E92D161B998DB14262CC08436EEDDB2B73A2F47CB4D1245348055F19E02721638A64A0630F513D4919B359DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:J<A[$oA[$oA[$o...o@[$o...o.[$o...op[$o...o.[$o...oC[$o...oL[$oA[%o.[$oA[$op[$o...o@[$oL..o.[$oL..o@[$oL..o@[$oL..o@[$oRichA[$o................PE..L...}..T...........!.........>.......*...............................................!......................................(............7..............8!.............................................@............................................text............................... ..`.rdata..............................@..@.data...$r......."..................@....rodata.............................@..@.rsrc....7.......8...0..............@..@.reloc..............h..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\webmmux.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	267064
Entropy (8bit):	6.532234442351241
Encrypted:	false
SSDEEP:	3072:zW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTD:zWSfr7sXSmPDbKPJ6/AsNk+N
MD5:	5E8673834662AC42B8363E19BC719282
SHA1:	BB1C1ED731830A03DB47D232E748DF4E4D196DB9
SHA-256:	A64A113955EC0D89AE6FF357F9BB1063C7DD29FE5610EE516A94AC17B11172C2
SHA-512:	3CF558B2D3CA03AED1EF0CFE36FB7FF3FE7A3AF63A4C3B0CB6CF13C58BAACAE17E5A01BAD743AFFAE8C4F5B9F5425DD4A97755ACA2DED99E70D782F699A9E225
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@~..!..!..!...p...!...p..!...p..+!..M...!..M...!..!...!..M...!..s..!..s..!..s..!..s..!..Rich.!..................PE..L...{..T...........!.........N.......k.......................................0......c[......................................4...x.......................8!......./..................................Ha..@...............l............................text............................... ..`.rdata..v...........................@..@.data....B......."..................@....rsrc...............................@..@.reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\webmvorbisdecoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	374584
Entropy (8bit):	6.776430632714067
Encrypted:	false
SSDEEP:	6144:saoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88Rt:ooPH0GgEp0gVd1ValsQXsH
MD5:	95D30B282132FB591FD5FDD94E52AF05
SHA1:	EB7ABE2F02C19EE41E4EFC2506337288141D70ED
SHA-256:	E6C04DC8359B2C76F765FCE37EC123D33ACBC5CE93E60022BA88EB7C867AC3F6
SHA-512:	9E4EA23519D243D6D3AE93D2501F05F35AA1CC6264ADB8F180F8A255BD35FB7996E110AC0EC7960FA0B93062BE45EB0C0922D9597E76EE8180781CC5C9A9C792
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mm..,...,...,...}...,...}...,...}...,.......,.......,...,..,.......,...~...,...~...,...~...,...~...,..Rich.,..........................PE..L...t..T...........!................b................................................K....@..........................M......@N..d.......0...............8!......d&..................................p/..@...............T............................text...=........................... ..`.rdata...E.......F..................@..@.data...\|<...`.......H..............@..._RDATA...............d..............@..@.rsrc...0............j..............@..@.reloc..d&.......(...n..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Utilities - Host\webmvorbisencoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881464
Entropy (8bit):	5.2453925074994965
Encrypted:	false
SSDEEP:	12288:DTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNl:cYF+Eyx2lzujtEIYRc1cQmsGa7ONl
MD5:	A663E7EF3F3CD7A1D4790B4EBF491C27
SHA1:	BFE086E653D0BC8D20ACAE61990BA4FA33F2A1F7
SHA-256:	8B1F95D7C0FDF25A6278347AFDA2F5AC4C86045C7FC530A330BE885D8A87EA68
SHA-512:	E78460C287646F509A50B878A34392546E01803A46C389E942073013A8292E3653713F2B6067842ECCCB09B7CDC13D1D9FFF76065AA61910FC3CEBE6A1C20C47
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A....u...u...u..C$G.3u..C$y.Iu..C$x..u...V..u...S..u...u..ju...H..u...'}.&u...'D..u...'C..u...'F..u..Rich.u..........................PE..L...s..T...........!.........R..............0......................................\.....@.........................`...........d....P..p............R..8!...`...D......................................@............0..T............................text...}........................... ..`.rdata.......0......."..............@..@.data...\|<..........................@..._RDATA.......@......................@..@.rsrc...p....P......................@..@.reloc...D...`...F..................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Remote Utilities\Logs\rut_log_2024-02.html

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CR line terminators
Category:	dropped
Size (bytes):	5364
Entropy (8bit):	5.485641443773401
Encrypted:	false
SSDEEP:	96:I0xccoJxML6RLidRLildgy99M/0bSOtfh/:IzcWS6pidpiHgyMMVtJ/
MD5:	F2E6FCC4D409479E68C5301C9A696197
SHA1:	48EBE4DB096CB4E318F3D69BEC6672FE13652035
SHA-256:	2A8CC3D804AA9FE8D87A392B4587D360B3DB47D0B88FDE34943AC395D13E803B
SHA-512:	4E818F5503CF118F80EF0DD6AFAB952F016BE24EBE56D34AEE23F56748361573C03472B194E982C32608973A730CCE525A13D0D1885023F213C691E4C7933131
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>Remote Utilities – ... ..</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nod

C:\ProgramData\Remote Utilities\install.log

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333
Entropy (8bit):	4.961347298932099
Encrypted:	false
SSDEEP:	6:HUc+jLmKRLQUUc+jLdd/ao+Uc+jLhHujHO7eVmUc+jLwmnXjKV+Uc+jLOLGeXkR+:0c+jfCvc+jDSoRc+j9Be7c+jRTmc+j6l
MD5:	57527D70DBA3E2FEB786357C144B5586
SHA1:	AFA68E6C5CC3FFA2E1B0148168C961B124B1FAB3
SHA-256:	85AEC0FB9F246A37363CD4FD1FAED3168DDC09901F700C7A4D1A6B6B3FA7625B
SHA-512:	01787D98D47BE918869D421405C8CFAB7D5AE0F8984E24BF6103614C8D2AC9A8A19468CD2E222EF4E69BBCD5CDE2FEB359113B2435C12C270F6886ED4792CA28
Malicious:	false
Preview:	02-02-2024_09:37:08#T:SilentInstall: installation 70220..02-02-2024_09:37:08#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK..02-02-2024_09:37:08#T:SilentInstall: OpenService: service not found_1. OK..02-02-2024_09:37:08#T:SilentInstall: CreateService. OK..02-02-2024_09:37:08#T:SilentInstall: finished (installation) 70220..

C:\ProgramData\Remote Utilities\msi\70220_{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\Exel.msi

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	false
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\Exel.msi

Download File

Process:	C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	true
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\49a7b6.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	false
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\49a7b9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer contains the logic and data to install Remote Utilities - Host 7.2, Keywords: Installer,MSI,Database, Subject: Remote Utilities - Host 7.2, Author: Remote Utilities Pty (Cy) Ltd., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Wed Oct 25 17:17:52 2023, Create Time/Date: Wed Oct 25 17:17:52 2023, Last Printed: Wed Oct 25 17:17:52 2023, Revision Number: {BFB6CB81-8A2D-41FC-A737-5CF8EB370093}, Code page: 1252, Template: Intel;1033
Category:	dropped
Size (bytes):	22656000
Entropy (8bit):	7.906722436026202
Encrypted:	false
SSDEEP:	393216:WL2lXkXWYidpIsMLU9zQR5bFvt8uy+zZKKRa8n2o8lQKai847ZxNwb:WLY6G3Mgxmvtry+zxk8wTxNO
MD5:	DBC84F3FE9ECE7369D0FA36E34CE4844
SHA1:	37412165A73BCD574D7F2F34147F2A530FEB7936
SHA-256:	3E88E8A58C47562ED0FC4302BC22247C6D5282757CC18C316757475176FF48C1
SHA-512:	F0969CFB4B23050779391C852961E71A93C8CB1ED7378585FB573A15510D289F942286B7D302D9E352DC77CBE5A539307DC3EA923EC4A06895E072E36B815111
Malicious:	false
Preview:	......................>...................Z...............8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?.......A...B...C...D...E...F...G...H...I...J...O...L...N...........P...Q...R...U...........V...Z...X...Y.......[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIAB6F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169896
Entropy (8bit):	6.068969720857241
Encrypted:	false
SSDEEP:	3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
MD5:	B5ADF92090930E725510E2AAFE97434F
SHA1:	EB9AFF632E16FCB0459554979D3562DCF5652E21
SHA-256:	1F6F0D9F136BC170CFBC48A1015113947087AC27AED1E3E91673FFC91B9F390B
SHA-512:	1076165011E20C2686FB6F84A47C31DA939FA445D9334BE44BDAA515C9269499BD70F83EB5FCFA6F34CF7A707A828FF1B192EC21245EE61817F06A66E74FF509
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._`,"..Bq..Bq..Bq..q..Bq<.q..Bq..q..Bq..q/.Bq..qh.Bq.y.q..Bq.y.q..Bq..Cq..Bq..q..Bq..q..Bq..q..Bq...q..Bq..q..BqRich..Bq........PE..L.....,a...........!.....p...$......................................................U..................................m............`..p............x.......p..........................................@............................................text....o.......p.................. ..`.rdata..M............t..............@..@.data....1... ......................@....rsrc...p....`.......$..............@..@.reloc...L...p...N...*..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIACD8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1408583
Entropy (8bit):	4.8128312343081046
Encrypted:	false
SSDEEP:	24576:HMMMMMMSLLLLLLLTMMMMMMSLLLLLLLJMMMMMMSLLLLLLLg:HMMMMMMSLLLLLLLTMMMMMMSLLLLLLLJr
MD5:	C1D50A44D3E5171DAEC6BDBF802AC9A5
SHA1:	0707ACD0DED1024989A8043E344D87E7A96218F8
SHA-256:	26C3BE848122AD72E9AF24FE877761D46AE92E34383704F763B4D3D529446D86
SHA-512:	C08F0A7E8741B7C12604A1C267CEA786C917FBC916748DD52D05D80603C2DEB5F23EAAE202A71E5157466CE54CBCA1BE6798A22BFB79D94FA81D2FE3EF1F313B
Malicious:	false
Preview:	...@IXOS.@.....@.LBX.@.....@.....@.....@.....@.....@......&.{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}..Remote Utilities - Host..Exel.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{BFB6CB81-8A2D-41FC-A737-5CF8EB370093}.....@.....@.....@.....@.......@.....@.....@.......@......Remote Utilities - Host......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}/.C:\Program Files (x86)\Remote Utilities - Host\.@.......@.....@.....@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}...@.......@.....@.....@...........@....&.{00000000-0000-0000-0000-000000000000}.@.....@.....@......&.{3244CDE6-6414-4399-B0D5-424562747210}...@.......@.....@.....@......&.{197F692B-7CCA-4D79-85A5-ED04202D08D0}...@.......@.....@.....@......&.{E79AC184-AD38-4B26-89D0-75B7CEA19FA2};.C:\Program Files (x86)\Remote Utilities - Host\Printer\x86\.@.......@.....@..

C:\Windows\Installer\SourceHash{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1620403438347329
Encrypted:	false
SSDEEP:	12:JSbX72FjMiliAGiLIlHVRpzh/7777777777777777777777777vDHFwd8mvbLHpc:JEQI53W8qXa8F
MD5:	0A729EC420FB3F9CFEEA56D3C5E02D22
SHA1:	781F706A6827E089154CE5270FC9F2D27C503F35
SHA-256:	D14BFCF752F4EDD77151479A460CCD7F085C2803D594A1325A016FD215E8B9C6
SHA-512:	E2BFD7255B6296B52C95C91917C101A9C7F0C74DA4373FC784B5213B142CF278E9787B7E4418F07302BCEF9785E450F4C745A4313084B70BA856916DDA061262
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.895945339984345
Encrypted:	false
SSDEEP:	48:g8Ph4uRc06WXJuFT5d9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB29Y:Ph41FFT4lXJnBy/itbCqLJnBy/i0
MD5:	C54E6183C8ADF3D4D90D07D00FA4BD0E
SHA1:	5E8D8E07E5B9609C8FDF6D055E926F719561027B
SHA-256:	3DB177C510404B0889856D3828FF6AB9E6A1F057A6878304B3DF3E4890F79E78
SHA-512:	60C821E1AD75FB9E2915142222168FB672E9571DD71E0F3A51D19EE8AA13B89F0C325CC8C4D471B9F881C7762D395228D541466978E52B4C3C748142ABC826C4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	71360
Entropy (8bit):	5.493854356833401
Encrypted:	false
SSDEEP:	768:PMAyYdTmPJbgqcnDckJdtwCpKAMxkE0twCRr5AMxkEo:P1U81ckJdtwsoxYtwUdxc
MD5:	C5D9AD25A352AB74B481CB2A0E938E40
SHA1:	400D21EEB68A31136C49C4FE5B3FC042CB278CAB
SHA-256:	885C1CD9C61F93C7284FD1DA853D5C58000419655525413CA469B9D5E806403F
SHA-512:	E919646B606B2C8984D1DD9FF5B6FC4F92930290339263D56487DA8A702EC68551B2950E20EF531B452022F3F9FB61A72F73196826AB3E70BDE5521717666FD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.........................................................................4T..(.......t0...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...t0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63168
Entropy (8bit):	5.217205507888401
Encrypted:	false
SSDEEP:	768:0dMAyYdTmPJbgqcnDc/soJCtwChfqAMxkE1twC53AMxkE7:u1U81cLJCtwsgxJtws3xP
MD5:	D0F686C7B7334657E93B8DB349F9540D
SHA1:	F855C4FA5FBBCF79C6246AF94EB0046CE8FDCE45
SHA-256:	8DECE53004FFEE3BA42A820D1EBEA3CA1482299A6B5B80D682D9D8CDE3070B31
SHA-512:	C883A8DCD573DF1757FB3737D93B40AB25F83A3896DAF610C0112AF2FDE79EDEE1EC9B9499DF073F4F9D7FB80CD51A8663C4485C8B0DC426CA339032B1902C15
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...`...............P....@.................................\.......................................4T..(.......\................F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...\........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415424
Entropy (8bit):	4.597963610747478
Encrypted:	false
SSDEEP:	1536:01U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLl:cjcT6uuuutMMMMMMSLLLLLLLeYCk
MD5:	0A46537981B366DA572524EA4F0F834D
SHA1:	55AA01DF1728DEF4F143084839980043DDB536A3
SHA-256:	FA4A8E01B7748A816CDF2CF7D29E2B926EE4200F685DC87B2CFEB3CE4D0AA55D
SHA-512:	D1EA98137B8FC3B9F88500E0CF40792937B6A8C5FC918ED6E20C5304A6E779F4864DDEE70D67E1B5FCDCF1CB63E185E5F6CB66AC08A2993F644D41EFEDA97F40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................Zj......................................4T..(........u...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415424
Entropy (8bit):	4.597721784431409
Encrypted:	false
SSDEEP:	1536:W1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLj:CjcT6uuuutMMMMMMSLLLLLLLeYSa
MD5:	0DFAE3FEC66BC6813B9C75C76DBDF0F4
SHA1:	537352720EB1427EFD8E971C7B1CC4F2A007868F
SHA-256:	3F2B3730D09552BED4B2CF28C1E237313A7BE313F9E330BC77B147F29B96081E
SHA-512:	84BBBAA2A91AB2E6A2D5ACF7D956DCCD24B1ED55F5E1913601EAB2BE5F5BBE8FA59048BCF27A7F731A878990AB6AF644386F2FC41749236F23FE559093B2BDB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................F.......................................4T..(........u...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{3FF12DDA-38DA-466F-B4E3-6775ACEF5538}\en_server_stop_B603677802D142C98E7A415B72132E14.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415424
Entropy (8bit):	4.597627123267687
Encrypted:	false
SSDEEP:	1536:31U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLL2:ljcT6uuuutMMMMMMSLLLLLLLeYe
MD5:	13D157111B98791617D98963B653F7FD
SHA1:	062439148EE03C9EFBE24C2E4D801B55F6D76389
SHA-256:	23ACEF13F15429D6F30531224CB1E9C58E64B804351C58A89CE7597CAE1DA6AB
SHA-512:	AC435AC73809178001233E6C8753C5320EE271721E903D1D66FBC65994985A9656CF2A31FD215BC230E5C10F1CAD6B49616E2B6BFEF4FF1213E518E4E8BFE10F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@..................................\......................................4T..(........u...............F...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375172572548565
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauB:zTtbmkExhMJCIpEr4
MD5:	6BC3260469EC902DB1D090931B067D6A
SHA1:	2A20547F710A0AF56CF53F253B12AE6E35522274
SHA-256:	E87E04370D79BC679540D592857C0C34F36876A8698ACBEBB8CBF9FC24C2024E
SHA-512:	F4913C0EA6682CEE3C9E23F8DC263630F16D68517A08C3265F03407CCF08701C3899E658C8BC8A885B755AB7846699AAE7C49CCDE3261AC0D1EC6CB988901502
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	6.642066835146045
Encrypted:	false
SSDEEP:	6:ZOxjUpUGgtzuaUUG5o7IpP/pUG3QItzuanflflcZa3kK6l2cZbNjF:ZPnaUUG5FgIgaNfGZaUycZbNB
MD5:	7C8F509EE8BA0782632512240F655578
SHA1:	D41ED379B131EE745D21B000DF047E1A07C76F88
SHA-256:	56C31A3824DC1B9DB307931E3F4F698D9757C22E2011B7DFB381E5EAC0A12366
SHA-512:	A9D6D4AB73527699B1C03C6215DBE7E06D2DCE0597A1DEF28CF4016B541BDE20CD07DB04A29488C1CB7E634305874734AF9A4BFFEC52C5296B5DC5D9AB68B44C
Malicious:	false
Preview:	0..6....../0..+..+.....0......0...0........H.....6A..cib).K...20240201184200Z0s0q0I0...+..........G+~..w.#.....W.....H.....6A..cib).K......@....QC.Y..@)....20240201184200Z....20240208184200Z0....H.=....i.0f.1..J(.\.x....5...2z.....LY.i;Bn....;r..X..4...1...5...<]VZ..[..?:4O.._..I...'....X.....xk...2...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	313
Entropy (8bit):	6.5546319534749
Encrypted:	false
SSDEEP:	6:MBN7ULL7ujQQW+G5o7/MqexL7hf4c+ouzQVtqpmwdFiOfUOELX6eqSJZ:MbY+WX5nrxaStqowd7fUOEj6HgZ
MD5:	888564A0B6D055C179A5CA8137F69617
SHA1:	6A31E95C20B58030865F3CA6D1E8CED3794C259F
SHA-256:	5A4A8BEF73E85D46EC53B81F57BA964FD755D101CF7AE7B60F0EB0451B6DE64D
SHA-512:	D7161FA3675131C1359674CE5CEE688FCF96C7129D5A7DE1BE5C08CCD4358F3D8D404D2DF9656E6C2492115257D664D4C7DE787F7B9988C274CCD009DBF80468
Malicious:	false
Preview:	0..5.......0....+.....0......0...0......._.6.....'..."...8w...20240202051846Z0s0q0I0...+..........[.x.A.<.q)nj.L.._..._.6.....'..."...8w.....G..jZ.n#.A~......20240202050302Z....20240209040302Z0...*.H.=....h.0e.0.}.H.......hw^Cb..'.x.).2.^..-~1p0a.q..'.2.1..OoEb.p1.$7<'.....-}........V]e%....3s.p1d

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	404
Entropy (8bit):	3.913938006640074
Encrypted:	false
SSDEEP:	12:tcNldkEX66sMNmxMiv8sFpT6er+iTw73br:eAEXbsOmxxvbLFTkbr
MD5:	E27E17654028F5B828483EAD36078AD0
SHA1:	4B7D6AE60A07C14BF50B715D0DBC9B5FDE4C03F3
SHA-256:	2F0A81F46DBE0C6B8FD86D1034000E88A308FFB01CDD299048B9421522EAA070
SHA-512:	9B775406662679633438912C80BB2C0BD0E0717B87AE5D9AF37CD6D88000F3E22B8EE2426D59A0838E424D2D84D0087D2B83AE003B58297C31CC74BC0D1F3389
Malicious:	false
Preview:	p...... .... .....g.U..(.................0W>U.......Z.......................Z.. .........9a.U.. ...............:...h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.r.j.r.y.d.R.y.t.%.2.B.A.p.F.3.G.S.P.y.p.f.H.B.x.R.5.X.t.Q.Q.U.s.9.t.I.p.P.m.h.x.d.i.u.N.k.H.M.E.W.N.p.Y.i.m.8.S.8.Y.C.E.A.%.2.B.4.p.0.C.5.F.Y.0.D.U.U.O.8.W.d.n.w.Q.C.k.%.3.D...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_ED80F76A55EEDF047A88FD3F37D62FA3

Download File

Process:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	408
Entropy (8bit):	3.9247957560796167
Encrypted:	false
SSDEEP:	6:kKe38qwaRNfOAUMivhClroFH18WilzmlwyiilHDuel8DtQHl+w4lWqlk77ANn:S8faLmxMiv8sFarlyFiiMe+4l+w4PlZ
MD5:	57DA74F59030AED7A30414D6DD925FBB
SHA1:	39FB0C31C8BF2A032F3D788402B33F4C0E363964
SHA-256:	78D399CA8C184B2F7017C8FEAF5B44D237C4379F7CE95A0A013C707C9501614B
SHA-512:	743F7DEE3E86D585EBCB844F8CA099CB5B2CBC9218F0F842069F50639FAA4D666351314D80051F3F2BCE1F746B12EAD15F7A6FFA1F812E6331AB302F37908F8F
Malicious:	false
Preview:	p...... ....$...C.T.U..(....................U....2..[....................2..[.. .........(..U.. ...............9...h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.S.E.6.7.N.b.q.3.j.f.Q.Q.g.8.y.X.E.p.b.m.q.L.T.N.n.7.X.w.Q.U.m.1.%.2.B.w.N.r.q.d.B.q.4.Z.J.7.3.A.o.C.L.A.i.4.s.4.d.%.2.B.0.C.E.A.7.z.K.k.e.s.D.W.p.a.7.2.4.j.j.E.F.%.2.B.2.x.0.%.3.D...

C:\Windows\Temp\~DF10BD94535F44088B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.49702049430394
Encrypted:	false
SSDEEP:	48:2dwuMO+CFXJvT55Ukym9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB2i:iwGHT3twlXJnBy/itbCqLJnBy/i0
MD5:	1A8F292A886E376D3C2C702958B09E06
SHA1:	7BCBF4DAE59C69329CDD083A6F192E312E06368C
SHA-256:	800111B992522BBAF77236A54AE82173F1CB7FA83180322908950C4E926A8625
SHA-512:	96FF0F3398CFA46F847CCEA2335AC84D117DDA5A5E945C6D2E2CDAF33DC12A093463AB9F28FACB26D94EFBA5D149591B7AF0B5DBB8798BF375BE1CD3BB1FD640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF43AE85119F93081A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06887906536849638
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOwd6SumvbfzYsEoVky6l0t/:2F0i8n0itFzDHFwd8mvbLK01
MD5:	BE571F185F10B61BEC870EE494C2DB99
SHA1:	F2C1BE92CDA3689AE4B7C426715C8FA1C31A31CA
SHA-256:	F6BF0799FD664C0732F91B052E213BDBB42BA5AC71D0F846739E9E85B21A59D2
SHA-512:	0D8425263AC7F1B7EF53A3CDB2019135A651BDA8283CE5568A8EC0C8B8ED88ACAFE2A6F00ACD0FD92035D1A0EE9EC2DF04E21B76ADB79CF790883B55AE88892F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF46A59DA49B45DF44.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.895945339984345
Encrypted:	false
SSDEEP:	48:g8Ph4uRc06WXJuFT5d9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB29Y:Ph41FFT4lXJnBy/itbCqLJnBy/i0
MD5:	C54E6183C8ADF3D4D90D07D00FA4BD0E
SHA1:	5E8D8E07E5B9609C8FDF6D055E926F719561027B
SHA-256:	3DB177C510404B0889856D3828FF6AB9E6A1F057A6878304B3DF3E4890F79E78
SHA-512:	60C821E1AD75FB9E2915142222168FB672E9571DD71E0F3A51D19EE8AA13B89F0C325CC8C4D471B9F881C7762D395228D541466978E52B4C3C748142ABC826C4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF529C0FE4C5A9CE4B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF70B43A60818B563C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8E23FC32B87CAA71.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9FE2B93D9F6F7365.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB588C3675999CB76.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.895945339984345
Encrypted:	false
SSDEEP:	48:g8Ph4uRc06WXJuFT5d9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB29Y:Ph41FFT4lXJnBy/itbCqLJnBy/i0
MD5:	C54E6183C8ADF3D4D90D07D00FA4BD0E
SHA1:	5E8D8E07E5B9609C8FDF6D055E926F719561027B
SHA-256:	3DB177C510404B0889856D3828FF6AB9E6A1F057A6878304B3DF3E4890F79E78
SHA-512:	60C821E1AD75FB9E2915142222168FB672E9571DD71E0F3A51D19EE8AA13B89F0C325CC8C4D471B9F881C7762D395228D541466978E52B4C3C748142ABC826C4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCE78CABB386C66F3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD5F4580B380072C8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.49702049430394
Encrypted:	false
SSDEEP:	48:2dwuMO+CFXJvT55Ukym9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB2i:iwGHT3twlXJnBy/itbCqLJnBy/i0
MD5:	1A8F292A886E376D3C2C702958B09E06
SHA1:	7BCBF4DAE59C69329CDD083A6F192E312E06368C
SHA-256:	800111B992522BBAF77236A54AE82173F1CB7FA83180322908950C4E926A8625
SHA-512:	96FF0F3398CFA46F847CCEA2335AC84D117DDA5A5E945C6D2E2CDAF33DC12A093463AB9F28FACB26D94EFBA5D149591B7AF0B5DBB8798BF375BE1CD3BB1FD640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDE25689DD43B2CB0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.26499363023775985
Encrypted:	false
SSDEEP:	48:QtwXSB29odTfdTuOdThRXdTpkdTpdTKdTI9mSKdTfdTuOdThRXdTpkdTpdTKdTtR:w+qLJnBy/ifXJnBy/itbV
MD5:	4B10A259B2226A26CD98E062FB70F4D6
SHA1:	C6D44E56DEEAD4F3ED0F2AE9D656E88A8A2B258A
SHA-256:	C15AC826D08AB6FC2DDA39716E318A15F291FE8C226AC339B0F56AE784A30407
SHA-512:	63E623E51AC09C3BB7A22AA787C13A06006DAB60CE25020FBDFD4FBEDF808FE82FC555C244246182233E39D091B76C0C379EC3A25C87DFAD4A35FDC5498D344B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE4BF60F9C7AF91F3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.49702049430394
Encrypted:	false
SSDEEP:	48:2dwuMO+CFXJvT55Ukym9ue9mSKdTfdTuOdThRXdTpkdTpdTKdTt6AdTnUo94SB2i:iwGHT3twlXJnBy/itbCqLJnBy/i0
MD5:	1A8F292A886E376D3C2C702958B09E06
SHA1:	7BCBF4DAE59C69329CDD083A6F192E312E06368C
SHA-256:	800111B992522BBAF77236A54AE82173F1CB7FA83180322908950C4E926A8625
SHA-512:	96FF0F3398CFA46F847CCEA2335AC84D117DDA5A5E945C6D2E2CDAF33DC12A093463AB9F28FACB26D94EFBA5D149591B7AF0B5DBB8798BF375BE1CD3BB1FD640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.99798080331911
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
File size:	20'949'417 bytes
MD5:	075d6c122274cb9226521d3cd298f2f2
SHA1:	6f54d70f39fa28596ef90bfcb0c14278b016db1b
SHA256:	92192af947017c20ad861faf4459fb705e63f7083b34c77c1727891b88091573
SHA512:	c89f25e451ae095635bee4df25cbf7bb8431d87017ae65898471b346ee3b2a8694b5a45aa00e4dc54881905643c62843216d402e10faadd195e10922a29573be
SSDEEP:	393216:9Vz6+gdQzi/Ew1x1vXYQBEPDdasNaAzEFuEaP3CxMk50pRZfQCy0lifWA5J8EOx:LHSvI+EPDdXNaHaP4Mk50hfh/ieA5nOx
TLSH:	14273306D79D18FCC8A9E67D985B4C47E633784D2211A48F176949A22F83334ED3F72A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	0e0f7834fc39070c

Static PE Info

General

Entrypoint:	0x140032dc0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6579B995 [Wed Dec 13 14:03:01 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F11E0BCA2E8h
dec eax
add esp, 28h
jmp 00007F11E0BC9C7Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F11E0BC9103h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F11E0BC9E13h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F11E0BCBE27h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F11E0BB8693h
dec eax
lea edx, dword ptr [00025887h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F11E0BCAEE2h
int3
jmp 00007F11E0BD10C4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597c0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597f4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x1e324	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8f000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588dc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4664e	0x46800	cb5fa3169f581ba82faed363ff4f6e49	False	0.5365483710106383	data	6.468535106678591	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128e4	0x12a00	919da1ea112d11a732dbc754aee3741b	False	0.44967753775167785	data	5.272430005055125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	17e6aee7483d05299c67ef1c20548699	False	0.28260216346153844	data	3.2575802848760493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	bb12e72c2a1957150354ef39796c9470	False	0.485625	data	5.507547185354104	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	ced4b34f6105bed5c533724cbd855e33	False	0.2568359375	data	3.0248828943464656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	c67570d55af77c6d3a435fe95a2589ac	False	0.40625	data	3.3215020267482327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x1e324	0x1e400	89bca75165439faf93b747f75742c27d	False	0.938646048553719	data	7.896782666673534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8f000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70524	0x13154	PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced	0.9947162376541631
RT_ICON	0x83678	0x858e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9985668324071366
RT_DIALOG	0x8bc08	0x2ba	data	0.5286532951289399
RT_DIALOG	0x8bec4	0x13a	data	0.6560509554140127
RT_DIALOG	0x8c000	0xf2	data	0.71900826446281
RT_DIALOG	0x8c0f4	0x14a	data	0.6
RT_DIALOG	0x8c240	0x314	data	0.47588832487309646
RT_DIALOG	0x8c554	0x24a	data	0.6279863481228669
RT_STRING	0x8c7a0	0x1fc	data	0.421259842519685
RT_STRING	0x8c99c	0x246	data	0.41924398625429554
RT_STRING	0x8cbe4	0x1a6	data	0.514218009478673
RT_STRING	0x8cd8c	0xdc	data	0.65
RT_STRING	0x8ce68	0x470	data	0.3873239436619718
RT_STRING	0x8d2d8	0x164	data	0.5056179775280899
RT_STRING	0x8d43c	0x110	data	0.5772058823529411
RT_STRING	0x8d54c	0x158	data	0.4563953488372093
RT_STRING	0x8d6a4	0xe8	data	0.5948275862068966
RT_STRING	0x8d78c	0x1c6	data	0.5242290748898678
RT_STRING	0x8d954	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x8dbbc	0x14	data	1.05
RT_MANIFEST	0x8dbd0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2024 09:37:22.025059938 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:22.028461933 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.041404009 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.042712927 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.042725086 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:22.051462889 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:22.247539043 CET	5651	49735	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:22.247647047 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.260546923 CET	465	49736	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:22.260616064 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:22.263031006 CET	80	49737	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:22.263729095 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.027426004 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:23.027559042 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:23.121231079 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.121229887 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.230521917 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:23.230535984 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.714910984 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.715123892 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:23.933636904 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:25.105581999 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:25.105581045 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:25.105592012 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:25.105974913 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:25.230550051 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:25.418035030 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:27.368830919 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.489749908 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:27.489840984 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.490696907 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.490799904 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:27.611716986 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:27.683662891 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:27.699285030 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:28.152405977 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:29.105572939 CET	49734	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:29.105745077 CET	49738	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:29.230571985 CET	49739	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:32.840043068 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:32.886811972 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:33.621156931 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:35.988476992 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:35.988694906 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:35.999866962 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.018121958 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:36.114202023 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.114248037 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.996181965 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:36.997667074 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:37.011818886 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:37.027415991 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:37.121166945 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:37.121167898 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:37.532773972 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.533879995 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.534821033 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.621692896 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:37.621757030 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:37.753740072 CET	5651	49748	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:37.753849030 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.755201101 CET	465	49750	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:37.755371094 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:37.755496979 CET	80	49749	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:37.755561113 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.418041945 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.418060064 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.418364048 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.949394941 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.949395895 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.949398041 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:38.996162891 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:38.996314049 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:39.011812925 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:39.043061972 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:39.121176958 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:39.136789083 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:40.261966944 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:40.261971951 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:40.277654886 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.871217966 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.873662949 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.933794022 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:42.996592999 CET	49742	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:42.997653008 CET	49743	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:43.027424097 CET	49744	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.043051958 CET	49745	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:43.121186972 CET	49747	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.136895895 CET	49735	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:43.136895895 CET	49746	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.246273041 CET	49737	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:43.796216965 CET	49751	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:43.875823975 CET	49752	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:44.558669090 CET	49736	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:44.796236038 CET	49751	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:44.886828899 CET	49752	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:46.063117981 CET	49753	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:46.076226950 CET	49754	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:46.173964024 CET	49755	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:46.191998959 CET	49756	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:46.808845997 CET	49751	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:46.886821985 CET	49752	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:47.074276924 CET	49753	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:47.090042114 CET	49754	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:47.168040991 CET	49755	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:47.199326038 CET	49756	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:47.743442059 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:47.743546963 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:48.074362993 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:48.076666117 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:48.246167898 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:49.074373007 CET	49753	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:49.105628014 CET	49754	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:49.168129921 CET	49755	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:49.214916945 CET	49756	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:50.808662891 CET	49751	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:50.902405977 CET	49752	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:52.849366903 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:52.890458107 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:52.891227007 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:53.070310116 CET	80	49757	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:53.070590019 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:53.074275017 CET	49753	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:53.109831095 CET	5651	49758	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:53.109921932 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:53.110255957 CET	465	49759	101.99.94.54	192.168.2.4
Feb 2, 2024 09:37:53.110336065 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:53.121148109 CET	49754	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:53.168034077 CET	49755	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:53.230556965 CET	49756	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:53.746154070 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:53.761774063 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:53.761795998 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:53.838515043 CET	49761	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:53.936974049 CET	49762	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:54.293028116 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:54.293045044 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:54.293047905 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:54.839920044 CET	49761	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:54.949264050 CET	49762	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:55.191329002 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:55.191376925 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:37:55.191471100 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:37:55.589925051 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:55.589932919 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:55.653656960 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:56.125189066 CET	49763	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:56.138747931 CET	49764	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:56.238107920 CET	49765	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:56.238116980 CET	49766	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:56.855521917 CET	49761	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:56.949290037 CET	49762	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:57.136828899 CET	49763	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:57.152422905 CET	49764	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:57.230742931 CET	49765	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:57.232350111 CET	49766	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:58.168077946 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:58.168246984 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:58.355572939 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:58.464973927 CET	49749	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:58.480515957 CET	49750	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:58.855585098 CET	49748	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:37:59.136773109 CET	49763	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:59.168147087 CET	49764	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:37:59.246335030 CET	49765	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:37:59.246526957 CET	49766	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:00.855573893 CET	49761	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:00.949284077 CET	49762	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:03.136782885 CET	49763	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:03.168047905 CET	49764	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:03.246189117 CET	49766	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:03.246193886 CET	49765	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:03.308765888 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:03.324328899 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:03.761811018 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:03.890258074 CET	49767	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:03.999679089 CET	49768	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:04.902468920 CET	49767	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:05.012670994 CET	49768	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:05.322232008 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:05.322312117 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:06.187670946 CET	49769	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:06.202579975 CET	49770	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:06.297880888 CET	49771	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:06.311985970 CET	49772	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:06.918072939 CET	49767	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:07.011812925 CET	49768	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:07.199484110 CET	49769	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:07.199614048 CET	49770	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:07.308804035 CET	49771	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:07.324448109 CET	49772	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:08.463413954 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:08.468446016 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:08.469692945 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:08.682470083 CET	80	49773	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:08.682552099 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:08.688801050 CET	465	49774	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:08.689166069 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:08.689757109 CET	5651	49775	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:08.689815044 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:09.214900017 CET	49769	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:09.230515957 CET	49770	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:09.311933041 CET	49771	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:09.339905977 CET	49772	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:09.339912891 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:09.339930058 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:09.339931965 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:09.871155977 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:09.873063087 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:09.875725985 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:10.918019056 CET	49767	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:11.011847973 CET	49768	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:11.168054104 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:11.168054104 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:11.183773041 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:13.215008974 CET	49769	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:13.246216059 CET	49770	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:13.324297905 CET	49771	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:13.339929104 CET	49772	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:13.591820955 CET	49759	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:13.621256113 CET	49758	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:13.746207952 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:13.761920929 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:13.793179989 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:13.957506895 CET	49776	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:14.063043118 CET	49777	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:14.574362993 CET	49757	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:14.964932919 CET	49776	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:15.074326038 CET	49777	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:15.447232962 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:15.447443008 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:16.251576900 CET	49778	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:16.266746044 CET	49779	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:16.366787910 CET	49780	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:16.374257088 CET	49781	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:16.980549097 CET	49776	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:17.074305058 CET	49777	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:17.261850119 CET	49778	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:17.277504921 CET	49779	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:17.371259928 CET	49780	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:17.371279001 CET	49781	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:18.886785984 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:18.951739073 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:19.011862040 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:19.261790037 CET	49778	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:19.277420998 CET	49779	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:19.371165991 CET	49780	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:19.371187925 CET	49781	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:20.668853998 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:20.794096947 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:20.794130087 CET	5655	49741	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:20.794188976 CET	49741	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:20.980581999 CET	49776	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:21.074306965 CET	49777	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:23.277488947 CET	49778	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:23.277509928 CET	49779	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:23.371171951 CET	49780	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:23.371181011 CET	49781	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:23.846169949 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:23.849237919 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:23.850317001 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:23.907582998 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.015434027 CET	49787	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:24.065526962 CET	5651	49783	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:24.065613985 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.069658041 CET	465	49784	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:24.070497990 CET	80	49785	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:24.070610046 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.071796894 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.124819994 CET	49788	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:24.126861095 CET	465	49786	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:24.126962900 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.714889050 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.730547905 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.730547905 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:24.793075085 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:25.011830091 CET	49787	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:25.136929989 CET	49788	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:25.246160030 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:25.261775017 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:25.261775970 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:25.324712992 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:26.241691113 CET	49789	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:26.352899075 CET	49790	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:26.381094933 CET	5655	49789	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:26.381201029 CET	49789	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:26.381700993 CET	49789	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:26.381726980 CET	49789	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:26.426052094 CET	49791	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:26.426196098 CET	49792	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:26.521198988 CET	5655	49789	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:26.543025017 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:26.558634996 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:26.574255943 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:26.652398109 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:26.903173923 CET	49789	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:27.027405977 CET	49787	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:27.042551994 CET	5655	49789	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:27.042579889 CET	5655	49789	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:27.042627096 CET	49789	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:27.152426958 CET	49788	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:27.355549097 CET	49790	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:27.418030024 CET	49792	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:27.418199062 CET	49791	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:29.121323109 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:29.152442932 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:29.168086052 CET	49773	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:29.172241926 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:29.293174028 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:29.324299097 CET	49775	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:29.371172905 CET	49790	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:29.418092012 CET	49792	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:29.418128967 CET	49791	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:29.543060064 CET	49774	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:31.043044090 CET	49787	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:31.152458906 CET	49788	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:32.247832060 CET	49793	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:32.365813971 CET	5655	49793	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:32.366020918 CET	49793	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:32.366710901 CET	49793	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:32.366744041 CET	49793	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:32.367616892 CET	49793	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:32.484359026 CET	5655	49793	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:32.485110044 CET	5655	49793	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:32.485127926 CET	5655	49793	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:32.485219955 CET	49793	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:33.371253967 CET	49790	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:33.418154001 CET	49791	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:33.543091059 CET	49792	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:34.078978062 CET	49794	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:34.187736988 CET	49795	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:34.277436972 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:34.339947939 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:34.355624914 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:34.558676004 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:35.089960098 CET	49794	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:35.199278116 CET	49795	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:36.375020981 CET	49796	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:36.494515896 CET	49797	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:36.494714975 CET	49798	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:37.089901924 CET	49794	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:37.199256897 CET	49795	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:37.386764050 CET	49796	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:37.496159077 CET	49797	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:37.496299028 CET	49798	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:37.718451023 CET	49799	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:37.839581966 CET	5655	49799	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:37.839929104 CET	49799	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:37.842046976 CET	49799	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:37.842046976 CET	49799	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:37.843009949 CET	49799	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:37.962852001 CET	5655	49799	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:37.963713884 CET	5655	49799	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:37.963748932 CET	5655	49799	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:37.964145899 CET	49799	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:39.113101959 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.115680933 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.117712021 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.221982956 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.332081079 CET	5651	49800	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:39.332156897 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.334759951 CET	80	49801	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:39.334846973 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.339512110 CET	465	49802	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:39.339576006 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.390954971 CET	49796	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:39.441637993 CET	465	49803	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:39.441823959 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:39.511784077 CET	49797	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:39.511842966 CET	49798	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:40.011778116 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:40.121157885 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:40.121397972 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:40.199279070 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:40.699309111 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:40.730528116 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:40.730698109 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:40.808634996 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:41.121155024 CET	49794	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:41.230518103 CET	49795	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:42.105530024 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:42.105634928 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:42.121151924 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:42.121268034 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:43.404047012 CET	49804	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:43.506360054 CET	49796	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:43.528649092 CET	5655	49804	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:43.528742075 CET	49804	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:43.530276060 CET	49804	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:43.530306101 CET	49804	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:43.531192064 CET	49804	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:43.623224020 CET	49797	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:43.623238087 CET	49798	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:43.654551983 CET	5655	49804	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:43.655139923 CET	5655	49804	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:43.655175924 CET	5655	49804	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:43.655230999 CET	49804	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:44.143291950 CET	49805	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:44.251909018 CET	49806	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:44.636759996 CET	49783	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:44.808670998 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:44.808728933 CET	49784	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:44.808743000 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:44.824351072 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:44.824407101 CET	49785	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:44.824409962 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:45.136765957 CET	49786	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:45.306684017 CET	49805	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:45.324405909 CET	49806	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:47.308656931 CET	49805	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:47.324289083 CET	49806	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:47.914274931 CET	49807	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:47.916068077 CET	49808	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:47.916157961 CET	49809	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:48.933684111 CET	49808	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:48.996197939 CET	49807	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:49.000230074 CET	49809	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:49.007180929 CET	49810	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:49.131407976 CET	5655	49810	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:49.131661892 CET	49810	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:49.162523985 CET	49810	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:49.162554979 CET	49810	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:49.167639017 CET	49810	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:49.286990881 CET	5655	49810	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:49.291740894 CET	5655	49810	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:49.291754961 CET	5655	49810	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:49.291841984 CET	49810	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:50.050575018 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:50.121166945 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:50.121619940 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:50.199270964 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:50.933660984 CET	49808	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:50.996180058 CET	49809	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:50.996269941 CET	49807	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:51.308696985 CET	49805	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:51.433660984 CET	49806	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:54.219999075 CET	49811	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:54.314193964 CET	49812	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:54.425582886 CET	49813	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.426933050 CET	49814	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.468303919 CET	49815	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.533998966 CET	49816	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.570333004 CET	49817	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:54.646049976 CET	465	49813	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:54.646141052 CET	49813	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.647171974 CET	5651	49814	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:54.647236109 CET	49814	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.688668013 CET	80	49815	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:54.688750982 CET	49815	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.691653967 CET	5655	49817	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:54.691731930 CET	49817	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:54.692209959 CET	49817	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:54.692234993 CET	49817	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:54.754563093 CET	465	49816	101.99.94.54	192.168.2.4
Feb 2, 2024 09:38:54.754654884 CET	49816	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:54.813433886 CET	5655	49817	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:54.933655024 CET	49808	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:55.105525017 CET	49807	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:55.105616093 CET	49809	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:55.230515003 CET	49811	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:55.433666945 CET	49813	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:55.433959961 CET	49816	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:55.433973074 CET	49812	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:55.434047937 CET	49814	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:55.480135918 CET	49815	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:56.105526924 CET	49815	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:56.136785030 CET	49816	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:56.136796951 CET	49813	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:56.136797905 CET	49814	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:56.454792023 CET	5655	49817	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:56.454862118 CET	5655	49817	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:56.454922915 CET	49817	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:56.809340954 CET	49817	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:56.930761099 CET	5655	49817	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:56.930795908 CET	5655	49817	64.20.61.146	192.168.2.4
Feb 2, 2024 09:38:56.932869911 CET	49817	5655	192.168.2.4	64.20.61.146
Feb 2, 2024 09:38:57.127296925 CET	49818	5655	192.168.2.4	66.23.226.254
Feb 2, 2024 09:38:57.233629942 CET	49811	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:57.248091936 CET	5655	49818	66.23.226.254	192.168.2.4
Feb 2, 2024 09:38:57.248579979 CET	49818	5655	192.168.2.4	66.23.226.254
Feb 2, 2024 09:38:57.249140978 CET	49818	5655	192.168.2.4	66.23.226.254
Feb 2, 2024 09:38:57.249216080 CET	49818	5655	192.168.2.4	66.23.226.254
Feb 2, 2024 09:38:57.369954109 CET	5655	49818	66.23.226.254	192.168.2.4
Feb 2, 2024 09:38:57.433814049 CET	49812	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:57.496540070 CET	49815	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:57.621191978 CET	49816	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:57.621210098 CET	49813	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:57.621211052 CET	49814	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:38:57.921813965 CET	49819	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:57.936893940 CET	49820	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:57.950176954 CET	49821	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:58.933661938 CET	49819	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:38:58.933856964 CET	49820	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:38:58.964979887 CET	49821	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:00.121155977 CET	49815	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.293025970 CET	49816	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.293066025 CET	49813	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.309235096 CET	49814	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.339883089 CET	49803	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.511775970 CET	49801	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.527400970 CET	49802	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.808715105 CET	49800	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:00.933659077 CET	49819	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:39:00.933768988 CET	49820	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:00.965657949 CET	49821	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:01.230537891 CET	49811	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:01.449592113 CET	49812	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:39:04.949280977 CET	49819	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:39:04.949610949 CET	49820	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:04.981256962 CET	49821	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:05.371220112 CET	49815	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:05.621186972 CET	49816	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:05.652439117 CET	49813	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:05.683708906 CET	49814	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:07.382016897 CET	5655	49818	66.23.226.254	192.168.2.4
Feb 2, 2024 09:39:07.382137060 CET	49818	5655	192.168.2.4	66.23.226.254
Feb 2, 2024 09:39:09.230505943 CET	49811	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:09.464885950 CET	49812	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:39:12.949285984 CET	49819	5651	192.168.2.4	185.70.104.90
Feb 2, 2024 09:39:12.949656010 CET	49820	80	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:12.980614901 CET	49821	5651	192.168.2.4	77.105.132.70
Feb 2, 2024 09:39:13.128570080 CET	49822	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.128679991 CET	49823	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.128969908 CET	49824	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.347836971 CET	5651	49823	101.99.94.54	192.168.2.4
Feb 2, 2024 09:39:13.347924948 CET	49823	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.349119902 CET	80	49822	101.99.94.54	192.168.2.4
Feb 2, 2024 09:39:13.349138975 CET	465	49824	101.99.94.54	192.168.2.4
Feb 2, 2024 09:39:13.349184036 CET	49822	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.349229097 CET	49824	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.996131897 CET	49822	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.996153116 CET	49824	465	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:13.996154070 CET	49823	5651	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:14.527378082 CET	49822	80	192.168.2.4	101.99.94.54
Feb 2, 2024 09:39:14.527386904 CET	49823	5651	192.168.2.4	101.99.94.54

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2024 09:37:27.247483015 CET	65129	53	192.168.2.4	1.1.1.1
Feb 2, 2024 09:37:27.366250038 CET	53	65129	1.1.1.1	192.168.2.4
Feb 2, 2024 09:38:26.122497082 CET	50422	53	192.168.2.4	1.1.1.1
Feb 2, 2024 09:38:26.240483046 CET	53	50422	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 2, 2024 09:37:27.247483015 CET	192.168.2.4	1.1.1.1	0x5fc8	Standard query (0)	id72.remoteutilities.com	A (IP address)	IN (0x0001)	false
Feb 2, 2024 09:38:26.122497082 CET	192.168.2.4	1.1.1.1	0x5fe1	Standard query (0)	id72.remoteutilities.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 2, 2024 09:37:17.167222023 CET	1.1.1.1	192.168.2.4	0x989a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 09:37:17.167222023 CET	1.1.1.1	192.168.2.4	0x989a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 2, 2024 09:37:27.366250038 CET	1.1.1.1	192.168.2.4	0x5fc8	No error (0)	id72.remoteutilities.com	id.remoteutilities.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 09:37:27.366250038 CET	1.1.1.1	192.168.2.4	0x5fc8	No error (0)	id.remoteutilities.com		64.20.61.146	A (IP address)	IN (0x0001)	false
Feb 2, 2024 09:38:26.240483046 CET	1.1.1.1	192.168.2.4	0x5fe1	No error (0)	id72.remoteutilities.com	id.remoteutilities.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 09:38:26.240483046 CET	1.1.1.1	192.168.2.4	0x5fe1	No error (0)	id.remoteutilities.com		64.20.61.146	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	101.99.94.54	80	7876	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:37:23.121231079 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:23.715123892 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:25.105581999 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:27.699285030 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:32.886811972 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	101.99.94.54	80	7876	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:37:38.418060064 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:38.949398041 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:40.261971951 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:42.871217966 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:48.074362993 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49757	101.99.94.54	80	7876	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:37:53.746154070 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:54.293028116 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:55.653656960 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:37:58.355572939 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:03.761811018 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49773	101.99.94.54	80	7876	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:38:09.339912891 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:09.873063087 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:11.168054104 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:13.746207952 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:18.886785984 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49785	101.99.94.54	80	7876	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:38:24.730547905 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:25.261775017 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:26.574255943 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:29.172241926 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:34.355624914 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49801	101.99.94.54	80	7876	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:38:40.121157885 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:40.730528116 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:42.121151924 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:44.824351072 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:50.121166945 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49815	101.99.94.54	80	7876	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:38:55.480135918 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:56.105526924 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:38:57.496540070 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:39:00.121155977 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:39:05.371220112 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49822	101.99.94.54	80

Timestamp	Bytes transferred	Direction	Data
Feb 2, 2024 09:39:13.996131897 CET	6	OUT	Data Raw: 00 Data Ascii:
Feb 2, 2024 09:39:14.527378082 CET	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	0
Start time:	09:36:56
Start date:	02/02/2024
Path:	C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
Imagebase:	0x7ff6cdb10000
File size:	20'949'417 bytes
MD5 hash:	075D6C122274CB9226521D3CD298F2F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:36:58
Start date:	02/02/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i Exel.msi /qn
Imagebase:	0x7ff6043c0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:36:58
Start date:	02/02/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6043c0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:36:59
Start date:	02/02/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 494BECA00E3009394CA5F2713F238EA9
Imagebase:	0xf30000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:37:03
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\user\AppData\Local\Temp\Exel.msi
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000004.00000000.1716230830.0000000001091000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:37:05
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /silentinstall
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000005.00000000.1747218595.0000000001803000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000005.00000000.1747218595.0000000001739000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:37:09
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /firewall
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:37:14
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" /start
Imagebase:	0x7ff6ec4b0000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:37:15
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -service
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000009.00000003.1896822360.000000000890F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:37:20
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe" -firewall
Imagebase:	0x340000
File size:	21'148'984 bytes
MD5 hash:	652C2A693B333504A3879460D0AF7224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:37:21
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:37:21
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:37:29
Start date:	02/02/2024
Path:	C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" /tray
Imagebase:	0x650000
File size:	10'931'000 bytes
MD5 hash:	6AAE165F3B1575DB887A0370CFC80083
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	28.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00007FF6CDB3B070 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB1255C: GetDlgItem.USER32 ref: 00007FF6CDB125AC
Part of subcall function 00007FF6CDB1255C: SetDlgItemTextW.USER32 ref: 00007FF6CDB125C8

EndDialog.USER32 ref: 00007FF6CDB3B1B0
SetDlgItemTextW.USER32 ref: 00007FF6CDB3B200
GetMessageW.USER32 ref: 00007FF6CDB3B230
IsDialogMessageW.USER32 ref: 00007FF6CDB3B249
TranslateMessage.USER32 ref: 00007FF6CDB3B25B
DispatchMessageW.USER32 ref: 00007FF6CDB3B269
EndDialog.USER32 ref: 00007FF6CDB3B2B3
GetDlgItem.USER32 ref: 00007FF6CDB3B2F0
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3B311
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3B329
SetFocus.USER32 ref: 00007FF6CDB3B332
GetLastError.KERNEL32 ref: 00007FF6CDB3B514
GetLastError.KERNEL32 ref: 00007FF6CDB3B545
GetTickCount.KERNEL32 ref: 00007FF6CDB3B56B
GetLastError.KERNEL32 ref: 00007FF6CDB3B5D5
GetCommandLineW.KERNEL32 ref: 00007FF6CDB3B721
CreateFileMappingW.KERNEL32 ref: 00007FF6CDB3B7E0
MapViewOfFile.KERNEL32 ref: 00007FF6CDB3B803
Sleep.KERNEL32 ref: 00007FF6CDB3B896
UnmapViewOfFile.KERNEL32 ref: 00007FF6CDB3B8BF
CloseHandle.KERNEL32 ref: 00007FF6CDB3B8C8
SetDlgItemTextW.USER32 ref: 00007FF6CDB3BBBE
DialogBoxParamW.USER32 ref: 00007FF6CDB3BFB7
EndDialog.USER32 ref: 00007FF6CDB3BFCF
EnableWindow.USER32 ref: 00007FF6CDB3C186
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3C1D8
ShellExecuteExW.SHELL32 ref: 00007FF6CDB3B83B

Part of subcall function 00007FF6CDB2AA90: LoadStringW.USER32 ref: 00007FF6CDB2AB17
Part of subcall function 00007FF6CDB2AA90: LoadStringW.USER32 ref: 00007FF6CDB2AB30

IsDlgButtonChecked.USER32 ref: 00007FF6CDB3BDA3
SendDlgItemMessageW.USER32 ref: 00007FF6CDB3BDCA
GetDlgItem.USER32 ref: 00007FF6CDB3BDD8
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3BDF2
GetDlgItem.USER32 ref: 00007FF6CDB3BE2F
SetDlgItemTextW.USER32 ref: 00007FF6CDB3BECC
SetDlgItemTextW.USER32 ref: 00007FF6CDB3BEE4
SetDlgItemTextW.USER32 ref: 00007FF6CDB3C201
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C243
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C249
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C24F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C255
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C25B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C261
SendDlgItemMessageW.USER32 ref: 00007FF6CDB3C329
EndDialog.USER32 ref: 00007FF6CDB3C343
GetDlgItem.USER32 ref: 00007FF6CDB3C371
SetFocus.USER32 ref: 00007FF6CDB3C37A
SendDlgItemMessageW.USER32 ref: 00007FF6CDB3C41E
FindFirstFileW.KERNEL32 ref: 00007FF6CDB3C442
FindClose.KERNEL32 ref: 00007FF6CDB3C56A
SendDlgItemMessageW.USER32 ref: 00007FF6CDB3C68F

Part of subcall function 00007FF6CDB1129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB11396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C989
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C98F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C995
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C99B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C9A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3C9A7

Strings

%s %s, xrefs: 00007FF6CDB3C5B9, 00007FF6CDB3C826
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF6CDB3B679
__tmp_rar_sfx_access_check_, xrefs: 00007FF6CDB3B589
@, xrefs: 00007FF6CDB3B696
winrarsfxmappingfile.tmp, xrefs: 00007FF6CDB3B7C0
runas, xrefs: 00007FF6CDB3B6A9
REPLACEFILEDLG, xrefs: 00007FF6CDB3C2B3
LICENSEDLG, xrefs: 00007FF6CDB3BFA9
p, xrefs: 00007FF6CDB3B68B
STARTDLG, xrefs: 00007FF6CDB3B0AA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Item$_invalid_parameter_noinfo_noreturn$Message$DialogText$ButtonChecked$FileSend$ErrorLast$CloseFindFocusLoadStringView$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmapWindow
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 3303814210-2702805183
Opcode ID: fa1a1248da0eee8bb9c6b2c135254225a06a707859c16a46956c22940eca37a7
Instruction ID: f79de55186e1a5706b622535b5e0528a6f5c5530a11a4d5004b7949dc32ae174
Opcode Fuzzy Hash: fa1a1248da0eee8bb9c6b2c135254225a06a707859c16a46956c22940eca37a7
Instruction Fuzzy Hash: 30D2B3E2B0878392EA20DF65E8952B96361EF87786F404135D9ED876A9FF3CE544C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3CD68 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963fileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6CDB3D4D3
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3D506
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3D535
MoveFileW.KERNEL32 ref: 00007FF6CDB3DA2B
MoveFileExW.KERNEL32 ref: 00007FF6CDB3DA49
GetTempPathW.KERNEL32 ref: 00007FF6CDB3DB29

Part of subcall function 00007FF6CDB11FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11FFB

EndDialog.USER32 ref: 00007FF6CDB3DEAA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB3EDC3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EDCF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EDE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EDED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EDF3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EDF9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EDFF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE05
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE0B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE11
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE17
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE1D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE23
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE29
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE2F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE35
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3EE3B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB3EE47
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB3EE53

Strings

@set:user, xrefs: 00007FF6CDB3DC76, 00007FF6CDB3DC85
ProgramFilesDir, xrefs: 00007FF6CDB3D3D0
lnk, xrefs: 00007FF6CDB3E2AA, 00007FF6CDB3E2B9
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF6CDB3D3E1
<br>, xrefs: 00007FF6CDB3D5BA, 00007FF6CDB3D5C9
.lnk, xrefs: 00007FF6CDB3E2E6, 00007FF6CDB3E2F5
HIDE, xrefs: 00007FF6CDB3E8C5, 00007FF6CDB3E8D4
.tmp, xrefs: 00007FF6CDB3D965
MAX, xrefs: 00007FF6CDB3E962, 00007FF6CDB3E971
MIN, xrefs: 00007FF6CDB3E9C5, 00007FF6CDB3E9D4

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$ButtonCheckedFileMove$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 1830998149-3916287355
Opcode ID: c3cc931237e6748134a2c1d62aa3536714c5ffe481b1857ace23a4c2cd176c5c
Instruction ID: 23037e64ea5bec391c7fc5ff8eb0e33192e414e6a0024c933a5270def2e00781
Opcode Fuzzy Hash: c3cc931237e6748134a2c1d62aa3536714c5ffe481b1857ace23a4c2cd176c5c
Instruction Fuzzy Hash: 6B13B5B2B04B8296EB10DF74D8442EC27B1FB42799F500536DAAD97AD9EF38E585C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB40634 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CDB2DF3C: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2DF84
Part of subcall function 00007FF6CDB2DF3C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2DF9C
Part of subcall function 00007FF6CDB2DF3C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2DFC9

Part of subcall function 00007FF6CDB262EC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6CDB26302
Part of subcall function 00007FF6CDB262EC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6CDB2633C

Part of subcall function 00007FF6CDB3934C: OleInitialize.OLE32 ref: 00007FF6CDB39366
Part of subcall function 00007FF6CDB3934C: SHGetMalloc.SHELL32 ref: 00007FF6CDB393B4

GetCommandLineW.KERNEL32 ref: 00007FF6CDB4084E
OpenFileMappingW.KERNEL32 ref: 00007FF6CDB408E7
MapViewOfFile.KERNEL32 ref: 00007FF6CDB40910
UnmapViewOfFile.KERNEL32 ref: 00007FF6CDB40926
MapViewOfFile.KERNEL32 ref: 00007FF6CDB40943
UnmapViewOfFile.KERNEL32 ref: 00007FF6CDB409AA
CloseHandle.KERNEL32 ref: 00007FF6CDB409B3
SetEnvironmentVariableW.KERNELBASE ref: 00007FF6CDB40A8D
GetLocalTime.KERNEL32 ref: 00007FF6CDB40A98
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6CDB40AF3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6CDB40B06
GetModuleHandleW.KERNEL32 ref: 00007FF6CDB40B0E
LoadIconW.USER32 ref: 00007FF6CDB40B2D
DialogBoxParamW.USER32 ref: 00007FF6CDB40B96
Sleep.KERNEL32 ref: 00007FF6CDB40BC6
DeleteObject.GDI32 ref: 00007FF6CDB40BED
DeleteObject.GDI32 ref: 00007FF6CDB40BFF
CloseHandle.KERNEL32 ref: 00007FF6CDB40C47
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB40CB7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB40CBD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB40CC3

Part of subcall function 00007FF6CDB3FBEC: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6CDB3FC23
Part of subcall function 00007FF6CDB3FBEC: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6CDB3FC9C

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF6CDB40AE2
sfxname, xrefs: 00007FF6CDB40A7B
winrarsfxmappingfile.tmp, xrefs: 00007FF6CDB408D9
sfxstime, xrefs: 00007FF6CDB40AFF
STARTDLG, xrefs: 00007FF6CDB40B85

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: 3cf015b1185407393cba8033487ad466a5ea17343d08040d3a26a01d05833c23
Instruction ID: 65bdae8600be00989b5fe1671addd95a2c21077fbcc4e66a167b582537706f18
Opcode Fuzzy Hash: 3cf015b1185407393cba8033487ad466a5ea17343d08040d3a26a01d05833c23
Instruction Fuzzy Hash: B31281A1B18B8292EB10DF25E8452B97361FF86796F404235DAED87AA5FF3CE144C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2A45C Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6CDB2A4B4

Part of subcall function 00007FF6CDB30E3C: WideCharToMultiByte.KERNEL32 ref: 00007FF6CDB30E6D

SetDlgItemTextW.USER32 ref: 00007FF6CDB2A523
GetWindowRect.USER32 ref: 00007FF6CDB2A55D
GetClientRect.USER32 ref: 00007FF6CDB2A56B
GetWindowLongPtrW.USER32 ref: 00007FF6CDB2A61C
GetWindowRect.USER32 ref: 00007FF6CDB2A662
SetDlgItemTextW.USER32 ref: 00007FF6CDB2A69C
GetSystemMetrics.USER32 ref: 00007FF6CDB2A6A7
GetWindow.USER32 ref: 00007FF6CDB2A6B8
GetWindowRect.USER32 ref: 00007FF6CDB2A6F6
GetWindow.USER32 ref: 00007FF6CDB2A7B8

Strings

CAPTION, xrefs: 00007FF6CDB2A67F
$%s:, xrefs: 00007FF6CDB2A49F

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Window$Rect$ItemText$ByteCharClientLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 1936833115-404845831
Opcode ID: 0f97b10e63c7eacc13c9f1d203baf504c460b1b461996c53aa071e032e53dcc4
Instruction ID: 6b3ab989b8123fb8fb5aab37b3858031a4ff72f83d6de316ea2169b00e452b21
Opcode Fuzzy Hash: 0f97b10e63c7eacc13c9f1d203baf504c460b1b461996c53aa071e032e53dcc4
Instruction Fuzzy Hash: 78910972B1864287E718CF29E84466EB7A1FB85789F415435EE9D87B58EF3CE805CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB38504 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE ref: 00007FF6CDB3851D
SizeofResource.KERNEL32 ref: 00007FF6CDB38539
LoadResource.KERNEL32 ref: 00007FF6CDB38553
LockResource.KERNEL32 ref: 00007FF6CDB38565
GlobalAlloc.KERNEL32 ref: 00007FF6CDB38586
GlobalLock.KERNEL32 ref: 00007FF6CDB3859B
GdipAlloc.GDIPLUS ref: 00007FF6CDB385DE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6CDB38649
GlobalUnlock.KERNEL32 ref: 00007FF6CDB3866C
GlobalFree.KERNEL32 ref: 00007FF6CDB38675

Strings

PNG, xrefs: 00007FF6CDB3850F

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: 964a3e4766442599f5b5b2c50d141baf56ab4eb83316e7091f8bf1c058c1ef4f
Instruction ID: efebff4afe13562f6f9f76eff569eb84b5a72a661888da1e633df8544b47daa4
Opcode Fuzzy Hash: 964a3e4766442599f5b5b2c50d141baf56ab4eb83316e7091f8bf1c058c1ef4f
Instruction Fuzzy Hash: 8F4122A5B09B0282EF458F26E454379A7A0AF8AB96F480435CDADC7764FF7CE445C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1F8E8 Relevance: 17.1, APIs: 8, Strings: 1, Instructions: 1396COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB21199
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2119F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB211A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB211AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB211B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB211B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB211BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB211C3

Strings

__tmp_reference_source_, xrefs: 00007FF6CDB1FC8A, 00007FF6CDB1FC99

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 9a1b211498849438d2819252a024eb4c205f1e3dfa705b130dc22b6ddeb13dab
Instruction ID: fd8da596bbd9e32f03438255b70bbe6f1ec399bac6527ba05d1646957b6bcc9d
Opcode Fuzzy Hash: 9a1b211498849438d2819252a024eb4c205f1e3dfa705b130dc22b6ddeb13dab
Instruction Fuzzy Hash: 6ED273A3B086C292EA64CF25E1443BEA7A1FB46785F404136DBED836A5EF3CE455C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB14840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB15125
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1512B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB15131
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB15E1E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB15E24

Strings

CMT, xrefs: 00007FF6CDB159BA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 79d77a20da0ffa754a228f6689685b26b03dda1bfeee1c1ffc7c389a44fcdb7f
Instruction ID: dd3945af33a579f89174bda994d4c69acc38e339c83417784bfec55f07ba5e3a
Opcode Fuzzy Hash: 79d77a20da0ffa754a228f6689685b26b03dda1bfeee1c1ffc7c389a44fcdb7f
Instruction Fuzzy Hash: D1E2EFA3B0868286EB18DF35D5542FEA7A1FB46789F400035DAAE87796EF3CE555C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB240CC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6CDB2411B
FindFirstFileW.KERNELBASE ref: 00007FF6CDB2416E
GetLastError.KERNEL32 ref: 00007FF6CDB241BF
FindNextFileW.KERNEL32 ref: 00007FF6CDB241E7
GetLastError.KERNEL32 ref: 00007FF6CDB241F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2431F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB24325

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 3701501b534fdf231aea3ed9899527aaf37a940aa259de45b57eb9610a1ccc33
Instruction ID: 2b06a62e6026351d9a504b917311c77daa6b50dbee9a8bafc2a82d320cb78d27
Opcode Fuzzy Hash: 3701501b534fdf231aea3ed9899527aaf37a940aa259de45b57eb9610a1ccc33
Instruction Fuzzy Hash: F361C1E3B08A4281EA10DF25E445269A361FB967AAF505335EAFD83AD9EF3CD544C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB15E2C Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF6CDB159BA, 00007FF6CDB1675B

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 832fad852de2a3bb5d079ecd498cb82d6a35d45a4a3c396cd13c740cf52f72cc
Instruction ID: 475c5e10b25a6f56e50cd21f99a03119d683276cdaa9ebf9cc6c36282851dd9d
Opcode Fuzzy Hash: 832fad852de2a3bb5d079ecd498cb82d6a35d45a4a3c396cd13c740cf52f72cc
Instruction Fuzzy Hash: 3742DEA3B0868297EB18DF74C1502FD77A1EB56789F400136DBAE93696EF38E558C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB31E00 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ba9ee39043de2ed211329d99a14a036d35ebd86ecffaa38a0ab5fb2c373eee
Instruction ID: e67867dbef5cc3bd9cb4b682634964cabc98acdd52b471a58f9335dc66e4981b
Opcode Fuzzy Hash: 29ba9ee39043de2ed211329d99a14a036d35ebd86ecffaa38a0ab5fb2c373eee
Instruction Fuzzy Hash: B9E1E7A2B082828BEB64CF29A4442BDB791FB56749F054139DBEDC7785EE3CE541D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB33364 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4adc5e5360e31c7bbfcf75934ae1acdc6dcec02cf26cf6597a20636be5d282a7
Instruction ID: 339dfb821a2c861847038006e77d64aea7c8358ed1869732031b1e72377ab574
Opcode Fuzzy Hash: 4adc5e5360e31c7bbfcf75934ae1acdc6dcec02cf26cf6597a20636be5d282a7
Instruction Fuzzy Hash: BFB1C0E2B087C592DE58CE669508AEA7391BB06FC5F888036DEAD4B741EF3CE155D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB24938 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: dfe7c3859ed454adfd115bd5e162aace49cc0573e9f009016389c648432cf77c
Instruction ID: fe9a3ed808999fa756ab8f7ce7cdab18616f27c4ac9cb290c06013e42844d9bb
Opcode Fuzzy Hash: dfe7c3859ed454adfd115bd5e162aace49cc0573e9f009016389c648432cf77c
Instruction Fuzzy Hash: 74415EA3B1465286FB68DF11E90877A6252FBD678DF044038DE9D87B54EE3CE446C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2DF3C Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2DF84
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2DF9C
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2DFC9
CreateFileW.KERNEL32 ref: 00007FF6CDB2E35C
SetFilePointer.KERNEL32 ref: 00007FF6CDB2E37A
ReadFile.KERNEL32 ref: 00007FF6CDB2E3A2

Part of subcall function 00007FF6CDB2DF3C: GetSystemDirectoryW.KERNEL32 ref: 00007FF6CDB2DD4B

CompareStringW.KERNELBASE ref: 00007FF6CDB2E4C5
CloseHandle.KERNEL32 ref: 00007FF6CDB2E45F

Part of subcall function 00007FF6CDB11FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11FFB

Part of subcall function 00007FF6CDB251B4: GetVersionExW.KERNEL32 ref: 00007FF6CDB251E5

Part of subcall function 00007FF6CDB2DF3C: LoadLibraryW.KERNELBASE ref: 00007FF6CDB2DE6B
Part of subcall function 00007FF6CDB2DF3C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2DF21
Part of subcall function 00007FF6CDB2DF3C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2DF27
Part of subcall function 00007FF6CDB2DF3C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2DF2D
Part of subcall function 00007FF6CDB2DF3C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2DF33

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2E6B7
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2E6C1
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2E6C9
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2E6EC
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2E705
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2E710
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6CDB2E716
ExitProcess.KERNEL32 ref: 00007FF6CDB2E727

Strings

dnsapi.DLL, xrefs: 00007FF6CDB2E1C5
samlib.dll, xrefs: 00007FF6CDB2E243
clbcatq.dll, xrefs: 00007FF6CDB2E055
msasn1.dll, xrefs: 00007FF6CDB2E101
devrtl.dll, xrefs: 00007FF6CDB2E20B
usp10.dll, xrefs: 00007FF6CDB2E04A
shell32.dll, xrefs: 00007FF6CDB2E12B
cryptui.dll, xrefs: 00007FF6CDB2E10F
samcli.dll, xrefs: 00007FF6CDB2E235
srvcli.dll, xrefs: 00007FF6CDB2E18D
sfc_os.dll, xrefs: 00007FF6CDB2DFFD
atl.dll, xrefs: 00007FF6CDB2E0A2
wkscli.dll, xrefs: 00007FF6CDB2E251
kernel32, xrefs: 00007FF6CDB2DF7D
ntmarta.dll, xrefs: 00007FF6CDB2E163
cryptbase.dll, xrefs: 00007FF6CDB2E034
RpcRtRemote.dll, xrefs: 00007FF6CDB2E2CF
version.dll, xrefs: 00007FF6CDB2DFE7
uxtheme.dll, xrefs: 00007FF6CDB2E5D9
setupapi.dll, xrefs: 00007FF6CDB2E0AD
dfscli.dll, xrefs: 00007FF6CDB2E25F
ntshrui.dll, xrefs: 00007FF6CDB2E097
SetDefaultDllDirectories, xrefs: 00007FF6CDB2DFBF
wintrust.dll, xrefs: 00007FF6CDB2E11D
ieframe.dll, xrefs: 00007FF6CDB2E08C
cscapi.dll, xrefs: 00007FF6CDB2E19B
shdocvw.dll, xrefs: 00007FF6CDB2E0E5
DXGIDebug.dll, xrefs: 00007FF6CDB2DFF2, 00007FF6CDB2E522
WindowsCodecs.dll, xrefs: 00007FF6CDB2E17F
slc.dll, xrefs: 00007FF6CDB2E1A9
XmlLite.dll, xrefs: 00007FF6CDB2E2A5
apphelp.dll, xrefs: 00007FF6CDB2E0BB
userenv.dll, xrefs: 00007FF6CDB2E0C9
mlang.dll, xrefs: 00007FF6CDB2E227
rsaenh.dll, xrefs: 00007FF6CDB2E013
mpr.dll, xrefs: 00007FF6CDB2E1FD
secur32.dll, xrefs: 00007FF6CDB2E139
oleaccrc.dll, xrefs: 00007FF6CDB2E155
psapi.dll, xrefs: 00007FF6CDB2E081
netapi32.dll, xrefs: 00007FF6CDB2E0D7
imageres.dll, xrefs: 00007FF6CDB2E1B7
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF6CDB2E6A7
SetDllDirectoryW, xrefs: 00007FF6CDB2DF92
cryptsp.dll, xrefs: 00007FF6CDB2E2C1
profapi.dll, xrefs: 00007FF6CDB2E171
SSPICLI.DLL, xrefs: 00007FF6CDB2E008
aclui.dll, xrefs: 00007FF6CDB2E2DD
propsys.dll, xrefs: 00007FF6CDB2E219
browcli.dll, xrefs: 00007FF6CDB2E26D
ws2help.dll, xrefs: 00007FF6CDB2E076
dhcpcsvc.dll, xrefs: 00007FF6CDB2E297
crypt32.dll, xrefs: 00007FF6CDB2E0F3
dsrole.dll, xrefs: 00007FF6CDB2E2EB
lpk.dll, xrefs: 00007FF6CDB2E03F
dhcpcsvc6.dll, xrefs: 00007FF6CDB2E289
UXTheme.dll, xrefs: 00007FF6CDB2E01E
linkinfo.dll, xrefs: 00007FF6CDB2E2B3
iphlpapi.DLL, xrefs: 00007FF6CDB2E1D3
comres.dll, xrefs: 00007FF6CDB2E060
WINNSI.DLL, xrefs: 00007FF6CDB2E1E1
cabinet.dll, xrefs: 00007FF6CDB2E147
ws2_32.dll, xrefs: 00007FF6CDB2E06B
peerdist.dll, xrefs: 00007FF6CDB2E2F9
netutils.dll, xrefs: 00007FF6CDB2E1EF
rasadhlp.dll, xrefs: 00007FF6CDB2E27B
dwmapi.dll, xrefs: 00007FF6CDB2E029, 00007FF6CDB2E5CD

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: a97d0c65318b225b22df9e3453455be42fefb62485aae8da8dad92dbaea153c0
Instruction ID: 31c20f1d34a85508176398a2d327dd7870f775a40bac58072fa17e28c3881970
Opcode Fuzzy Hash: a97d0c65318b225b22df9e3453455be42fefb62485aae8da8dad92dbaea153c0
Instruction Fuzzy Hash: BD321876B09B8299EB219F60E8401E973A4FF4635AF500236DAED86765FF3CE255C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2988C Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB28E08: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB28F3D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6CDB29F25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2A3DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2A3E5

Part of subcall function 00007FF6CDB30A90: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6CDB30A18), ref: 00007FF6CDB30ABD

Strings

DIALOG, xrefs: 00007FF6CDB29D7D
, xrefs: 00007FF6CDB29DA9
*messages***, xrefs: 00007FF6CDB29B76
*messages***, xrefs: 00007FF6CDB29BB4
DIRECTION, xrefs: 00007FF6CDB29D95
RTL, xrefs: 00007FF6CDB29EDE
STRINGS, xrefs: 00007FF6CDB29D71
$%s:, xrefs: 00007FF6CDB29F00
@%s:, xrefs: 00007FF6CDB29F07
,, xrefs: 00007FF6CDB29F5A
MENU, xrefs: 00007FF6CDB29D89

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 66610e022f4de4060f360c73c1aa570acb7af1ed975cd0e7eaf94a8b3c384ca3
Instruction ID: 808a6c00a74bc6a41e895c20b7219879c3dccf3711a72a752a3ef04ed22f6f19
Opcode Fuzzy Hash: 66610e022f4de4060f360c73c1aa570acb7af1ed975cd0e7eaf94a8b3c384ca3
Instruction Fuzzy Hash: 1F62CDA3B18A8285EB10DF24C4882BE7365FB46799F804136DAAD876D5FF3CE645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB417E0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CDB41438: DloadProtectSection.DELAYIMP ref: 00007FF6CDB414A9

RaiseException.KERNEL32 ref: 00007FF6CDB41887
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6CDB41873

Part of subcall function 00007FF6CDB41748: DloadProtectSection.DELAYIMP ref: 00007FF6CDB417A7

LoadLibraryExA.KERNELBASE ref: 00007FF6CDB41926
GetLastError.KERNEL32 ref: 00007FF6CDB41934
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6CDB41966
RaiseException.KERNEL32 ref: 00007FF6CDB4197A

Strings

H, xrefs: 00007FF6CDB41854

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: d502b893622e318fe04c5d8657585a281d9fc288093b581db3e70e2b50933adb
Instruction ID: ddfc6d8389cdb6064117f9518505dadd932e1aee565e796c2a8448b8c5243690
Opcode Fuzzy Hash: d502b893622e318fe04c5d8657585a281d9fc288093b581db3e70e2b50933adb
Instruction Fuzzy Hash: 4D916BA6F05B128AEB40CFA5D8446BC73A0BB09B8AF48453ADEAD57754FF38E445D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3F3C0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6CDB3F627
ShowWindow.USER32 ref: 00007FF6CDB3F666
GetExitCodeProcess.KERNEL32 ref: 00007FF6CDB3F69D
CloseHandle.KERNEL32 ref: 00007FF6CDB3F6C7
ShowWindow.USER32 ref: 00007FF6CDB3F71F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3F7DB

Strings

Install, xrefs: 00007FF6CDB3F564
.inf, xrefs: 00007FF6CDB3F555
.exe, xrefs: 00007FF6CDB3F6D2
p, xrefs: 00007FF6CDB3F409

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: 3cccbf155df5727a74089406123dfcd58e61338677e259a012e923e757bb25ff
Instruction ID: fe8389302fce1c6460a3cd98f498dbd0f9a4fe5ac72b081a8bfb4aa70cad20b8
Opcode Fuzzy Hash: 3cccbf155df5727a74089406123dfcd58e61338677e259a012e923e757bb25ff
Instruction Fuzzy Hash: A9C16DA2F18A0296FB10DF65D95427D23B1AF8AB86F044035DAAD87BA5FF3CE455D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3EF84 Relevance: 16.6, APIs: 11, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6CDB3ACFC: PeekMessageW.USER32 ref: 00007FF6CDB3AD12
Part of subcall function 00007FF6CDB3ACFC: GetMessageW.USER32 ref: 00007FF6CDB3AD29
Part of subcall function 00007FF6CDB3ACFC: IsDialogMessageW.USER32 ref: 00007FF6CDB3AD40
Part of subcall function 00007FF6CDB3ACFC: TranslateMessage.USER32 ref: 00007FF6CDB3AD4F
Part of subcall function 00007FF6CDB3ACFC: DispatchMessageW.USER32 ref: 00007FF6CDB3AD5A

GetDlgItem.USER32 ref: 00007FF6CDB3EFC3
ShowWindow.USER32 ref: 00007FF6CDB3EFE9
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3EFFE
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F016
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F037
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F053
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F096
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F0B4
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F0C8
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F0F2
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F10A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ButtonChecked$Message$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 4119318379-0
Opcode ID: 253ab4858e17339d5a492e1b46975a376c44fb8caa76ba8f9d9796d39d916b50
Instruction ID: 537ebfaab88e5ac070d77702454515439c10ad7ceb54d329b2cc8308bd1651bc
Opcode Fuzzy Hash: 253ab4858e17339d5a492e1b46975a376c44fb8caa76ba8f9d9796d39d916b50
Instruction Fuzzy Hash: F141F4B1B14A4297F700CF65E800FAE3360EB4AB99F451135EDAA8BB94DF3DE4498750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1EEC8 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F4FA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F500
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F50C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F512
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F518
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F524
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F52A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f4bc2594cd83d321eef4cd27188afa95904b93077d80d968f10a3441a0a5ecc9
Instruction ID: ef38d23407ddc4341aa46ac3032efdaf194f28d200713766890fa5c12f92ab31
Opcode Fuzzy Hash: f4bc2594cd83d321eef4cd27188afa95904b93077d80d968f10a3441a0a5ecc9
Instruction Fuzzy Hash: E31293A3F08B4185FB10DF65D4542AD23B1AB4A7A9F404236DEAC97AD9EF3CE585C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB224D0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6CDB225AB
GetLastError.KERNEL32 ref: 00007FF6CDB225BE
CreateFileW.KERNEL32 ref: 00007FF6CDB2261E
GetLastError.KERNEL32 ref: 00007FF6CDB22627
SetFileTime.KERNEL32 ref: 00007FF6CDB226D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB22746

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 936119dcdc61c3d09dfbc6f86898800bdce19a07f54fc53875a2b94303f46eb1
Instruction ID: 79bac9a5631611c6d3952440815d15d1ba76b02ae3e612289c1592b02b755ab3
Opcode Fuzzy Hash: 936119dcdc61c3d09dfbc6f86898800bdce19a07f54fc53875a2b94303f46eb1
Instruction Fuzzy Hash: 0261B3A7B08A4185E7208F29E40436F77A1BB867ADF101324DEB983AD4EF3DD4948744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3AEF4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF6CDB3AF0A
GetObjectW.GDI32 ref: 00007FF6CDB3AF3B
DeleteObject.GDI32 ref: 00007FF6CDB3AF75
DeleteObject.GDI32 ref: 00007FF6CDB3AFA5

Part of subcall function 00007FF6CDB38504: FindResourceW.KERNELBASE ref: 00007FF6CDB3851D
Part of subcall function 00007FF6CDB38504: SizeofResource.KERNEL32 ref: 00007FF6CDB38539
Part of subcall function 00007FF6CDB38504: LoadResource.KERNEL32 ref: 00007FF6CDB38553
Part of subcall function 00007FF6CDB38504: LockResource.KERNEL32 ref: 00007FF6CDB38565
Part of subcall function 00007FF6CDB38504: GlobalAlloc.KERNEL32 ref: 00007FF6CDB38586
Part of subcall function 00007FF6CDB38504: GlobalLock.KERNEL32 ref: 00007FF6CDB3859B
Part of subcall function 00007FF6CDB38504: GdipAlloc.GDIPLUS ref: 00007FF6CDB385DE
Part of subcall function 00007FF6CDB38504: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6CDB38649
Part of subcall function 00007FF6CDB38504: GlobalUnlock.KERNEL32 ref: 00007FF6CDB3866C
Part of subcall function 00007FF6CDB38504: GlobalFree.KERNEL32 ref: 00007FF6CDB38675

Strings

], xrefs: 00007FF6CDB3AF43

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: GlobalResource$Object$AllocBitmapDeleteGdipLoadLock$CreateFindFreeFromSizeofUnlock
String ID: ]
API String ID: 2347093688-3352871620
Opcode ID: 93dd44c7e59638a1d1511d61259afb9db2058f386a2987dea5d6c297b3409a84
Instruction ID: 7399b8392e21fdfc95b367991a8bbb725c1be6e3b641628f49c28c3db5d5f928
Opcode Fuzzy Hash: 93dd44c7e59638a1d1511d61259afb9db2058f386a2987dea5d6c297b3409a84
Instruction Fuzzy Hash: B211E6E4F0D34243EA149F11D69427992A1AF8ABC6F180034E9ADC7B85FE3CE8049B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3ACFC Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF6CDB3AD12
GetMessageW.USER32 ref: 00007FF6CDB3AD29
IsDialogMessageW.USER32 ref: 00007FF6CDB3AD40
TranslateMessage.USER32 ref: 00007FF6CDB3AD4F
DispatchMessageW.USER32 ref: 00007FF6CDB3AD5A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 1155e2eac5c0330a0f18bd67fb5c92651e4b7da5ee72aa3495f3e9d9fdcd90d7
Instruction ID: dcdd05c2d60c0f9448427e9fe0b5f1f471cd9ca52da8cdd7b36ad64b2473f262
Opcode Fuzzy Hash: 1155e2eac5c0330a0f18bd67fb5c92651e4b7da5ee72aa3495f3e9d9fdcd90d7
Instruction Fuzzy Hash: F1F0ECB5B38542A3FB609F21E896A762360FF91B06F815031F59E82C64EF2CD108DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB390C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF6CDB390F1
SHAutoComplete.SHLWAPI ref: 00007FF6CDB39135

Part of subcall function 00007FF6CDB31298: CompareStringW.KERNEL32 ref: 00007FF6CDB312B7

FindWindowExW.USER32 ref: 00007FF6CDB3911F

Strings

EDIT, xrefs: 00007FF6CDB390FB, 00007FF6CDB39113

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: daca292fe889d401d4258fd3765b0861555302059037067f7f1d841c9f784690
Instruction ID: 5fb2527a85c7b21edc3b1b5005966b97d9d61501103104c3d1102d588a7dc3f2
Opcode Fuzzy Hash: daca292fe889d401d4258fd3765b0861555302059037067f7f1d841c9f784690
Instruction Fuzzy Hash: F00162E1B18A4792FE209F11EC553B66350AF9A746F880031C9ED9B654FE2CE1499710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB22CF0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF6CDB28C4A), ref: 00007FF6CDB22D32
WriteFile.KERNEL32 ref: 00007FF6CDB22D7C
WriteFile.KERNELBASE ref: 00007FF6CDB22DAA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: ec3a854fcc57202cc52d732db201fdd938a7748edcadd4f84268c0f117232e32
Instruction ID: 2ecb7c7e7a795d3058318bbf47345d15132117df32e6ebff63f3c7133d39ef17
Opcode Fuzzy Hash: ec3a854fcc57202cc52d732db201fdd938a7748edcadd4f84268c0f117232e32
Instruction Fuzzy Hash: D55106A7B19A4252FA50DF25D40837B6360FF46796F440131EAADC6AA4FF7CE485C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB402C0 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetDlgItemTextW.USER32 ref: 00007FF6CDB40436
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB404A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB404A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB404AD

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ItemText
String ID:
API String ID: 3750147219-0
Opcode ID: 0a34143c20c2f746d5ca29f49d8e7d887edf6a10a19364d193909f324f5a4b28
Instruction ID: 743360b4bf98102047f6a9a356c35658c8c33b3ecbef78d507d9bc4bc985dd28
Opcode Fuzzy Hash: 0a34143c20c2f746d5ca29f49d8e7d887edf6a10a19364d193909f324f5a4b28
Instruction Fuzzy Hash: 9F519FA2F14A5285FB00DFA5D8452AD2322AF46BA6F504636DAAC97BD5EF6CE440C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB23694 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,00000000,00000000,?,00007FF6CDB230AD), ref: 00007FF6CDB236DE
CreateDirectoryW.KERNEL32 ref: 00007FF6CDB23743
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,00007FF6CDB230AD), ref: 00007FF6CDB237A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB237DE

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 072a2b8ac1399326ec50dcff8ca594137dac2b0fda88f662e81bcea673ce7f7d
Instruction ID: 1c09a02e1f21f71e8444f4e1a8729143de7d71c921983708a17b41dd5e469e8b
Opcode Fuzzy Hash: 072a2b8ac1399326ec50dcff8ca594137dac2b0fda88f662e81bcea673ce7f7d
Instruction Fuzzy Hash: F031F6A7B0C64241EA248F25944927E7361FF8A79AF544239EAEDC27E5FF3CD4418600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB42C4C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6CDB42C5B

Part of subcall function 00007FF6CDB426DC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6CDB426FE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6CDB42C70
__scrt_release_startup_lock.LIBCMT ref: 00007FF6CDB42CDE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6CDB42D31

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 0c9c4e8b53fce571e4f8cc9c566692338f2f17298642b4176caf27cad4df4a56
Instruction ID: da46ab09de4cf2180053cb3992a9e24ba9d1371f36dfe7165ea4b4d950074238
Opcode Fuzzy Hash: 0c9c4e8b53fce571e4f8cc9c566692338f2f17298642b4176caf27cad4df4a56
Instruction Fuzzy Hash: 07314FA1F4D90346FA54EF65D5123BE6291AF43386F444434EAEEC72E3FE2CE9049250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB22330 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6CDB22937,?,00100000,?,00000001,00000000,00000000,?,00007FF6CDB21421), ref: 00007FF6CDB22358
ReadFile.KERNELBASE ref: 00007FF6CDB22377
GetLastError.KERNEL32 ref: 00007FF6CDB223AB
GetLastError.KERNEL32 ref: 00007FF6CDB223CA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 9a5f096d935e1beb86ed3acd2769427491289d6d100b5e01c498b1e2430b3287
Instruction ID: 3421afc3aa1aafe00ffb7b0c90579ee7c8d373a29fb40310b99acaba74062a3b
Opcode Fuzzy Hash: 9a5f096d935e1beb86ed3acd2769427491289d6d100b5e01c498b1e2430b3287
Instruction Fuzzy Hash: F92150A2F0CD5289EA605F11E40863A6390FF46B9EF144135DAEDCE684EF7CEA858741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2E8B4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB2EC48: ResetEvent.KERNEL32 ref: 00007FF6CDB2EC61
Part of subcall function 00007FF6CDB2EC48: ReleaseSemaphore.KERNEL32 ref: 00007FF6CDB2EC77

ReleaseSemaphore.KERNEL32 ref: 00007FF6CDB2E8E0
FindCloseChangeNotification.KERNELBASE ref: 00007FF6CDB2E8FF
DeleteCriticalSection.KERNEL32 ref: 00007FF6CDB2E916
CloseHandle.KERNEL32 ref: 00007FF6CDB2E923

Part of subcall function 00007FF6CDB2E9C8: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6CDB2E8CB,?,?,?,00007FF6CDB2464A,?,?,?), ref: 00007FF6CDB2E9CF
Part of subcall function 00007FF6CDB2E9C8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6CDB2E8CB,?,?,?,00007FF6CDB2464A,?,?,?), ref: 00007FF6CDB2E9DA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CloseReleaseSemaphore$ChangeCriticalDeleteErrorEventFindHandleLastNotificationObjectResetSectionSingleWait
String ID:
API String ID: 2143293610-0
Opcode ID: 4c0973ffb1440d85791d797361540583d42a04df9501ebda1e3e4d0b2ceb8b3d
Instruction ID: 6181ad3feb65c32136edd3c3b1d735daeb5acdbcfec0ff17aadbc521de60fe0f
Opcode Fuzzy Hash: 4c0973ffb1440d85791d797361540583d42a04df9501ebda1e3e4d0b2ceb8b3d
Instruction Fuzzy Hash: E0014077B18A9193E6489F22E94426DB331FB89B81F044131EBAD43611EF39F4B58740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2EA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6CDB2EA4C
SetThreadPriority.KERNEL32 ref: 00007FF6CDB2EAA2

Strings

CreateThread failed, xrefs: 00007FF6CDB2EA5A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: b809f1ae60c8875f32b5bcbb20d8f41751bc11c1317a13f6b24d05741c8ad7d5
Instruction ID: fbe0383b32bca8f838b2efb77d3083a6eb1dc894664541d9a9a72aef9c6196b2
Opcode Fuzzy Hash: b809f1ae60c8875f32b5bcbb20d8f41751bc11c1317a13f6b24d05741c8ad7d5
Instruction Fuzzy Hash: 331194B2B18A4292F700DF15E8451B97370FB9678AF544531E6ED82668FF3CE585C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB2DF3C: GetSystemDirectoryW.KERNEL32 ref: 00007FF6CDB2DD4B

OleInitialize.OLE32 ref: 00007FF6CDB39366
SHGetMalloc.SHELL32 ref: 00007FF6CDB393B4

Strings

riched20.dll, xrefs: 00007FF6CDB39355

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 5b2071be2b1dafc67132129f05112032e17bcfd74a08d7c7ef604375e8075561
Instruction ID: 9a3bacf9aebd3d0546bd7b4c28de7ab97cb68d4fcf9a18a45818c9346f313c55
Opcode Fuzzy Hash: 5b2071be2b1dafc67132129f05112032e17bcfd74a08d7c7ef604375e8075561
Instruction Fuzzy Hash: 1AF062B1718A4292EB00DF20F8552AAB7A0FF89755F440135E9DD86B54EF7CE14DCB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB30830 Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB3841C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6CDB3844C

Part of subcall function 00007FF6CDB2AA90: LoadStringW.USER32 ref: 00007FF6CDB2AB17
Part of subcall function 00007FF6CDB2AA90: LoadStringW.USER32 ref: 00007FF6CDB2AB30

Part of subcall function 00007FF6CDB11FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11FFB

Part of subcall function 00007FF6CDB1129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB11396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB4009B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB400A1
SendDlgItemMessageW.USER32 ref: 00007FF6CDB400D2

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 9ebcb70c4461c46b65b2539b60ce7e6f4da769025c2a1ea5b79e80e31e37c1f9
Instruction ID: 89788e296d27a44753bd6a423c7f942a91e6d2a4f1ea49703b7004e47c5a349f
Opcode Fuzzy Hash: 9ebcb70c4461c46b65b2539b60ce7e6f4da769025c2a1ea5b79e80e31e37c1f9
Instruction Fuzzy Hash: 8C51B1A2F0564296FB10EFA1D4452FD2362AF86BC9F414136DAAD977D6FE2CE540C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB22144 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6CDB221DF
CreateFileW.KERNEL32 ref: 00007FF6CDB2224C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB222E8

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: d3124626a4378c333c49cbb96ed45c7905388a628c063955ee716b633a20b6b0
Instruction ID: bc0cfbc28f9af475559cb43f0db181a54055e2ef6f4a1de618ca672501a374ab
Opcode Fuzzy Hash: d3124626a4378c333c49cbb96ed45c7905388a628c063955ee716b633a20b6b0
Instruction Fuzzy Hash: BF41B3B3B04A8182EB108F15E44966A63A1FB46BB9F505734DBFD87AD5EF3CE491C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB123F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6CDB1243E
GetWindowTextW.USER32 ref: 00007FF6CDB12476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB12505

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 87749474a89299ab25d86d739f35c4f3f9ae05bc047993a5a9aa9354af0e8750
Instruction ID: 99d89fc80db2d9ffb3d3936ed170f26653009bf4b804ce41d8f8821610f87c13
Opcode Fuzzy Hash: 87749474a89299ab25d86d739f35c4f3f9ae05bc047993a5a9aa9354af0e8750
Instruction Fuzzy Hash: 9C2193A2B18B8181EA149F65B44016A7364FB8ABD1F145235EBEC43B95EF3CD180C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB31E74 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CDB31F3B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CDB31F57
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CDB31F73

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 4c84efd0a00d1c798189c990ace33d55e2c5e51d4e326bb4c8e4ffb822122b00
Instruction ID: e2e55540c24eb732021fb1e8db48ae051c2c5dfbad3b7e48c986220544ed78c5
Opcode Fuzzy Hash: 4c84efd0a00d1c798189c990ace33d55e2c5e51d4e326bb4c8e4ffb822122b00
Instruction Fuzzy Hash: 1E317ED2F08A8692EB24DF14E4443BC63A4AB417C5F984432D6EC87AE6EF6CE5569301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB23D44 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000000,00000001,00007FF6CDB2379D), ref: 00007FF6CDB23D6E
SetFileAttributesW.KERNEL32 ref: 00007FF6CDB23DC0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB23E2A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 09c1da968bb57d26b7efcbce64c8032bdfea7029a715582e76ae5880fe178d45
Instruction ID: b6d4f4ff2af990ecec3294d3d87829ef0530b99e97f39e533392b1c569ee053f
Opcode Fuzzy Hash: 09c1da968bb57d26b7efcbce64c8032bdfea7029a715582e76ae5880fe178d45
Instruction Fuzzy Hash: 5121FB63B08A4181EA209F25E44426E7360FF8AB99F405235EAED82795FF3CD540C640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB231CC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF6CDB231F7
DeleteFileW.KERNEL32 ref: 00007FF6CDB23247
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB232B1

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 3e5a054dda678685d953116bf724def0cddc25b6d3140765cfe07ef2595d13cf
Instruction ID: 4f0e5fc595888308dc18a186ad8c0a23a91f26112f2c602bc6fcb6722a0a0f81
Opcode Fuzzy Hash: 3e5a054dda678685d953116bf724def0cddc25b6d3140765cfe07ef2595d13cf
Instruction Fuzzy Hash: 8021B663B18B8181EA148F25E45926E7360FF86B99F505234EAED82B99FF2CD541C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB232CC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF6CDB2E51D,?,?,?,00000000,?), ref: 00007FF6CDB232F7
GetFileAttributesW.KERNELBASE ref: 00007FF6CDB23344
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB233A9

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 1604c7ddd739069d4f8cf3d3f41905e88ad9e3ef0ba44aeeadaa27002a19151a
Instruction ID: 846c6865b3d51cf2c3c81c5d10f46e599ece7abf13a428ea144ff0334f16d420
Opcode Fuzzy Hash: 1604c7ddd739069d4f8cf3d3f41905e88ad9e3ef0ba44aeeadaa27002a19151a
Instruction Fuzzy Hash: 7E217773B1868181EA149F19E445129B361FF8A795F500735EAED837E5EF3CD541C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4BE44 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6CDB4BE28), ref: 00007FF6CDB4BE6C
TerminateProcess.KERNEL32(?,?,?,00007FF6CDB4BE28), ref: 00007FF6CDB4BE77
ExitProcess.KERNEL32 ref: 00007FF6CDB4BE86

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0a2eda5d3e88f26141300154e6fecbf72f6183405112391574be9d7d4e2c3e95
Instruction ID: 4c56e373657a3fe5fdca0bee11990b6baf6ed4c6844d3131c1dcc9121a88da9d
Opcode Fuzzy Hash: 0a2eda5d3e88f26141300154e6fecbf72f6183405112391574be9d7d4e2c3e95
Instruction Fuzzy Hash: 02E04894B4430582EB44AF31D89137633525F8A743F004838DAEF87352FE3DE4084301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1F530 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F84D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1F853

Part of subcall function 00007FF6CDB23ED8: FindClose.KERNELBASE ref: 00007FF6CDB23F0D

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 11b05a60c023c70aa501037ac0427ff50022e187128bfdfe1074b826fae88991
Instruction ID: d4d9cc02b85618f2ab4d09cf58cd43b2e13854ae8ed3941aa67672bde072fdf9
Opcode Fuzzy Hash: 11b05a60c023c70aa501037ac0427ff50022e187128bfdfe1074b826fae88991
Instruction Fuzzy Hash: B691A6B3B18B8194FB10DF64D4442AD63A1FB4A799F504236EAAC87AE9EF7CD545C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB13904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB13AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB13AB9

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3762ba0ec72dccc1855668fce849e0246193341c791bcf5b82e0bb1608038e06
Instruction ID: 72fe412254932c3a80fb002d2e321c02db4f1655b458a9ba3a97ac392f1201ff
Opcode Fuzzy Hash: 3762ba0ec72dccc1855668fce849e0246193341c791bcf5b82e0bb1608038e06
Instruction Fuzzy Hash: 8141A2A2F1465285FB00DFB5D4412AD2360AF46BD9F545235DEADA7BC9FE38D482C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB22788 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF6CDB2275D), ref: 00007FF6CDB228B9
GetLastError.KERNEL32(?,00007FF6CDB2275D), ref: 00007FF6CDB228C8

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ef4fbd1024d65e14d311a2418a60bd7248f9f38b675c6cd41192c0d1007b2491
Instruction ID: 5d254a22fb8b047ec5369d9b919144e96b9a844d8e7ca63186f1a97c2966cbcc
Opcode Fuzzy Hash: ef4fbd1024d65e14d311a2418a60bd7248f9f38b675c6cd41192c0d1007b2491
Instruction Fuzzy Hash: 9331A5A3B19D5282EE604F29D5456BE6350AF06BDAF144131DEADCB7E0FE3CD5428700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB122BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6CDB122F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB123F0

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: fc3057fc9fef7823719b30f2cb257a4c1749aca8553d38d128b735d00cbab6c0
Instruction ID: ea804ee144e705aacb85ac6f5f3752e7652256031b7fed5e1b2b3262ccf4bfbb
Opcode Fuzzy Hash: fc3057fc9fef7823719b30f2cb257a4c1749aca8553d38d128b735d00cbab6c0
Instruction Fuzzy Hash: 7431CFA2B19B8686EA109F15F44536EB361EF86791F444235EBEC4BB95EF3CE140C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB22AE0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6CDB22B0E
SetFileTime.KERNELBASE ref: 00007FF6CDB22BAB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 3ec87b9758bb496d3f0ed74d2f22f57f278571f080bc3e03455df4d759835da1
Instruction ID: 706b07d6bbfd7ee2704f2fafa584eefdb47da619cc3fb879fd9d0d242330e9cd
Opcode Fuzzy Hash: 3ec87b9758bb496d3f0ed74d2f22f57f278571f080bc3e03455df4d759835da1
Instruction Fuzzy Hash: 6A21B0A3F09F4259EE618F52D80D3BB6690AF0679AF544131DE9C86291FE3CD886C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2AA90 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6CDB2AB17
LoadStringW.USER32 ref: 00007FF6CDB2AB30

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 1b36b612ca2896629c4e280576aab8d16d1c306fb9027882c0f57f56b41622ee
Instruction ID: 3949e62d74bba543805ac0972445727e893206c528543837812a6b0237e4b7fd
Opcode Fuzzy Hash: 1b36b612ca2896629c4e280576aab8d16d1c306fb9027882c0f57f56b41622ee
Instruction Fuzzy Hash: 32118EB1B08A0186EA008F16E888069B7B1BF8AFC6F554539CAADD3720EF3CE5018344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB22BC0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6CDB22C21
GetLastError.KERNEL32 ref: 00007FF6CDB22C2E

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 2a3ab4247109ddd51a4604de65f86c8f2d80f792229f2c0bcaddc834a5f20f46
Instruction ID: f46b658b7bf62eafe8c0b3454e2dbbcb467cf8960ad9a8bc13026cb159dcea6a
Opcode Fuzzy Hash: 2a3ab4247109ddd51a4604de65f86c8f2d80f792229f2c0bcaddc834a5f20f46
Instruction Fuzzy Hash: D811B762B1CA4181EB508F25E44527A6360FB46BB9F540331DABDD22E4EF3CD596C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB2A45C: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6CDB2A4B4
Part of subcall function 00007FF6CDB2A45C: SetDlgItemTextW.USER32 ref: 00007FF6CDB2A523
Part of subcall function 00007FF6CDB2A45C: GetWindowRect.USER32 ref: 00007FF6CDB2A55D
Part of subcall function 00007FF6CDB2A45C: GetClientRect.USER32 ref: 00007FF6CDB2A56B

GetDlgItem.USER32 ref: 00007FF6CDB125AC
SetDlgItemTextW.USER32 ref: 00007FF6CDB125C8

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Item$RectText$ClientWindowswprintf
String ID:
API String ID: 402765569-0
Opcode ID: b31d2a7bfc2867de038032dd24892f10b2ad5a957bbf65c7e9321e6fac6021db
Instruction ID: 7b6277781495ddce6d8d0c4a19ae3dbc9e92213dfc78359f4d4e2d0d3a4449fe
Opcode Fuzzy Hash: b31d2a7bfc2867de038032dd24892f10b2ad5a957bbf65c7e9321e6fac6021db
Instruction Fuzzy Hash: 09015290B0964A42FF555F51A49927A57A15F4774AF080035DCEDC62D9FE2CE4848310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2EAC4 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6CDB2EB19,?,?,?,?,00007FF6CDB25762,?,?,?,00007FF6CDB256EE), ref: 00007FF6CDB2EAC8
GetProcessAffinityMask.KERNEL32 ref: 00007FF6CDB2EADB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: d58601a77610d155af6f03b3f46bba2854ae3b9f9b2054f6603c13fa12b36a4d
Instruction ID: e892acd18ec9406fee8783aadc3d2043d44e2a4bedca660fe0e27d1f3b149c62
Opcode Fuzzy Hash: d58601a77610d155af6f03b3f46bba2854ae3b9f9b2054f6603c13fa12b36a4d
Instruction Fuzzy Hash: B0E02BA1F1454682DF098F56C8445E9B391FFC9B40B848036E54FC3614FE2CE1458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB420B0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB420E0

Part of subcall function 00007FF6CDB42E5C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CDB42E65

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB420E6

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: b2c957b1af4e92a60d360a929e9299ec44355b010b36c49b02650d0b792b9dfc
Instruction ID: 703b53b5e09ea26cbc1a584e1d0b3ba41f3f0db2792adc381056765e5eaade90
Opcode Fuzzy Hash: b2c957b1af4e92a60d360a929e9299ec44355b010b36c49b02650d0b792b9dfc
Instruction Fuzzy Hash: 1DE0ECC0F1A50B01F928ADA214552B601844F5B772E581B34DDFDC53C2BD1CE4929110

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4D7EC Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF6CDB4D802
GetLastError.KERNEL32 ref: 00007FF6CDB4D814

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 584100ada6b16433ad96f355d67de13f0450602348ee73c008d6ec9c263b7b09
Instruction ID: 236ff8a5193cd052a12e56c2c1d78d241d547c3876a43d437f885e15f5eb34e5
Opcode Fuzzy Hash: 584100ada6b16433ad96f355d67de13f0450602348ee73c008d6ec9c263b7b09
Instruction Fuzzy Hash: CCE08CE0F0910386FF08EFF298150B423E09F9AB43F080034C9ADC6292FE2CA4828201

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB133E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1388C

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0c4ba017ebc298f70cb3f58888252c552d89fedf9ec9e2209bdeb883bb1e2ad2
Instruction ID: d5cc84e7055ab4491b937792f3909167b4e03c2d4363cc2008a81cf620cc7437
Opcode Fuzzy Hash: 0c4ba017ebc298f70cb3f58888252c552d89fedf9ec9e2209bdeb883bb1e2ad2
Instruction Fuzzy Hash: A3D194E6B0868296EB688F25D5402BD77A5FF06B86F040035CBAD877A5FF38E4658700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB252A4 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2552B

Part of subcall function 00007FF6CDB312C8: CompareStringW.KERNEL32 ref: 00007FF6CDB31338

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: 0a2280026abf1d5f252db3327d554aa26a96ae8d4dcef8c3f5dc6264eaa9bd4a
Instruction ID: bdacd427142dbf3d2bd46147da444a11112036994353deeb5cbabcc0a6d4a702
Opcode Fuzzy Hash: 0a2280026abf1d5f252db3327d554aa26a96ae8d4dcef8c3f5dc6264eaa9bd4a
Instruction Fuzzy Hash: F26102D3F0C64781FA649E25460827A92D1AF42BDBF544131DEFEC66C9FE6CE5418210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB31750 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB2E8B4: ReleaseSemaphore.KERNEL32 ref: 00007FF6CDB2E8E0
Part of subcall function 00007FF6CDB2E8B4: FindCloseChangeNotification.KERNELBASE ref: 00007FF6CDB2E8FF
Part of subcall function 00007FF6CDB2E8B4: DeleteCriticalSection.KERNEL32 ref: 00007FF6CDB2E916
Part of subcall function 00007FF6CDB2E8B4: CloseHandle.KERNEL32 ref: 00007FF6CDB2E923

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB319AB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Close$ChangeCriticalDeleteFindHandleNotificationReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1624603282-0
Opcode ID: 01ceaa24fc445e3c8638e4446936c020665fb4b6e2bb907c0f410112f5f028f1
Instruction ID: c29e234dcd9d522d7e9ef6e8557c76d61a6b0797fbf3ed62bd813b2587a76eed
Opcode Fuzzy Hash: 01ceaa24fc445e3c8638e4446936c020665fb4b6e2bb907c0f410112f5f028f1
Instruction Fuzzy Hash: BC61B0E2B15A85A2EE08DF26D5541BC7369FF42BC5B544236D7BD87AC1EF28E4A1C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1EC54 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1EE70

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b9b319761cc6a3e1800825b04271ad6919126f9e41cd9415e70617dd37653bd4
Instruction ID: 0ba007b8cc0c67ef30d1eb0ac0b1774735cac22e665baabed7ffed6e73f52d44
Opcode Fuzzy Hash: b9b319761cc6a3e1800825b04271ad6919126f9e41cd9415e70617dd37653bd4
Instruction Fuzzy Hash: A751B0A3B08A4250EA149F26D4453A92751FF87BCAF840136EEED87396EF3DE485C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2189C Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB21A4B

Part of subcall function 00007FF6CDB22144: CreateFileW.KERNEL32 ref: 00007FF6CDB2224C

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CreateFile_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2373759558-0
Opcode ID: 8d536db985148bab0ae847466f9aff6d20d49608bd843134bb0cc1f8fb5084c9
Instruction ID: 5b581cf0ffd73f02e411e77d27968de42b008e13623f6feb21329a3e9c884b5c
Opcode Fuzzy Hash: 8d536db985148bab0ae847466f9aff6d20d49608bd843134bb0cc1f8fb5084c9
Instruction Fuzzy Hash: F941E393B1C64245FA24AE2294193BA1351AF57BDAF044132DEBDCBBD6FE2CE442C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1E760 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB23ED8: FindClose.KERNELBASE ref: 00007FF6CDB23F0D

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1E94B

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: cb2dba6838f1cf6ae25d147f7a361d62f7a50a4f668aa68bee71642d9e3fe321
Instruction ID: ba0110cdb8ebb45524fa4d069aa4af8ce78d15f631cd6a031febcef494e1ff75
Opcode Fuzzy Hash: cb2dba6838f1cf6ae25d147f7a361d62f7a50a4f668aa68bee71642d9e3fe321
Instruction Fuzzy Hash: 275181A2B1868681FB64CF28D44537D2361FF86B85F440136EAED877A5EF2CE441C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB216F4 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB217DD

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 6aba7824494e9ca9408788b0b26e9c82c738197394e76539725ef44273fc4e0f
Instruction ID: 12cec10bede581edd5b576bc7e6a5dde476b252a74936632589b5935c8113da9
Opcode Fuzzy Hash: 6aba7824494e9ca9408788b0b26e9c82c738197394e76539725ef44273fc4e0f
Instruction Fuzzy Hash: D8412AA3B18A8141EA048F13E944379A291FF95FC5F048536EE9C8BF59EF7CD4918340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB22F68 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB230D8

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1ca180ee51584c916344a10b4dbc1bff289906776cdcd728db3dbd4adc6c1ffa
Instruction ID: 3f8e0e088bd82db8032d94cc06ce99ec3e840f835d5c6a3356d5f3b4d1a3b10d
Opcode Fuzzy Hash: 1ca180ee51584c916344a10b4dbc1bff289906776cdcd728db3dbd4adc6c1ffa
Instruction Fuzzy Hash: B141D3A3B08B4680EA189F25D54937A33A1EF46BD9F141139EAED87799EF3DE040C650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4BCD8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6CDB4BD00

Part of subcall function 00007FF6CDB4BE90: GetModuleHandleExW.KERNEL32 ref: 00007FF6CDB4BEB0
Part of subcall function 00007FF6CDB4BE90: GetProcAddress.KERNEL32 ref: 00007FF6CDB4BEC6
Part of subcall function 00007FF6CDB4BE90: FreeLibrary.KERNEL32 ref: 00007FF6CDB4BEEB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5f3f72e95806f48bc601d5673e555addf4234e18d129eb1b5d0bf15baf821d35
Instruction ID: 0f26e3f08687ddce6615f4a3dcf173f7d5c33342b4ea66fc5f03c95ede1d2e8f
Opcode Fuzzy Hash: 5f3f72e95806f48bc601d5673e555addf4234e18d129eb1b5d0bf15baf821d35
Instruction Fuzzy Hash: CE41D2A1F0861282FB18DF16D85017963A1AF97B82F944479EAEEC7691FF3DE8408340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB11396

Part of subcall function 00007FF6CDB11F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CDB11F89

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 726a7ea0e11eaddf7946e7a6aa87bc75786e33f15201306cfb91278e1d6dc955
Instruction ID: 19ea591d5d9e11d70d3cce96860f062d64b8bb9cb87b33d2fcde20fdb22c1fbf
Opcode Fuzzy Hash: 726a7ea0e11eaddf7946e7a6aa87bc75786e33f15201306cfb91278e1d6dc955
Instruction Fuzzy Hash: DE21A4A2B09B5195EA149F91B4402796250FF06BF1F680B32DEBD87BD5FE7CE0518344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB5112C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB51160

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d5c0289b8fa8543e55461a0eba1f16d50ca4c5d514165fc00effb05d3347a802
Instruction ID: 2e6f2af06f4f3c5bb11ce16af35e93e77a4cb900ebb276270524aab07db4ce4e
Opcode Fuzzy Hash: d5c0289b8fa8543e55461a0eba1f16d50ca4c5d514165fc00effb05d3347a802
Instruction Fuzzy Hash: 6F118BB2B0C68286F710AF10E88017972A5FB463C6F550576E6EDC7692FF3CE8008B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB13AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB13B6C

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2ad6a4f04a0d46fbc5bf8fc690fb633ecbc3182f237835d9dbf9bee9c88372d6
Instruction ID: fe5a82f93a562eb04a671cb9a014317e82b62648a572290e63c8f7a15f88930e
Opcode Fuzzy Hash: 2ad6a4f04a0d46fbc5bf8fc690fb633ecbc3182f237835d9dbf9bee9c88372d6
Instruction Fuzzy Hash: 72016DE2F18B8581FA149F28E44526E7361FF8A796F805231EBEC47BA5FE6CD141C604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB41438 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB414E4: GetModuleHandleW.KERNEL32(?,?,?,00007FF6CDB41453,?,?,?,00007FF6CDB4180A), ref: 00007FF6CDB4150B

DloadProtectSection.DELAYIMP ref: 00007FF6CDB414A9

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 30aead04cd111ca808ad120ff150458f4e2f5f4057b01e6f9c0314f98d77e521
Instruction ID: ee2c3561d600f966dad01f1a521cd112f1b7a3e9985501dc64ae8aa73068d44d
Opcode Fuzzy Hash: 30aead04cd111ca808ad120ff150458f4e2f5f4057b01e6f9c0314f98d77e521
Instruction Fuzzy Hash: DE11CCE4F0860792FB61DF55E8423706350AF0678AF150036C9FDC62A5FF3CA5959B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4F8E4 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6CDB4F939

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e45b4205e63e7225e81d8b155b4aa63996a4611e3abc014573c50bdbd896d072
Instruction ID: 07fa4e87cc50aef967dec8c721b9a7f0a5c82daa71816a2210335080c7cac221
Opcode Fuzzy Hash: e45b4205e63e7225e81d8b155b4aa63996a4611e3abc014573c50bdbd896d072
Instruction Fuzzy Hash: FFF06DD5F0A20751FE56DE6699453B962D05F5EB92F485430C9EEC73D1FE1CE4814220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB23ED8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB240CC: FindFirstFileW.KERNELBASE ref: 00007FF6CDB2411B
Part of subcall function 00007FF6CDB240CC: FindFirstFileW.KERNELBASE ref: 00007FF6CDB2416E
Part of subcall function 00007FF6CDB240CC: GetLastError.KERNEL32 ref: 00007FF6CDB241BF

FindClose.KERNELBASE ref: 00007FF6CDB23F0D

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: b3b5d10abd9dd928a71f03b4f8beb2761cd6a866a34a94f189c3012c27a56145
Instruction ID: b4dc4af12f9b7197e88db33f078f7e42adb8b5d1c285af166dc7c79e6e75a5b3
Opcode Fuzzy Hash: b3b5d10abd9dd928a71f03b4f8beb2761cd6a866a34a94f189c3012c27a56145
Instruction Fuzzy Hash: 2AF0F4A3B082C185EA14AF70A0481A933609F07BB9F181338EABD473D7DE28D485C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB11FA0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11FFB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0ef7cacdd4384e4836ec246951469c3c91253e445cc1fff22a2220a3cfb9f043
Instruction ID: d9a39d3290884616b6438b930ad69a8bf35647a3739e006e4965d85ee3dae88f
Opcode Fuzzy Hash: 0ef7cacdd4384e4836ec246951469c3c91253e445cc1fff22a2220a3cfb9f043
Instruction Fuzzy Hash: 5CF0BEA1B1068A80EE18DF69C08836C2362EB05B8AF504432D79C8B655EF6DD8C0C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB220E0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000000,00007FF6CDB2208A), ref: 00007FF6CDB22106

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: dc44c697aecda2a3651f5016d9d2e54d615b42984b8d71c5c966daabb4029cc0
Instruction ID: b45a758f8900ce6f9129c0191a568e703992e7f9b3e34b9a04a5f92408ba1850
Opcode Fuzzy Hash: dc44c697aecda2a3651f5016d9d2e54d615b42984b8d71c5c966daabb4029cc0
Instruction Fuzzy Hash: 4AF08162B08A8295FB248F20E04667A2661EB16B7FF494335D7BCC11D4EF28D8958714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4D82C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6CDB4D86A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 73a5323a310e52b210095381dd27d43cc9adff3e93408486b8786f310bee8c05
Instruction ID: 7ef6d98304792eac391ad29db6e2a8bade423061ff6c18a1728fe442e8ac11d4
Opcode Fuzzy Hash: 73a5323a310e52b210095381dd27d43cc9adff3e93408486b8786f310bee8c05
Instruction Fuzzy Hash: 9FF0F8D1F0924645FEA4AEB25C512B522905F8ABA2F4D4634DDFEC62D1FE6CE4818120

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2274C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF6CDB22765

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: ba6dcb6d4754fc4065425ddad4f70c4e78d26e6be1c6327c0237102fe5098734
Instruction ID: 1fd27d71b6ff88c95d65f0400f5dbad7e37dd2fc672b7924680549a407d046d0
Opcode Fuzzy Hash: ba6dcb6d4754fc4065425ddad4f70c4e78d26e6be1c6327c0237102fe5098734
Instruction Fuzzy Hash: 79E0CD56B1491581EF209F36D8555356320EF4EF86B4C1030CE9D87331EE28C4818700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB224A0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6CDB224B2

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 3f696bf045a3ed6fe586de77e66f21a1296162081a8ca5dd48a72c6a9739041a
Instruction ID: 4c0fb38f319346e399639629e316f47d09bccc4b0485d51a7287da2cae2a7a21
Opcode Fuzzy Hash: 3f696bf045a3ed6fe586de77e66f21a1296162081a8ca5dd48a72c6a9739041a
Instruction Fuzzy Hash: 6BD0C956E0A84182D9109A39985603D2250AF53B3AFA40720D6BEC16E1DE5DA4969210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB27F74 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF6CDB27F82

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 6decb0ccc1ae4c1fe08947d54160ccc025c816e3e5ffee15d2fe0ffc161d4727
Instruction ID: 3fe4840f705b9366360e6299c2561434ce20ac3ef75547d6f23e9491365b86fb
Opcode Fuzzy Hash: 6decb0ccc1ae4c1fe08947d54160ccc025c816e3e5ffee15d2fe0ffc161d4727
Instruction Fuzzy Hash: 13C08C21F05542C1DA086F26C8CA01823A4BB41B0AB644038C15CC1120EE2CD9EA9388

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6CDB1C300 Relevance: 48.0, APIs: 23, Strings: 4, Instructions: 731fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB1DDBC: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6CDB1CF03), ref: 00007FF6CDB1DDDF
Part of subcall function 00007FF6CDB1DDBC: GetLastError.KERNEL32 ref: 00007FF6CDB1DE40
Part of subcall function 00007FF6CDB1DDBC: CloseHandle.KERNEL32 ref: 00007FF6CDB1DE53

CreateFileW.KERNEL32 ref: 00007FF6CDB1C8F5
CloseHandle.KERNEL32 ref: 00007FF6CDB1C98B
wcscpy.LIBCMT ref: 00007FF6CDB1C9D9
wcscpy.LIBCMT ref: 00007FF6CDB1CA0F
wcscpy.LIBCMT ref: 00007FF6CDB1CB8C
wcscpy.LIBCMT ref: 00007FF6CDB1CBC2
CreateFileW.KERNEL32 ref: 00007FF6CDB1CBFC
DeviceIoControl.KERNEL32 ref: 00007FF6CDB1CCC5
CloseHandle.KERNEL32 ref: 00007FF6CDB1CCD6
GetLastError.KERNEL32 ref: 00007FF6CDB1CCF2
RemoveDirectoryW.KERNEL32 ref: 00007FF6CDB1CD40
DeleteFileW.KERNEL32 ref: 00007FF6CDB1CD4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE48
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE4E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE5A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE60
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE6C

Part of subcall function 00007FF6CDB1129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB11396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE72
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE78
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE7E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE84
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE8A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1CE90

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6CDB1C35F
UNC\, xrefs: 00007FF6CDB1C54E, 00007FF6CDB1C56C
SeRestorePrivilege, xrefs: 00007FF6CDB1C353
\??\, xrefs: 00007FF6CDB1C3A1, 00007FF6CDB1C3C7

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$wcscpy$CloseFileHandle$CreateErrorLast$Concurrency::cancel_current_taskControlCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2399786022-3508440684
Opcode ID: e3273c780add81ac982781179e6245e6c8bde2b197675b5fddbdb4f82a88bc4f
Instruction ID: e95cac6ed9d166897be963f99d604871f131b83b56a0ba3a63d503b6b91724ed
Opcode Fuzzy Hash: e3273c780add81ac982781179e6245e6c8bde2b197675b5fddbdb4f82a88bc4f
Instruction Fuzzy Hash: 1662CFA2F1868285FB00DF74D4452BD6361AF867A5F504236DABCA7AD9FF38E185C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2F0F0 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6CDB30498

Part of subcall function 00007FF6CDB2AA90: LoadStringW.USER32 ref: 00007FF6CDB2AB17
Part of subcall function 00007FF6CDB2AA90: LoadStringW.USER32 ref: 00007FF6CDB2AB30

Part of subcall function 00007FF6CDB3AFBC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CDB30399), ref: 00007FF6CDB3AFF0
Part of subcall function 00007FF6CDB3AFBC: SetLastError.KERNEL32 ref: 00007FF6CDB3B033

Part of subcall function 00007FF6CDB1129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB11396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30400
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30406
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3040C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30412
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30418
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3041E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30424
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3042A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30430
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30436
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3043C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30442
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30448
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3044E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30454
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3045A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30460
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB30466
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB304A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB304A8

Strings

%s: %s, xrefs: 00007FF6CDB2FB81
%ls, xrefs: 00007FF6CDB2F31C, 00007FF6CDB2F36F

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: a55aa01ccccba92e7cef55d00e3df48e1cb5795345c33898c80520f6132ea1f3
Instruction ID: 2b34ac300378bc30f477e70a50920cca1f449bf9c556e860ff12c031add1e5f9
Opcode Fuzzy Hash: a55aa01ccccba92e7cef55d00e3df48e1cb5795345c33898c80520f6132ea1f3
Instruction Fuzzy Hash: E0B2C7E2F1868342EA149F26D4451BEA361EFDB791F104236E6ED836E6FE6CE540C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB52430 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB52AF2
memcpy_s.LIBCMT ref: 00007FF6CDB5349F
memcpy_s.LIBCMT ref: 00007FF6CDB53546

Part of subcall function 00007FF6CDB5379C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB537CE

memcpy_s.LIBCMT ref: 00007FF6CDB5360F

Part of subcall function 00007FF6CDB4CEE8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB4CF0D

Strings

1#QNAN, xrefs: 00007FF6CDB536C8
1#INF, xrefs: 00007FF6CDB536E7
1#SNAN, xrefs: 00007FF6CDB536A9
1#IND, xrefs: 00007FF6CDB5368A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: 64c2d7388ccc414d562cce2142b4611408cc8a54e4e8b2a90bb6c1e23c9fdf32
Instruction ID: c7d13e545fd534ee59fb5c23ccabd00aaebf3ccad71e3739d5ef9502c90bd6e0
Opcode Fuzzy Hash: 64c2d7388ccc414d562cce2142b4611408cc8a54e4e8b2a90bb6c1e23c9fdf32
Instruction Fuzzy Hash: 83B218B2F086828BE765CE69D4407FE37A1FB46789F505135DA6A97B84FF38E5048B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB21A54 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6CDB21AA3
GetLongPathNameW.KERNEL32 ref: 00007FF6CDB21AEC
GetShortPathNameW.KERNEL32 ref: 00007FF6CDB21B2D
GetShortPathNameW.KERNEL32 ref: 00007FF6CDB21B76

Part of subcall function 00007FF6CDB31298: CompareStringW.KERNEL32 ref: 00007FF6CDB312B7

MoveFileW.KERNEL32 ref: 00007FF6CDB21E0A
MoveFileW.KERNEL32 ref: 00007FF6CDB21E71

Part of subcall function 00007FF6CDB22144: CreateFileW.KERNEL32 ref: 00007FF6CDB2224C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB21FED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB21FF3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB21FF9

Strings

rtmp, xrefs: 00007FF6CDB21D00, 00007FF6CDB21D0F

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 010c3b244d9811f6aace4d49cfd520ac4f793057d78827e82fe7e5a8eac7b222
Instruction ID: 1885fd00de3cb21f7f440909d1fadfec87c3a8b950b754f94c76e0f60cc95b69
Opcode Fuzzy Hash: 010c3b244d9811f6aace4d49cfd520ac4f793057d78827e82fe7e5a8eac7b222
Instruction Fuzzy Hash: 21F1D6A3F08A4281EB10DF65D4841BE6761FB863C9F501136EAADC7AA9EF3CD585C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB25B70 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6CDB25BD2
GetFullPathNameW.KERNEL32 ref: 00007FF6CDB25C1E
GetFullPathNameW.KERNEL32 ref: 00007FF6CDB25D3B
GetFullPathNameW.KERNEL32 ref: 00007FF6CDB25D80
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB25EF0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB25EF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB25EFC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB25F02

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: f0830ec0508487d511d1b5bcfbe4f2ef7ae3b5d73509c3d864dd6dceeaf5fee7
Instruction ID: 1b47928da4db396b9c18e818146b2359d76bbb4dbfaf22ee143d076a8c9a8788
Opcode Fuzzy Hash: f0830ec0508487d511d1b5bcfbe4f2ef7ae3b5d73509c3d864dd6dceeaf5fee7
Instruction Fuzzy Hash: DDA1A3A3F14A5284FE00DF79D9481BD23A1AB46BA9B504235DEBD97BC8FE3CD081C240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB43050 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6CDB4306C
RtlCaptureContext.KERNEL32 ref: 00007FF6CDB43099
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6CDB430B3
RtlVirtualUnwind.KERNEL32 ref: 00007FF6CDB430F4
IsDebuggerPresent.KERNEL32 ref: 00007FF6CDB43148
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6CDB43169
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6CDB43174

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: bbb94efd6e2a469fca1a56d09deea645364734e9931874f57afa518f9a32d109
Instruction ID: 885901851bf7a3bbdb1a9e00a130f3e5226c18739d38ad5b0177faf426b3b601
Opcode Fuzzy Hash: bbb94efd6e2a469fca1a56d09deea645364734e9931874f57afa518f9a32d109
Instruction Fuzzy Hash: 75313CB6709B818AEB608F60E8507E97364FB85745F44443AEA9D87B98EF38D648C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB475B8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6CDB47631
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6CDB47649
RtlVirtualUnwind.KERNEL32 ref: 00007FF6CDB47684
IsDebuggerPresent.KERNEL32 ref: 00007FF6CDB476BD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6CDB476C7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6CDB476D2

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 70c7f3af6ef58f44486863db74fb05a279121861481e3b0243d292a7d9be0553
Instruction ID: f59b8135e2d4517cb1b213db369ec46b0679252c3dc8a2302aed7708bd223591
Opcode Fuzzy Hash: 70c7f3af6ef58f44486863db74fb05a279121861481e3b0243d292a7d9be0553
Instruction Fuzzy Hash: BB318E76708F8186EB60CF25E8406AE73A4FB89755F540536EAAD83B98EF3CC145CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB11AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB11EBB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 4167df96dbb16c82e892b51288492450405e1fa33c5a98002cb64fdd2cb06c89
Instruction ID: 473fee9a1f6d2f76ffd7b131c4a972243f5df0fa86a564056f2af34dc0788867
Opcode Fuzzy Hash: 4167df96dbb16c82e892b51288492450405e1fa33c5a98002cb64fdd2cb06c89
Instruction Fuzzy Hash: ABB1AEA2F15A8696EB109F65D8442AE2361FF867D5F405236EAAC87BD9FF3CD540C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4F974 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB4F9A4

Part of subcall function 00007FF6CDB47814: GetCurrentProcess.KERNEL32(00007FF6CDB50BAD), ref: 00007FF6CDB47841

Strings

., xrefs: 00007FF6CDB4FDC4
*?, xrefs: 00007FF6CDB4F9CB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 81433c8fefd8e6f10c886e24c667c44bba965009ea4539efb51bfcf7e2f48757
Instruction ID: 1af734b5a685b72876dbd78147528101bb8be84efe048956523c6717395addd1
Opcode Fuzzy Hash: 81433c8fefd8e6f10c886e24c667c44bba965009ea4539efb51bfcf7e2f48757
Instruction Fuzzy Hash: 7E51F2A2B15B9585EB11DFA298104BC77E4FB4ABD9B448531DEAD97B85FE3CD042C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB51F60 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF6CDB51FEB

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 2cbe3432477b1d9c4813cef5d46926508c58b940f98eb42ff710c18b5f87550a
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 67D1C3B2B1968687DB34CF15E18466BB7A1FB89785F448134DB9E97B44EE3CE841CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1B6E8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB1BAAD), ref: 00007FF6CDB1B6F5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB1BAAD), ref: 00007FF6CDB1B729
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB1BAAD), ref: 00007FF6CDB1B753

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: d54ba1604b47d5732b7315c53d2a433ca34a2d5dc9bbdb29158c846e93c7b95a
Instruction ID: 2fbeed8be468d829f4172d74965be2d1b686a25aa11d8808430202605b8dec6d
Opcode Fuzzy Hash: d54ba1604b47d5732b7315c53d2a433ca34a2d5dc9bbdb29158c846e93c7b95a
Instruction Fuzzy Hash: BC01FFB570C74282E7509F62F85057AA3A1FB8BBC1F484138EAAD87B55EF3CE5058B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4FB80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6CDB4FDC4

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 47d9fd1d9cce68eea699c86ee5c3e40722a5ed7f15fb7068995ba4ba6c15603a
Instruction ID: 344435050838d3b4564808e3cd87aeb4279cc3ce9d334112fdf61d7d8790f84a
Opcode Fuzzy Hash: 47d9fd1d9cce68eea699c86ee5c3e40722a5ed7f15fb7068995ba4ba6c15603a
Instruction Fuzzy Hash: 86312D62B0469145FB21DF32E9147B97AD1AB4ABE5F048235DEBC87BC6EE3CD5018300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB559D8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6CDB55C25
RaiseException.KERNEL32 ref: 00007FF6CDB55C36

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: e4c8747620ba2a31fb3fea2dbe59782e9a4c607827faab8e89e9801566228797
Instruction ID: 2b28eca415ae3f4e89918d7e2e5eadfe847d5f228e9a74cbbd9d76d43297309c
Opcode Fuzzy Hash: e4c8747620ba2a31fb3fea2dbe59782e9a4c607827faab8e89e9801566228797
Instruction Fuzzy Hash: 50B15AB3614B898BEB15CF29C98636C3BE0F745B4AF148921DAAD877A4EF39D451C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB38CD4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB384C0: GetDC.USER32 ref: 00007FF6CDB384CC
Part of subcall function 00007FF6CDB384C0: GetDeviceCaps.GDI32 ref: 00007FF6CDB384DD
Part of subcall function 00007FF6CDB384C0: ReleaseDC.USER32 ref: 00007FF6CDB384EA

GetObjectW.GDI32 ref: 00007FF6CDB38D28

Part of subcall function 00007FF6CDB38F90: GetDC.USER32 ref: 00007FF6CDB38FB9
Part of subcall function 00007FF6CDB38F90: GetObjectW.GDI32 ref: 00007FF6CDB38FE7
Part of subcall function 00007FF6CDB38F90: ReleaseDC.USER32 ref: 00007FF6CDB3909B

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 9a5c3d34b923cae5f694a3304152a3ac15d8c4888fdde5cc54b21661d77f21b7
Instruction ID: 07481d915e39988767666a2c880cd89317a63c23c8640f01d55f2dfc61c681fa
Opcode Fuzzy Hash: 9a5c3d34b923cae5f694a3304152a3ac15d8c4888fdde5cc54b21661d77f21b7
Instruction Fuzzy Hash: 6A815FBAB08B0586EB20CF6AE4506AD7771FB89B89F004536DE9D97B24EF38D545C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3A1AC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6CDB3A1F5
GetNumberFormatW.KERNEL32 ref: 00007FF6CDB3A251

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 6c77b93c6babdd078960e33a3dda3bdab4cb3bd71e0a7f1ea73c906554fc67a3
Instruction ID: a48c5bffc5ade86ed496fbd5bace5f8be7ea8317028f27510e0181ad1f06f02c
Opcode Fuzzy Hash: 6c77b93c6babdd078960e33a3dda3bdab4cb3bd71e0a7f1ea73c906554fc67a3
Instruction Fuzzy Hash: DE116DB2B18B8596E7618F11E8007EA7364FF89B85F854135DA9C83628FF3CD546C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB211CC Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB224D0: CreateFileW.KERNELBASE ref: 00007FF6CDB225AB
Part of subcall function 00007FF6CDB224D0: GetLastError.KERNEL32 ref: 00007FF6CDB225BE
Part of subcall function 00007FF6CDB224D0: CreateFileW.KERNEL32 ref: 00007FF6CDB2261E
Part of subcall function 00007FF6CDB224D0: GetLastError.KERNEL32 ref: 00007FF6CDB22627

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB21530

Part of subcall function 00007FF6CDB23990: MoveFileW.KERNEL32 ref: 00007FF6CDB239CD
Part of subcall function 00007FF6CDB23990: MoveFileW.KERNEL32 ref: 00007FF6CDB23A44

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: 87025e416cee58d714146fe86621062b287512ac4b8dcbefd11576ed62700a6a
Instruction ID: 1b0fc01c37903d0d30c0f34a7318b53186e6e86679dc5e7d790129ab97ffca03
Opcode Fuzzy Hash: 87025e416cee58d714146fe86621062b287512ac4b8dcbefd11576ed62700a6a
Instruction Fuzzy Hash: 9591D2A3B18A4682EA10DF62D4586BE6361FF46BC9F404036EEADC7B95EE3CD545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB24EC0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6CDB24EF2

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: c64f175986d7a8fda7e54b87a75a04ab53ef42f5d995779de85150265f3f9b60
Instruction ID: a1884c24cb470e511826fde82166c55893b18b3dd3f0e3b5e4be083db6963ac1
Opcode Fuzzy Hash: c64f175986d7a8fda7e54b87a75a04ab53ef42f5d995779de85150265f3f9b60
Instruction Fuzzy Hash: BF0184F2F4D58286FA308F20A4593B5B7509FAB70BF450139C5FC86691FE3CA0448A14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB48AFC Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6CDB48CB3

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 6e8e7ad7648d4e426f0b5d41b067cd50e69a5b1e3b084477f050905ae371f636
Instruction ID: 3b7deda47a4c36f332bae325613f612127ad47542ff8ae9d1ea8c622018d6f9c
Opcode Fuzzy Hash: 6e8e7ad7648d4e426f0b5d41b067cd50e69a5b1e3b084477f050905ae371f636
Instruction Fuzzy Hash: 39817999F1960246FB64CE29828027DA3A0EF03B46F141536DDA9C76D6EF2DE842C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB48880 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6CDB48A1A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 49fe15fdb2d666c8ca55a754b8ecad47c56f3e1a69e648c01cbc7683dae3907d
Instruction ID: 085c851613d2e6fa48af817cfc336b1fb95900cc9e40f4d926d94536fb3f869e
Opcode Fuzzy Hash: 49fe15fdb2d666c8ca55a754b8ecad47c56f3e1a69e648c01cbc7683dae3907d
Instruction Fuzzy Hash: 757126A9B0CA4346FB68CE29504037E9B919B4374AF182535CDE8C77D6EF2DE845C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2C918 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF6CDB2C927

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: b14b556a550ab9c557685cc0e568e0990f116c174438ba4f74e1acca61dc3e17
Instruction ID: 8d785f033c06e2d8462ad7e68f5e473f885ed1843019f54d055d89f55555f44c
Opcode Fuzzy Hash: b14b556a550ab9c557685cc0e568e0990f116c174438ba4f74e1acca61dc3e17
Instruction Fuzzy Hash: E651A0777286908BD724CF25E404A9E73A5F388798F445126EF9A93B08DF39E945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4C718 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF6CDB4C754

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: fde446ea9b982a502dd5f1ee3e696a7cdceb6db21e9e6d019aa7358a4b9e4cb6
Instruction ID: 0d8d1a35e44091483898b1c21ac22e28d169247dfe977a0e8e17a8735e702984
Opcode Fuzzy Hash: fde446ea9b982a502dd5f1ee3e696a7cdceb6db21e9e6d019aa7358a4b9e4cb6
Instruction Fuzzy Hash: 3241CCB3714A5486EE48CF2AD8542A973A1A759FD4B4DA036DFADCB754EE3CE042C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB50C00 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6CDB50C04

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 88ded60fe3f6f97b678b4dc4ac35e67973e2cd37b094ab7ac453c3bcc49c54de
Instruction ID: 5b709dec4c10b2c61688c2fec06ebfd9a63f042a1bceeb3ea679e0ac26204a02
Opcode Fuzzy Hash: 88ded60fe3f6f97b678b4dc4ac35e67973e2cd37b094ab7ac453c3bcc49c54de
Instruction Fuzzy Hash: F0B09264F17A02C2EE082F15AC8225422A4BF49702F958078D19C82320FF2C20A58710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB33844 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea26930433489c4679ddc8f0b2b91ef9881a292ac41eef90404591889e152e17
Instruction ID: 0d4eff5e028922322750e7f1b74bafaa01d3824b0605e0026e42187504d71f31
Opcode Fuzzy Hash: ea26930433489c4679ddc8f0b2b91ef9881a292ac41eef90404591889e152e17
Instruction Fuzzy Hash: 288214A3B096C187D714CF28D4442BD7B61EB56B89F09823ADAEE87385EE3DD445E310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB176C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce10dc1bd5e448f03d1118419a98a2947cce8991e3cbf8edea8f97ae5d77373
Instruction ID: 2f754a83b4d71d7e0e3a58a7af7171e416e47f14006cc251379aef7d2ffe31f3
Opcode Fuzzy Hash: 4ce10dc1bd5e448f03d1118419a98a2947cce8991e3cbf8edea8f97ae5d77373
Instruction Fuzzy Hash: 59627D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB352D0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b58196b4ecbb5769e54fc80c973dc5858fc4c1b14dbbe3b7c53fd5348143087
Instruction ID: 390f4afc82e3b302ed44a763f2c6f5a7250acd44d6e9f39ad5a94fa596de602f
Opcode Fuzzy Hash: 0b58196b4ecbb5769e54fc80c973dc5858fc4c1b14dbbe3b7c53fd5348143087
Instruction Fuzzy Hash: D48200B2B096C18BD714CE28C544AFC3BA1FB56B49F198136CAAE87785EE3CD485D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2BB3C Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c70324c870db858f628df726b9c70789d2efe9fa47d794540f1f95c798d2d4a
Instruction ID: 674b910f9ab28dc5a0ee2e78da6f48506d8f371083bcaf482fbcaf97f5b5819c
Opcode Fuzzy Hash: 7c70324c870db858f628df726b9c70789d2efe9fa47d794540f1f95c798d2d4a
Instruction Fuzzy Hash: 2922F5B3B206508BD728CF15C89AA5E3766F799344B4B8228DF4ACB785DB38D505CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB34A78 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd699e963fe8de4c67a7c8257b287e99a7e02dd2f4f27d0a432b53307594fd6f
Instruction ID: 20e1401d38f9a42cfa1ba4a597906ae1ab29b2cb758d4d30811ab6eacbb43704
Opcode Fuzzy Hash: bd699e963fe8de4c67a7c8257b287e99a7e02dd2f4f27d0a432b53307594fd6f
Instruction Fuzzy Hash: 9B32F0B2B085918BE71CCF28D550ABC77A1F755B49F058139DA9A87B88EF3CE850DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB17288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d10a9a08c9553fc75dd486fe246df930773ccb68969d07dba2de239b036bf03
Instruction ID: 975a342c9e5c0544c95ca280ddc81fde0aef2aaa16791dd56dd1731b885e8eda
Opcode Fuzzy Hash: 0d10a9a08c9553fc75dd486fe246df930773ccb68969d07dba2de239b036bf03
Instruction Fuzzy Hash: A6C19DB7B281908FE350CF7AE400A9D3BB1F39878CB519125DF69A7B09D639E645CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB32C38 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f73c881b3a3553f5a7ff7800e561c505383a03d90eedfedfea2aaa439c36d59
Instruction ID: 1c3d5b3d61b55c23ffa89071a8adc4f46bf8e4876fcf59449830de2d3b12162d
Opcode Fuzzy Hash: 0f73c881b3a3553f5a7ff7800e561c505383a03d90eedfedfea2aaa439c36d59
Instruction Fuzzy Hash: 3CA156F3F0898687EB24CE24C4047BE6691EBA2749F554139DAED87785EE3CE841E340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2AEC4 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8441164e717f4c3b9dfec9b5b30af15f411700d7f5e168923845e338acdac59
Instruction ID: b9be65dbc286e8791ce9362a014ee32c562f70a4639610929b9ea765bb446931
Opcode Fuzzy Hash: f8441164e717f4c3b9dfec9b5b30af15f411700d7f5e168923845e338acdac59
Instruction Fuzzy Hash: 5DC1E473B292E04DE302CBB5A4248FD3FB1E71E34DB4A4151EFA656B4ED5289201DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1A2FC Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 1f8397556f6f92a2e09f1a582afcc670c272784be4ec6e57750e3ce663fd6117
Instruction ID: a29bedc303fda7f990af9f4e60583d4e4a1bbca9a021fdced46908285999c957
Opcode Fuzzy Hash: 1f8397556f6f92a2e09f1a582afcc670c272784be4ec6e57750e3ce663fd6117
Instruction Fuzzy Hash: 5B9111A3B1858196EB11CF29D8856FD2721FF96789F441031EF9E87649EE38E606C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1A664 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c05e9b79bc5288d15690930a77abbe716cd69192349639a8f01886128b60fdd
Instruction ID: 11bc4237ab93140a017ac82b9ca1f17b533ad90d6ede9ceeea52825b32e20c81
Opcode Fuzzy Hash: 1c05e9b79bc5288d15690930a77abbe716cd69192349639a8f01886128b60fdd
Instruction Fuzzy Hash: 6181F4A3B18A9195EB10DF22D8807EE7765FB86789F444031DE9D87B99FE38E506C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2B4E0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccac6a6fc52c17975bdf01ed41956b978bcdf51773e7fee01f8e3267e678a629
Instruction ID: 25d9f0b5caf8718294ea26e885627b4f2f5183ac9f6d4c0428c3a85bedf9493e
Opcode Fuzzy Hash: ccac6a6fc52c17975bdf01ed41956b978bcdf51773e7fee01f8e3267e678a629
Instruction Fuzzy Hash: 1A6148A3B181D249EB12CF7485144FE7FB1A71A789B454032CEEA9764AEE3CE106CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB320B0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b695de0b4fe126c4b04c6d9a805711d28f939e9936930a9992a4148e5cc8308d
Instruction ID: 3408c9c4dacf69900a99ae142ea7dd7158f9d550e25782d996f0841de47f49f2
Opcode Fuzzy Hash: b695de0b4fe126c4b04c6d9a805711d28f939e9936930a9992a4148e5cc8308d
Instruction Fuzzy Hash: 795114B3B189514BE7288F28D9147BE3762FB81B49F444135DBA987788EE3DE541DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB32990 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7096bb6435ece9bb217020c7fe681a7486c35baf94dae0ee83bcc8c8b4126687
Instruction ID: 05c3d060fc6babfefe0282d1ac265907f3bf08eb67d467db873b7d7b15e5ab78
Opcode Fuzzy Hash: 7096bb6435ece9bb217020c7fe681a7486c35baf94dae0ee83bcc8c8b4126687
Instruction Fuzzy Hash: 7131D2E2B089859BD718DE16955067EB7D0F756345F048039DB9AC3B41EE7CE056CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2DBDC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction ID: a0abda42923c6c31b83a657013261f79eae73e49a4c1d3e8a1644034f1aa5868
Opcode Fuzzy Hash: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction Fuzzy Hash: 01F0D4E7F9C40742FB6C1C28A81D73910429B9631EF64883AD0FAC62C5FC9DA9816189

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB43234 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c2694c4c45484a776a5ef4ba02f16acbb14a00dc2333e13b7e28313c480a2c
Instruction ID: 2a5a4081025bbadcfc14a0b82f8cc0ad87f783fd97980910ced1f480dc6bff58
Opcode Fuzzy Hash: 49c2694c4c45484a776a5ef4ba02f16acbb14a00dc2333e13b7e28313c480a2c
Instruction Fuzzy Hash: 13A001A5A48842D0E6448F00E864420B320BB92302B444471E1AD812A4BE2CA5008200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1D788 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1D91C

Strings

::$INDEX_ROOT, xrefs: 00007FF6CDB1D80C
::$ATTRIBUTE_LIST, xrefs: 00007FF6CDB1D7B4
::$FILE_NAME, xrefs: 00007FF6CDB1D7EB
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6CDB1D82D
::$BITMAP, xrefs: 00007FF6CDB1D7BF
::$REPARSE_POINT, xrefs: 00007FF6CDB1D843
::$INDEX_ALLOCATION, xrefs: 00007FF6CDB1D7F6
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF6CDB1D801
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6CDB1D822
::$EA, xrefs: 00007FF6CDB1D7D5
::$EA_INFORMATION, xrefs: 00007FF6CDB1D7E0
::$OBJECT_ID, xrefs: 00007FF6CDB1D838
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF6CDB1D817
::$DATA, xrefs: 00007FF6CDB1D7CA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 3d499ea49bf17450a4c7f7e9e99b639bc97c788ae1b9e7f0c51e60c16934483d
Instruction ID: 518ad85d497e99e9601ce3243619fa52cea79742be0ec7a8b227db30454257a3
Opcode Fuzzy Hash: 3d499ea49bf17450a4c7f7e9e99b639bc97c788ae1b9e7f0c51e60c16934483d
Instruction Fuzzy Hash: 8341D6B6B05F45D9EB00CF65E8413A933B9EB49799F440236DAAC837A8FE38D155C384

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB428F0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6CDB42906
GetModuleHandleW.KERNEL32 ref: 00007FF6CDB42913
GetModuleHandleW.KERNEL32 ref: 00007FF6CDB42928
GetProcAddress.KERNEL32 ref: 00007FF6CDB42940
GetProcAddress.KERNEL32 ref: 00007FF6CDB42953
CreateEventW.KERNEL32 ref: 00007FF6CDB4297F
DeleteCriticalSection.KERNEL32 ref: 00007FF6CDB429CB
CloseHandle.KERNEL32 ref: 00007FF6CDB429DD

Strings

WakeAllConditionVariable, xrefs: 00007FF6CDB42946
SleepConditionVariableCS, xrefs: 00007FF6CDB42936
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6CDB4290C
kernel32.dll, xrefs: 00007FF6CDB42921

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6a26e05659341cc81e9cd7bb0af7be51fb7a0dfa131703d094c7fde62e66e3ed
Instruction ID: 52e5521ad55ec929ad0d0a603280e12f27d502364fc3a61be7ae166a3fc50fcd
Opcode Fuzzy Hash: 6a26e05659341cc81e9cd7bb0af7be51fb7a0dfa131703d094c7fde62e66e3ed
Instruction Fuzzy Hash: B12139E8F19A0392FE55DF61E855679B3A0AF4A782F840034C9EEC27A0FE3DE4459314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB26A1C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB270B6

Part of subcall function 00007FF6CDB12004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF6CDB1200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB270C2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB270C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB270D4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB270E6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB270EC

Strings

\\?\, xrefs: 00007FF6CDB26A67, 00007FF6CDB26A76
DXGIDebug.dll, xrefs: 00007FF6CDB26A28
UNC, xrefs: 00007FF6CDB26BCF

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 45f5505ab1f5cde0e38075833752ceb88b49cbde0c886373c145553a0f95317d
Instruction ID: ba4186292253f1f8f984706614f3d941aa60e5138432d44fdf745b5f086f33e7
Opcode Fuzzy Hash: 45f5505ab1f5cde0e38075833752ceb88b49cbde0c886373c145553a0f95317d
Instruction Fuzzy Hash: 9C12B4A3B09B4280EB10DF65D4481AD6371EB42B99F504235DBAD87BEAEF3CD549C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3A320 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB1129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6CDB11396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3A60F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3A615
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3A61B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3A621
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3A627
EndDialog.USER32 ref: 00007FF6CDB3A69A

Strings

GETPASSWORD1, xrefs: 00007FF6CDB3A653
Software\WinRAR SFX, xrefs: 00007FF6CDB3A40B, 00007FF6CDB3A41A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: eb6541408e04b92f6055a624696a755113c91cabbe041a8dcccdbd640fd5f2c6
Instruction ID: f7e65257dad0c0daad17ea3b1c1c250d5ea4703608e6f93a351c641ff77178a2
Opcode Fuzzy Hash: eb6541408e04b92f6055a624696a755113c91cabbe041a8dcccdbd640fd5f2c6
Instruction Fuzzy Hash: 11B1C1A2F19B4296FB00DF64D4842BC3362AF46799F504235DAACA7AD9FE3CE155C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4E530 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB4E6AD

Strings

inf, xrefs: 00007FF6CDB4E5B6
nan(ind), xrefs: 00007FF6CDB4E5E6
nan(snan), xrefs: 00007FF6CDB4E5D0
NAN, xrefs: 00007FF6CDB4E591
NAN(IND), xrefs: 00007FF6CDB4E5DB
nan, xrefs: 00007FF6CDB4E598
NAN(SNAN), xrefs: 00007FF6CDB4E5C5
INF, xrefs: 00007FF6CDB4E5A3

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 77ad88dfeb18cf37fe98ea626b4e60dfb349476b70b20baadc6c0d7550abaa52
Instruction ID: 99363a14f63e58ed14ff0e1abff29a678e999c2372abdd6bd42d8d8c2f2f1b80
Opcode Fuzzy Hash: 77ad88dfeb18cf37fe98ea626b4e60dfb349476b70b20baadc6c0d7550abaa52
Instruction Fuzzy Hash: 0541BFB2B05B4589E705CF25E8417ED37A5EB0A398F404136EEAC83B58EE3CD025C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3F270 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6CDB3F2AF
GetClassNameW.USER32 ref: 00007FF6CDB3F2DC
GetWindowLongPtrW.USER32 ref: 00007FF6CDB3F2FD
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F317
GetObjectW.GDI32 ref: 00007FF6CDB3F332
IsDlgButtonChecked.USER32 ref: 00007FF6CDB3F367
DeleteObject.GDI32 ref: 00007FF6CDB3F370
GetWindow.USER32 ref: 00007FF6CDB3F37E

Strings

STATIC, xrefs: 00007FF6CDB3F2E2

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Window$ButtonCheckedObject$ClassDeleteLongName
String ID: STATIC
API String ID: 781704138-1882779555
Opcode ID: 4307b924ee219b8c1b5088bbf8af2e686e679562b36d393570000ed990c9d7e2
Instruction ID: 30df6fc9e6ebbb2c84c650b9aa548b989940105fa0ed03804942d2bd3ce5c886
Opcode Fuzzy Hash: 4307b924ee219b8c1b5088bbf8af2e686e679562b36d393570000ed990c9d7e2
Instruction Fuzzy Hash: DA31A3A5B0864283FB649F11A554BBA63A1FF8EBC2F454430EDAD87B55FE3CE4068740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB36D60 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6CDB37D7B), ref: 00007FF6CDB36F60
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3705B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB37061
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB37067

Strings

<html>, xrefs: 00007FF6CDB36DF3
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF6CDB36E0C, 00007FF6CDB36E1B
</html>, xrefs: 00007FF6CDB36E52, 00007FF6CDB36E61
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF6CDB36DB5, 00007FF6CDB36DC4

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AllocGlobal
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2721297748-1533471033
Opcode ID: 242a2c3e2241a1f29bc862e95cd4c41139c7aa835e86f3fdfc5cf3c6d479b800
Instruction ID: 2d940df5b1a5ec78135283b6208b46d729b2490796f39cd49445d4737129cfc4
Opcode Fuzzy Hash: 242a2c3e2241a1f29bc862e95cd4c41139c7aa835e86f3fdfc5cf3c6d479b800
Instruction Fuzzy Hash: 248182A2F18A4296FB00EFA5D4402ED3371AF4679AF404135DEAD97699FF38E50AC344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3AD70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF6CDB3AD8E

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Item$Text
String ID: LICENSEDLG
API String ID: 1601838975-2177901306
Opcode ID: fbabcca8789a7abc903b972964f0df5aebba3406a965f94148686bd4d058d337
Instruction ID: 92859dc8dd99996864874066cef513bcaa009d1b1cc72dbc1ba85cfa7983328a
Opcode Fuzzy Hash: fbabcca8789a7abc903b972964f0df5aebba3406a965f94148686bd4d058d337
Instruction Fuzzy Hash: 2941A2A1B08A5283FB149F16E85477D2361AF86F87F650035E9AE87B94EF3CE5469300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2B960 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6CDB2B9BE
GetProcAddress.KERNEL32 ref: 00007FF6CDB2B9D9
GetCurrentProcessId.KERNEL32 ref: 00007FF6CDB2BA76

Part of subcall function 00007FF6CDB2DF3C: GetSystemDirectoryW.KERNEL32 ref: 00007FF6CDB2DD4B

Strings

CryptProtectMemory failed, xrefs: 00007FF6CDB2BA2C
CryptUnprotectMemory failed, xrefs: 00007FF6CDB2BA6D
CryptUnprotectMemory, xrefs: 00007FF6CDB2B9CB
Crypt32.dll, xrefs: 00007FF6CDB2B99C
CryptProtectMemory, xrefs: 00007FF6CDB2B9B4

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: 8935b6f7f66e2c7d47c99ae410095ef48e5be691970eec013db16fbd3fa160c8
Instruction ID: f7e14c3bb02274d75d1bdc0ae762d133bd9f645e91ff3e4638feb035cf5d4662
Opcode Fuzzy Hash: 8935b6f7f66e2c7d47c99ae410095ef48e5be691970eec013db16fbd3fa160c8
Instruction Fuzzy Hash: 15313BA5B0DA0392FA149F16E86817577A0EF4BB96F054135C9ED837A8FF3CE5418308

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB386B8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB38C96
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB38CA2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB38CAE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB38CBA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB38CC0

Strings

, xrefs: 00007FF6CDB38935
, xrefs: 00007FF6CDB3879E

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 2228e09d7393a61c849b8046ce96cfb0ac8265f0c0e8a896f2020ca0e95e1f48
Instruction ID: 7597de7f4e7f8f94201d71311e9c1f96b6d381c5379f52b80fc9c5f1c9be2b0c
Opcode Fuzzy Hash: 2228e09d7393a61c849b8046ce96cfb0ac8265f0c0e8a896f2020ca0e95e1f48
Instruction Fuzzy Hash: AAF1F4EAF15B4282EE009F68D4441BCA361AB46B99F505232CABD937D9FF7CE180D341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB456CC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6CDB4586A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CDB45B8D
abort.LIBCMT ref: 00007FF6CDB45BC1

Strings

csm, xrefs: 00007FF6CDB457B1
csm, xrefs: 00007FF6CDB45891
csm, xrefs: 00007FF6CDB45813

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 00493aba26876e22a0c058797fcb2f8350e9957e1905243f87ce4940491e038b
Instruction ID: b018f418c54fa28681a908cba9e9661de1f077146eb3fc983a53d2d4e5c95eac
Opcode Fuzzy Hash: 00493aba26876e22a0c058797fcb2f8350e9957e1905243f87ce4940491e038b
Instruction Fuzzy Hash: D3E19DB3A08B828AE760DF28D5803AD77E0EB46759F144135DEAD97796EF38E481C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB24F48 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB24E34: SysAllocString.OLEAUT32 ref: 00007FF6CDB24E6F

VariantClear.OLEAUT32 ref: 00007FF6CDB25135

Strings

Name, xrefs: 00007FF6CDB25109
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6CDB25027
ROOT\CIMV2, xrefs: 00007FF6CDB24F8B
WQL, xrefs: 00007FF6CDB2503A
Windows 10, xrefs: 00007FF6CDB2511A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: eb3affe9549700a57cd0e6de4142855619e953e3a19f5c412c6105883a6025ad
Instruction ID: d6286d67f53dee69aab51a06d224d317d2f5b2c0a4cfda3db3bb35073fdc0224
Opcode Fuzzy Hash: eb3affe9549700a57cd0e6de4142855619e953e3a19f5c412c6105883a6025ad
Instruction Fuzzy Hash: CA714AB6B14B0585EB20CF25E8905AD77B0FB89B99B041136EE9E87B64EF38D544C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB471CC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6CDB473D3,?,?,?,00007FF6CDB4513E,?,?,?,00007FF6CDB450F9), ref: 00007FF6CDB47251
GetLastError.KERNEL32(?,?,00000000,00007FF6CDB473D3,?,?,?,00007FF6CDB4513E,?,?,?,00007FF6CDB450F9), ref: 00007FF6CDB4725F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6CDB473D3,?,?,?,00007FF6CDB4513E,?,?,?,00007FF6CDB450F9), ref: 00007FF6CDB47289
FreeLibrary.KERNEL32(?,?,00000000,00007FF6CDB473D3,?,?,?,00007FF6CDB4513E,?,?,?,00007FF6CDB450F9), ref: 00007FF6CDB472CF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6CDB473D3,?,?,?,00007FF6CDB4513E,?,?,?,00007FF6CDB450F9), ref: 00007FF6CDB472DB

Strings

api-ms-, xrefs: 00007FF6CDB47271

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 4df90cf2703d265e089d489e86a26be228324eecb5904a81695c01ec3642baa2
Instruction ID: 15f818238e75237c4bed95e9eb54da44daae605ad6b4170c1e02299fe1b0577a
Opcode Fuzzy Hash: 4df90cf2703d265e089d489e86a26be228324eecb5904a81695c01ec3642baa2
Instruction Fuzzy Hash: AE31B2A1B1A64281EE11EF16A8006756394FF4BBA1F194535EDAD8B350FF3CE044CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB414E4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6CDB41453,?,?,?,00007FF6CDB4180A), ref: 00007FF6CDB4150B
GetProcAddress.KERNEL32(?,?,?,00007FF6CDB41453,?,?,?,00007FF6CDB4180A), ref: 00007FF6CDB41528
GetProcAddress.KERNEL32(?,?,?,00007FF6CDB41453,?,?,?,00007FF6CDB4180A), ref: 00007FF6CDB41544

Strings

AcquireSRWLockExclusive, xrefs: 00007FF6CDB4151E
KERNEL32.DLL, xrefs: 00007FF6CDB41504
ReleaseSRWLockExclusive, xrefs: 00007FF6CDB41533

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: d1d93a9dcdc2cb5efd1991c7952d47fb0bb63b89991576fd6ee39d9729fbea1d
Instruction ID: 4b78fb2c7f88c54e57024ac3aacf2d5d71f348872a722489308de816a9579eab
Opcode Fuzzy Hash: d1d93a9dcdc2cb5efd1991c7952d47fb0bb63b89991576fd6ee39d9729fbea1d
Instruction Fuzzy Hash: AA111BE4F19B0291FE65CF10E9412B462A16F0A7D6F495536C8FEC6754FE3CE4849320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2EC94 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB251B4: GetVersionExW.KERNEL32 ref: 00007FF6CDB251E5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6CDB15ABC), ref: 00007FF6CDB2ECFC
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6CDB15ABC), ref: 00007FF6CDB2ED08
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6CDB15ABC), ref: 00007FF6CDB2ED18
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6CDB15ABC), ref: 00007FF6CDB2ED26
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6CDB15ABC), ref: 00007FF6CDB2ED34
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6CDB15ABC), ref: 00007FF6CDB2ED75

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 10ffd27a1d0995ee2e88e313f1990b1d6389c8f138e56aee93b4f6506c4752f5
Instruction ID: aad7d7460878a66f45bd1533592b30251c72006e86b745935fe123b571a74678
Opcode Fuzzy Hash: 10ffd27a1d0995ee2e88e313f1990b1d6389c8f138e56aee93b4f6506c4752f5
Instruction Fuzzy Hash: 0E518CB2B106518BEB14CFBAD4451AC77B1F748B89B64403AEE5D97B58EF38E542C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2EF80 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6CDB2EFE4

Part of subcall function 00007FF6CDB251B4: GetVersionExW.KERNEL32 ref: 00007FF6CDB251E5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6CDB2F006
FileTimeToSystemTime.KERNEL32 ref: 00007FF6CDB2F012
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6CDB2F022
SystemTimeToFileTime.KERNEL32 ref: 00007FF6CDB2F030
SystemTimeToFileTime.KERNEL32 ref: 00007FF6CDB2F03E

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 815f6f964df36b0098ae6083f908862c9538aad2c9db9e10fb847501d330df7b
Instruction ID: 68d0684d22f6845cb92cfae6a7e68a3f8397aa90ce4b921600232f4a9ecf1413
Opcode Fuzzy Hash: 815f6f964df36b0098ae6083f908862c9538aad2c9db9e10fb847501d330df7b
Instruction Fuzzy Hash: 913137A6B10A51CEFB04CFB5E8811AC7770FB08759B54502AEE5EA7A58EF38D895C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB278C8 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB27C3C

Strings

rar, xrefs: 00007FF6CDB27A4B, 00007FF6CDB27A5A, 00007FF6CDB27B17, 00007FF6CDB27B2C
sfx, xrefs: 00007FF6CDB279A3, 00007FF6CDB279B2
exe, xrefs: 00007FF6CDB2795F, 00007FF6CDB2796E
.rar, xrefs: 00007FF6CDB27919, 00007FF6CDB27928

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 3591aa7f6208d0639e3ddd753617b5bd59cac7804775e7520afa3375969aa5d0
Instruction ID: d143960074f6a6bb75407f75ecd5b18662f4d5d27ac9cdf72f577bd11d94804d
Opcode Fuzzy Hash: 3591aa7f6208d0639e3ddd753617b5bd59cac7804775e7520afa3375969aa5d0
Instruction Fuzzy Hash: 77A1B2A7F04A4640EA00AF25D8592BC2361BF46BAAF504235DEBD876D9FF3CE545C384

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB45BC8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6CDB45C38

Part of subcall function 00007FF6CDB450F0: abort.LIBCMT ref: 00007FF6CDB45103

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6CDB45C83
abort.LIBCMT ref: 00007FF6CDB45EB1

Strings

RCC, xrefs: 00007FF6CDB45C54
MOC, xrefs: 00007FF6CDB45C4C

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 88090030e3e97ad46f4af9f464068a64c6ebcab78511bfe14db65436bf53bfce
Instruction ID: e75c3953be77aa45b58e69e16f365bb76232e04d08aa526275fa4c9df82af44b
Opcode Fuzzy Hash: 88090030e3e97ad46f4af9f464068a64c6ebcab78511bfe14db65436bf53bfce
Instruction Fuzzy Hash: 03918EB3B08B918AE710CF65E9402AD7BB0FB05789F144129EE9D97B59EF38D195C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB44E60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6CDB44E8B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6CDB44F20
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB42E3E), ref: 00007FF6CDB44F6F

Strings

f, xrefs: 00007FF6CDB44E9E
csm, xrefs: 00007FF6CDB44F06

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 13b92defcfc250779d77d005163ae440afffe3cbe9b13642e80169b4fe78ec7a
Instruction ID: ff5faf485f1411752294129a551242b91422ffc90ef329777af54ebd3eb98894
Opcode Fuzzy Hash: 13b92defcfc250779d77d005163ae440afffe3cbe9b13642e80169b4fe78ec7a
Instruction Fuzzy Hash: 0651D176F196028AEB14CF15E404A397795FB42B89F518138EEAE87788FF78E841C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1CE98 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6CDB1CFF5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1D089
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1D08F

Part of subcall function 00007FF6CDB1DDBC: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6CDB1CF03), ref: 00007FF6CDB1DDDF
Part of subcall function 00007FF6CDB1DDBC: GetLastError.KERNEL32 ref: 00007FF6CDB1DE40
Part of subcall function 00007FF6CDB1DDBC: CloseHandle.KERNEL32 ref: 00007FF6CDB1DE53

Strings

SeSecurityPrivilege, xrefs: 00007FF6CDB1CEF7
SeRestorePrivilege, xrefs: 00007FF6CDB1CF16

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: d0d67da842b53d88caa0fb31aad66ae310ec22e65d8544d4c8da3ae001d23120
Instruction ID: 23259fe786b139b8078d4641dd93d087d703600f77707536e2b8276de5c2e5ce
Opcode Fuzzy Hash: d0d67da842b53d88caa0fb31aad66ae310ec22e65d8544d4c8da3ae001d23120
Instruction Fuzzy Hash: A751E0A2F1864296FB00DF65D8552BE27B1AF467A6F000139DEBD93696FE3CE485C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB37A08 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6CDB37A4F
GetWindowRect.USER32 ref: 00007FF6CDB37AA0
ShowWindow.USER32 ref: 00007FF6CDB37B76
ShowWindow.USER32 ref: 00007FF6CDB37BA3

Strings

RarHtmlClassName, xrefs: 00007FF6CDB37B2B

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 346521eec488aea3dd98db297d9d00325930dfaab4f0cca47ace2342e5ac448a
Instruction ID: 8fadbc8797741a1e61a45b27ed631a78067acda1200d1230f87272f2fdff996d
Opcode Fuzzy Hash: 346521eec488aea3dd98db297d9d00325930dfaab4f0cca47ace2342e5ac448a
Instruction Fuzzy Hash: 5B5171A2B0878287EA249F25E45437AB3A0FF8A785F004435EEDE87B55EF3CE4458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3FBEC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6CDB3FC23
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6CDB3FC9C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB3FCFB

Strings

sfxcmd, xrefs: 00007FF6CDB3FC1C
sfxpar, xrefs: 00007FF6CDB3FC95

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: dbcde95ab6725992720ca3b71e7206b4bc63de45d9fe7100070882d44839ee44
Instruction ID: d2da5d3d5a7afec5e7d9cf23fb288ff1ce48f418b3d5db1afcdea9f90538847c
Opcode Fuzzy Hash: dbcde95ab6725992720ca3b71e7206b4bc63de45d9fe7100070882d44839ee44
Instruction Fuzzy Hash: 3D3194B2B14A0585FF04CF69D8841AC33B1FB4AB99F440131DEAD977A9EE38E085C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3FDB4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF6CDB3FE40
REPLACEFILEDLG, xrefs: 00007FF6CDB3FE14, 00007FF6CDB3FE79

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 6b6936d8af85ed07d69075739862379e0c7e38109e360d5c84d26f77dfe1686f
Instruction ID: 06ff475cf39f463487cfbf74da979e779dad9330bb58433df6c88a9e3dd140d7
Opcode Fuzzy Hash: 6b6936d8af85ed07d69075739862379e0c7e38109e360d5c84d26f77dfe1686f
Instruction Fuzzy Hash: AC2107E5B08B47A2FA109F5AE84857423A0EF4AB86F554036D9EDC7361FE3CE4899310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4BE90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6CDB4BEB0
GetProcAddress.KERNEL32 ref: 00007FF6CDB4BEC6
FreeLibrary.KERNEL32 ref: 00007FF6CDB4BEEB

Strings

CorExitProcess, xrefs: 00007FF6CDB4BEBF
mscoree.dll, xrefs: 00007FF6CDB4BEA7

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0ccc62a4b668c9744bf67573bebacabab741173be5aa4654eff986f512ea0f65
Instruction ID: ed32219e506e43cf57f5129a67835b27e874f6f610dfc392d0f63bef1a55ce43
Opcode Fuzzy Hash: 0ccc62a4b668c9744bf67573bebacabab741173be5aa4654eff986f512ea0f65
Instruction Fuzzy Hash: 8DF062A5B19A4291EF44CF11F4402797360EF8DB92F441436EAAF86664FF3CE484C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB544A0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB544E5

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 906a413d4f951bb5daa4ab1a7393b71f920d6b37417606cc76959ffd00c7350e
Instruction ID: ddc488703010c7109e3431784161b0d7ea705e3cc367899c484dfeaa893ee65b
Opcode Fuzzy Hash: 906a413d4f951bb5daa4ab1a7393b71f920d6b37417606cc76959ffd00c7350e
Instruction Fuzzy Hash: EA81F0A2F1860299F7209F65D8406BDB7A0BB46B8AF404139CEAE93795FF3CE441D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB23B08 Relevance: 7.7, APIs: 5, Instructions: 163filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6CDB23BCB
CreateFileW.KERNEL32 ref: 00007FF6CDB23C34
SetFileTime.KERNEL32 ref: 00007FF6CDB23CFC
CloseHandle.KERNEL32 ref: 00007FF6CDB23D06
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB23D3C

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: bbf8a6a1d963e036ce9f3ad4a27b3a79830c3b4cf1ffc0a6727f353e72a6fe12
Instruction ID: 343e75555c5bb4e8c05812a16b0ee963aad07b8628fc92b2748633fbde6fc8c4
Opcode Fuzzy Hash: bbf8a6a1d963e036ce9f3ad4a27b3a79830c3b4cf1ffc0a6727f353e72a6fe12
Instruction Fuzzy Hash: 1551AFA3B18B4249FB549F65E8482BD33B1AF4A7ADF044639DEAD86794FE38D0458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB53E14 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6CDB54647), ref: 00007FF6CDB53E71
WideCharToMultiByte.KERNEL32 ref: 00007FF6CDB53F4D
WriteFile.KERNEL32 ref: 00007FF6CDB53F73
WriteFile.KERNEL32 ref: 00007FF6CDB53FB2
GetLastError.KERNEL32 ref: 00007FF6CDB53FEA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 6101d93f35efaf94d4ffef1e77f73be41993fc0ca8b2b471f15e64abfad4bc84
Instruction ID: 8225076d40a31eb9272c838b00d295faa48049ed248396b4e3bc2b26c45a011a
Opcode Fuzzy Hash: 6101d93f35efaf94d4ffef1e77f73be41993fc0ca8b2b471f15e64abfad4bc84
Instruction Fuzzy Hash: B751AFB6F14A5589E710CF65D4443AC7BB0FB46799F088135DEAA87B98EF38D145C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB41CE0 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6CDB24E04), ref: 00007FF6CDB41D67
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6CDB24E04), ref: 00007FF6CDB41DE9
SysAllocString.OLEAUT32 ref: 00007FF6CDB41DF6

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 317e4e248690e5d91fe64e49538e69ee3e6a698b8574c230241ef5e73fc13709
Instruction ID: 5ef5b6e9fb26890d291a65c76a17f39207de0892755e561aa3e37790a0f84f61
Opcode Fuzzy Hash: 317e4e248690e5d91fe64e49538e69ee3e6a698b8574c230241ef5e73fc13709
Instruction Fuzzy Hash: B141C0A5F0864689EB14DF22D8003B96290EF0ABE6F544635EABDC77D5FE3CE1519300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4F2F4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6CDB4F416

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8db8589391796ed88bbe5435f360038518681dd8c75e5d23eac09e8759673d6a
Instruction ID: 7a1bcb309a8dd1920e4a9975728ce582be403a4604dd3b12e8850e60d16a755e
Opcode Fuzzy Hash: 8db8589391796ed88bbe5435f360038518681dd8c75e5d23eac09e8759673d6a
Instruction Fuzzy Hash: E641D4A2B09A4281FE17DF16982457962D5BF0ABD1F194535DEBECB788FE3CE4418300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB555B8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6CDB555DF
_set_statfp.LIBCMT ref: 00007FF6CDB555FA
_set_statfp.LIBCMT ref: 00007FF6CDB55616
_set_statfp.LIBCMT ref: 00007FF6CDB55652

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: a9f20b5bdc70fba6b7f87d7fcc2eea3aa20e6d71352814f05fe0213a93bc9760
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 521160F6F1868741FA651DA5E68637E20D16F5A3B3E484234E6FE8A5E6BE2CB4404300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB3FD04 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6CDB3FD21
GetMessageW.USER32 ref: 00007FF6CDB3FD38
TranslateMessage.USER32 ref: 00007FF6CDB3FD43
DispatchMessageW.USER32 ref: 00007FF6CDB3FD4E
WaitForSingleObject.KERNEL32 ref: 00007FF6CDB3FD5C

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: f3ee1a4d7667bfc3329b1c6b60f01b2bd3385d85cd62092d5101b818b94d2f82
Instruction ID: 7101ec9c4be7f1e53ecf5e110322028b7351b2e1a1a61f0b39ea2d00fb74aed1
Opcode Fuzzy Hash: f3ee1a4d7667bfc3329b1c6b60f01b2bd3385d85cd62092d5101b818b94d2f82
Instruction Fuzzy Hash: 67F04FA1B2844793F7108F21E499A362351FFAA706F541030E59E86C94AF3CD149D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4613C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6CDB46166
abort.LIBCMT ref: 00007FF6CDB463CA

Strings

csm, xrefs: 00007FF6CDB4618B
csm, xrefs: 00007FF6CDB462FA

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: f6806ac82c6ffe397d3272adf1ae55b80e26ac65e8e1139f79223806dd7c3d0a
Instruction ID: d236b88131b8c3d3bbb604975abf4beab91ffc6fee640f9ab9e5eb4da49541c2
Opcode Fuzzy Hash: f6806ac82c6ffe397d3272adf1ae55b80e26ac65e8e1139f79223806dd7c3d0a
Instruction Fuzzy Hash: EC7181B2B086C286DB60CF2990507BD7BA1EB56F86F149135DEDC87A89EF3CD4918740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB47FD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB47FFB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB481CD

Strings

*, xrefs: 00007FF6CDB48101
, xrefs: 00007FF6CDB48156

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 3dc0502f1828c80ed1bcbd4cba6bb1413543bd002d16f2013c37d4827c9e63c9
Instruction ID: b6efe9fe5dd20e8556960b5a3c31bac58c77d9ae4cf4167ad87fc586d6066244
Opcode Fuzzy Hash: 3dc0502f1828c80ed1bcbd4cba6bb1413543bd002d16f2013c37d4827c9e63c9
Instruction Fuzzy Hash: F55165FAA1C2428AEB64CE28904537C77A1FB0BB0AF181137C6EAC5295EF7CD485C601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB51638 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6CDB516AB
MultiByteToWideChar.KERNEL32 ref: 00007FF6CDB51774
GetStringTypeW.KERNEL32 ref: 00007FF6CDB5178E

Strings

$%s, xrefs: 00007FF6CDB5163A

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 5624f879a3904104de112aaa6330f4fecd41067ff92eb9f6dd7dbde445aaa44f
Instruction ID: e48374680f267f0868eb6bb6675abcefe4365d3e43224ced14fe6fb30b1b93ba
Opcode Fuzzy Hash: 5624f879a3904104de112aaa6330f4fecd41067ff92eb9f6dd7dbde445aaa44f
Instruction Fuzzy Hash: 7341A7A2B14B4249EB508F25D8006B97395FB56BE9F484636DEAD877C4FF7CE4458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB46580 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB450F0: abort.LIBCMT ref: 00007FF6CDB45103

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6CDB4662A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6CDB46656

Strings

csm, xrefs: 00007FF6CDB46756

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 9e52690079eca02a983d23d1df66cc5f2ab73f298d872e146c8e3cff99829fa2
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: FF513BB7718A8286D620EF15A55026E77A4FB8AB91F100138DF9D87B56EF3CE461CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB54240 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6CDB54326
WriteFile.KERNEL32 ref: 00007FF6CDB54359
GetLastError.KERNEL32 ref: 00007FF6CDB5437B

Strings

U, xrefs: 00007FF6CDB54304

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: e5cb2a7e434c55033be8c91b461b53ee1f7c27837a98993c2b5864274fd51453
Instruction ID: da16d474d810d6e602beb96f060ebbf6f6475ac954d19c0ceac771a27389dcef
Opcode Fuzzy Hash: e5cb2a7e434c55033be8c91b461b53ee1f7c27837a98993c2b5864274fd51453
Instruction Fuzzy Hash: D841E262B28A4582EB208F65E8047BAB7A0FB89795F844035EE9DC7798FF7CD441C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB38F90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6CDB38FB9
GetObjectW.GDI32 ref: 00007FF6CDB38FE7
ReleaseDC.USER32 ref: 00007FF6CDB3909B

Strings

, xrefs: 00007FF6CDB39033

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 8c6f63196968818d9ccf2e220cf7cdafcf28a736d7c0a6b15f755b38d188b54a
Instruction ID: c7b87f3c51b9fa54de85c0173e0082b56637444b80704b68fa96a844c66f5e7f
Opcode Fuzzy Hash: 8c6f63196968818d9ccf2e220cf7cdafcf28a736d7c0a6b15f755b38d188b54a
Instruction Fuzzy Hash: 46316F7570874297EB04DF12B80966AB760FB8AFD6F014439ED9A87B64DE3CE049CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2E7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF6CDB3305F,?,?,00001000,00007FF6CDB1E4D5), ref: 00007FF6CDB2E827
CreateSemaphoreW.KERNEL32(?,?,?,00007FF6CDB3305F,?,?,00001000,00007FF6CDB1E4D5), ref: 00007FF6CDB2E837
CreateEventW.KERNEL32(?,?,?,00007FF6CDB3305F,?,?,00001000,00007FF6CDB1E4D5), ref: 00007FF6CDB2E850

Strings

Thread pool initialization failed., xrefs: 00007FF6CDB2E86C

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 52fac21d231d2c480d1a8b9006b644d15e58b09438c2a4cb32a5e467e508583a
Instruction ID: 22f03b1fcdea08c2e17dd3465e54ae440a1ddd1420b0b617fe0e947d0eefb29f
Opcode Fuzzy Hash: 52fac21d231d2c480d1a8b9006b644d15e58b09438c2a4cb32a5e467e508583a
Instruction Fuzzy Hash: AC21E7B3B1564186F7408F25D0483BD32A1EB99B0EF188034CA9D8A295FF7ED445C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB384C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6CDB384CC
GetDeviceCaps.GDI32 ref: 00007FF6CDB384DD
ReleaseDC.USER32 ref: 00007FF6CDB384EA

Strings

, xrefs: 00007FF6CDB384F0

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: 14cc15b763bc5c924532feb7c260d418e0d1f0070544accd59e29c3ee95e963e
Instruction ID: 6a680df1cb5059e04fa75d2225cf0bc67abeb26c4564f64b612591ae4117d004
Opcode Fuzzy Hash: 14cc15b763bc5c924532feb7c260d418e0d1f0070544accd59e29c3ee95e963e
Instruction Fuzzy Hash: 76E0C260B0864293FB086FB6B58A03A2261EF4CBD1F168039FA6F87794EE3CC4C44310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1D160 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF6CDB1D424
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1D50C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1D512
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1D518

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 05accffe0705a617afa76a2def03445ee522539e958a6478a8d2aa2e05c55eea
Instruction ID: 48126b0dfd6a6005dc538477b0e716e648f36ddcf3319590e78a551518d8670b
Opcode Fuzzy Hash: 05accffe0705a617afa76a2def03445ee522539e958a6478a8d2aa2e05c55eea
Instruction Fuzzy Hash: 6FA1C3A2B18A8281EE10DF25E8442BE6361FF86785F405135EAED87AD9FF3CE544C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB304B8 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6CDB3056C
SetLastError.KERNEL32 ref: 00007FF6CDB30607

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7c247595c32359b78815612379d1a90ffeafe352fecc5b783f5d4d00929ec120
Instruction ID: 4b51d20c7ff188ca4d766c35697fe2a1be74b680acbfe8dd1da4e29fcec9c1a0
Opcode Fuzzy Hash: 7c247595c32359b78815612379d1a90ffeafe352fecc5b783f5d4d00929ec120
Instruction Fuzzy Hash: BC5191B2B14A4299FB00DF65D4452FD2361EF86B9AF404236DAAC9779AFE28D244C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB39C70 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6CDB39C9C
GetLastError.KERNEL32 ref: 00007FF6CDB39CE8
CreateDirectoryW.KERNEL32 ref: 00007FF6CDB39DF0
LocalFree.KERNEL32 ref: 00007FF6CDB39E00

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 86d36767b0cc527e88235088377ea717e8b20339b9d95eb3b4ada9a24dd54104
Instruction ID: 3492869f4e49eb7fa258595918516bdb5ea13536ad50e0a1a61e8f030bc67d0c
Opcode Fuzzy Hash: 86d36767b0cc527e88235088377ea717e8b20339b9d95eb3b4ada9a24dd54104
Instruction Fuzzy Hash: EC515F72718B4287EB408F22E4453AE73A4FB86B85F900139EA9E97B54EF3CD504CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4DA3C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB4DA8F
WideCharToMultiByte.KERNEL32 ref: 00007FF6CDB4DB61
GetLastError.KERNEL32 ref: 00007FF6CDB4DB84
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB4DBB6

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: 82d03ac598dba5566f38ba3ef07ab1b6c4dd0050ecfbb41a39305acade8eeb31
Instruction ID: 9b2d6819be467809afbd58bbb8c28485bc4353e95d300f7c46efb8b64e46fa80
Opcode Fuzzy Hash: 82d03ac598dba5566f38ba3ef07ab1b6c4dd0050ecfbb41a39305acade8eeb31
Instruction Fuzzy Hash: 2D4181B2B0D64286FB65DF14904037966A0EF86BA2F148135DBED87AD9FE3CD8418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB23990 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6CDB239CD
MoveFileW.KERNEL32 ref: 00007FF6CDB23A44
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB23AFB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB23B01

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 6242fedc446a94df65000cb55770fad86ef3df8a6d2fbd1c1d74b21590054829
Instruction ID: 682add6d9500418c457c4b96bfea51473a87f3c7ea51fc8421eb752081330e95
Opcode Fuzzy Hash: 6242fedc446a94df65000cb55770fad86ef3df8a6d2fbd1c1d74b21590054829
Instruction Fuzzy Hash: 4941BFA3F14B5284FB04DF75E8491AC3371BF46BA9B405239DEADA6B99EF78D041C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB50A58 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB4C33B), ref: 00007FF6CDB50A71
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB4C33B), ref: 00007FF6CDB50AD3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB4C33B), ref: 00007FF6CDB50B0D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6CDB4C33B), ref: 00007FF6CDB50B37

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 68d7ffff6da6bb5c30f515412ce5e96b1fa060087e9a7e21ee0192a4c2e09fbd
Instruction ID: fcf1a81e27b5e6522f00b2217d596366ae336b20a2a8f057937de02afa7a12fd
Opcode Fuzzy Hash: 68d7ffff6da6bb5c30f515412ce5e96b1fa060087e9a7e21ee0192a4c2e09fbd
Instruction Fuzzy Hash: BA215171F18B5281EA609F12A441029B6A4FB59BD5B085235DEEEA3BA4FF3CE4528704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4D320 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6CDB47E08,?,?,?,00007FF6CDB49C15), ref: 00007FF6CDB4D32A
SetLastError.KERNEL32(?,?,?,00007FF6CDB47E08,?,?,?,00007FF6CDB49C15), ref: 00007FF6CDB4D392
SetLastError.KERNEL32(?,?,?,00007FF6CDB47E08,?,?,?,00007FF6CDB49C15), ref: 00007FF6CDB4D3A8
abort.LIBCMT ref: 00007FF6CDB4D3AE

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: e5f34902ae44aa9bcef1dbed71889213d1179b49027ba2e2f6132b401c78f961
Instruction ID: a131457124113df61b6e8e826323cb1bfaa20ef280a9367af9e429f7231c2cba
Opcode Fuzzy Hash: e5f34902ae44aa9bcef1dbed71889213d1179b49027ba2e2f6132b401c78f961
Instruction Fuzzy Hash: 62015AA4F0D60342FA59EF25A666ABD61A15F5A792F080539D9FEC77C6FE2CF8014200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB38470 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6CDB38478
GetDeviceCaps.GDI32 ref: 00007FF6CDB3848E
GetDeviceCaps.GDI32 ref: 00007FF6CDB384A2
ReleaseDC.USER32 ref: 00007FF6CDB384B3

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 1f2ccc2ca8e2667e2053ff2e408bff2bb2b796922e999d64dde0a3f5810067ed
Instruction ID: 2943b53911a03cd158b886613ab587b926d1d40690f8a4db85f3b0038d7ab475
Opcode Fuzzy Hash: 1f2ccc2ca8e2667e2053ff2e408bff2bb2b796922e999d64dde0a3f5810067ed
Instruction Fuzzy Hash: A3E0EDA0F0960293FF086F7168591352650AF4AB43F194439D8AFCA360FD3CE0858620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB1E304 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB1E501

Strings

DXGIDebug.dll, xrefs: 00007FF6CDB1E312

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 42bd54e091842a7090a732cbb0766704ba53950ab79fd5ab8a5c07da9445c8d8
Instruction ID: 2075d4cb68c90b1014965e7fb1c6ad549c122179634db38f7b9baf1edac9d70f
Opcode Fuzzy Hash: 42bd54e091842a7090a732cbb0766704ba53950ab79fd5ab8a5c07da9445c8d8
Instruction Fuzzy Hash: FF718BB2B14B8186EB14CF25E8443ADB3A9FB557C4F504226DBAD47B95EF78E061C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4E0D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB4E117

Strings

gfff, xrefs: 00007FF6CDB4E242
e+000, xrefs: 00007FF6CDB4E1BF

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 923e1f928a93e1474c09cb05b2892164f2290ef7a7d4072d9a8f318e01b08a35
Instruction ID: 739d904a59a13747cb46623e56a3635d4398bb6ef19eab77db3b34b5cf8f076e
Opcode Fuzzy Hash: 923e1f928a93e1474c09cb05b2892164f2290ef7a7d4072d9a8f318e01b08a35
Instruction Fuzzy Hash: D351F5A2B187C586E765CF3999413696B91EB82B91F08D231D6ECC7BD5EF2CE444C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB293B8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB29558: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6CDB29596

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB2954C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6CDB29552

Strings

SIZE, xrefs: 00007FF6CDB293F3

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 73801b104769cce3368770b8aa400d6f5c3579c62427d1f12b055830ad3cb4e2
Instruction ID: 03e825fdb3fd83e23435c13e26501012434fe2da3538dc57c29f5a0e7794f069
Opcode Fuzzy Hash: 73801b104769cce3368770b8aa400d6f5c3579c62427d1f12b055830ad3cb4e2
Instruction Fuzzy Hash: 5E418FA2B6878296EE10DF64E4453BD6350AF8679AF404232EAEC866D6FF7CD540C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4C1A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CDB4C1CA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6CDB42BB5), ref: 00007FF6CDB4C1EB

Strings

C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe, xrefs: 00007FF6CDB4C1D9

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe
API String ID: 3307058713-2267444296
Opcode ID: abdbd848dd020dfc8427fe30ed957358b57952be7c8c307bd8df1df060e6b93e
Instruction ID: a61763b948ef1646aa43e4b7469192bed4003b7cbed11d2c12f4eb154326f9ce
Opcode Fuzzy Hash: abdbd848dd020dfc8427fe30ed957358b57952be7c8c307bd8df1df060e6b93e
Instruction Fuzzy Hash: A541B0B6B08A429AEB54DF22A4400BD77A4FF46BC5B454035EEAD87B85EF3CE441C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB39A20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CDB1255C: GetDlgItem.USER32 ref: 00007FF6CDB125AC
Part of subcall function 00007FF6CDB1255C: SetDlgItemTextW.USER32 ref: 00007FF6CDB125C8

EndDialog.USER32 ref: 00007FF6CDB39B04
SetDlgItemTextW.USER32 ref: 00007FF6CDB39B8A

Strings

ASKNEXTVOL, xrefs: 00007FF6CDB39A52

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: Item$Text$Dialog
String ID: ASKNEXTVOL
API String ID: 2638039312-3402441367
Opcode ID: 7989dff3c50c56c6cc139d7f67db034519f6fc83464fb887bf4ef7d5e981a364
Instruction ID: f352cd3047139646a26bae6c38f2cd76dfd9c114c8bc7fef3b5ff6ebbbddb34a
Opcode Fuzzy Hash: 7989dff3c50c56c6cc139d7f67db034519f6fc83464fb887bf4ef7d5e981a364
Instruction Fuzzy Hash: 124194A2B1868282FE149F16E4942BA2761AF87BC6F540035DEEDC77A5FF3CE4459340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB295E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6CDB2969A

Part of subcall function 00007FF6CDB30E3C: WideCharToMultiByte.KERNEL32 ref: 00007FF6CDB30E6D

Strings

$%s, xrefs: 00007FF6CDB29687
@%s, xrefs: 00007FF6CDB2967E

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 61aa15ec8efa5e091db1290c2b1bb03b7e81f9921c688364f82932fb47c38b92
Instruction ID: ef1d0b3c9e667a5aa924860944270b363bba70e80ede52822107dad7937a67fd
Opcode Fuzzy Hash: 61aa15ec8efa5e091db1290c2b1bb03b7e81f9921c688364f82932fb47c38b92
Instruction Fuzzy Hash: 2C31ADB3B18A5696EE108F66E4442EA23A0FB46789F405032DE9D97759FF3CE505C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB4E9E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6CDB4EA56
GetFileType.KERNEL32 ref: 00007FF6CDB4EA6C

Strings

@, xrefs: 00007FF6CDB4EA97

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 8d8ea2d4e5909bed338133a5bd192c156cb8ff3d1b8b72df778ce2b2be1c1e51
Instruction ID: dc823184b93a565f5202960b26ab688f77d6d80856c6925212f54eabd95070d0
Opcode Fuzzy Hash: 8d8ea2d4e5909bed338133a5bd192c156cb8ff3d1b8b72df778ce2b2be1c1e51
Instruction Fuzzy Hash: 2921A2E2B09A8285EB64CF28D4901396651FB86775F285335E6FE877D4EE3CD881C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB43F58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6CDB41C1E), ref: 00007FF6CDB43F9C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6CDB41C1E), ref: 00007FF6CDB43FE2

Strings

csm, xrefs: 00007FF6CDB43FCF

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f0616bcadced5d2513a00ddc48c4db8134eaf896c9b096a64d0c4ff957e2c77c
Instruction ID: 22e2b4778724404128d8ead8c070996780ecbcce3773055417e4e18f96f961b8
Opcode Fuzzy Hash: f0616bcadced5d2513a00ddc48c4db8134eaf896c9b096a64d0c4ff957e2c77c
Instruction Fuzzy Hash: 7B116672A18B8182EB21CF15E440269B7A0FF99B85F184230EEDD47B68EF3CC951CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2E9C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6CDB2E8CB,?,?,?,00007FF6CDB2464A,?,?,?), ref: 00007FF6CDB2E9CF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6CDB2E8CB,?,?,?,00007FF6CDB2464A,?,?,?), ref: 00007FF6CDB2E9DA

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6CDB2E9E4

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 0be3f9b4d8bd4fe87441163ba80d67581a7a6799d90b566deab43d0283165153
Instruction ID: 752cc86a8d0f928303600165333928aa97b141cae88499fa54d9129ed76273a8
Opcode Fuzzy Hash: 0be3f9b4d8bd4fe87441163ba80d67581a7a6799d90b566deab43d0283165153
Instruction Fuzzy Hash: 53E0E5A2F1980292F600AB25DC4617872207F673A2F944331D0BEC11F5BF2CA9458310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6CDB2A3EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6CDB2A3F7
FindResourceW.KERNEL32 ref: 00007FF6CDB2A40D

Strings

RTL, xrefs: 00007FF6CDB2A403

Memory Dump Source

Source File: 00000000.00000002.1667463112.00007FF6CDB11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CDB10000, based on PE: true

Associated: 00000000.00000002.1667444468.00007FF6CDB10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667501100.00007FF6CDB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667526712.00007FF6CDB74000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667568192.00007FF6CDB7E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cdb10000_3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 8bb87b8782bc4f719ee409d300cf3865ef3d2a8ccba331494b8c78a275f12365
Instruction ID: cb3233a51b12c33707536c4bd5edf63de7848f10c6bde0a175a9af770293150c
Opcode Fuzzy Hash: 8bb87b8782bc4f719ee409d300cf3865ef3d2a8ccba331494b8c78a275f12365
Instruction Fuzzy Hash: F9D05ED5F1964282FF194F72E84A33526505F1EB43F484038C8AE8A390FF2CD184C750

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rutserv.exePID: 7640, Parent PID: 7448COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25.6%
Total number of Nodes:	289
Total number of Limit Nodes:	22

Executed Functions

Function 1106C670 Relevance: 159.9, APIs: 64, Strings: 27, Instructions: 603
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(ADVAPI32.DLL,6C7ED52C), ref: 1106C6D5
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 1106C6DF
LoadLibraryA.KERNELBASE(NETAPI32.DLL), ref: 1106C6EB
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 1106C70E
GetProcAddress.KERNELBASE(00000000,NetApiBufferFree), ref: 1106C719
RAND_add.LIBEAY32(?,000000D8), ref: 1106C760
RAND_add.LIBEAY32(?,00000044), ref: 1106C79E
FreeLibrary.KERNELBASE(00000000), ref: 1106C7B2
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 1106C7C7
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 1106C7D2
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 1106C7DD
RAND_add.LIBEAY32(?,00000040), ref: 1106C844
Heap32First.KERNEL32(?,?,?), ref: 1106CB8F
RAND_add.LIBEAY32(?,?), ref: 1106CBC2
Heap32Next.KERNEL32(?), ref: 1106CBD1
GetTickCount.KERNEL32 ref: 1106CBDE
Heap32ListNext.KERNEL32(?,?), ref: 1106CC20
GetTickCount.KERNEL32 ref: 1106CC2D
GetTickCount.KERNEL32 ref: 1106CC57
Process32First.KERNEL32(?,?), ref: 1106CC68
RAND_add.LIBEAY32(?,?), ref: 1106CC96
GetTickCount.KERNEL32 ref: 1106CCB5
GetTickCount.KERNEL32 ref: 1106CCD7
RAND_add.LIBEAY32(?,?), ref: 1106CD19
GetTickCount.KERNEL32 ref: 1106CD39
GetTickCount.KERNEL32 ref: 1106CD54
RAND_add.LIBEAY32(?,00000040), ref: 1106C8A1

Part of subcall function 1106C290: ENGINE_get_default_RAND.LIBEAY32(00000000,11039409,?,00000008), ref: 1106C29A
Part of subcall function 1106C290: TS_TST_INFO_get_nonce.LIBEAY32(00000000,00000000,11039409,?,00000008), ref: 1106C2A6
Part of subcall function 1106C290: ENGINE_finish.LIBEAY32(00000000,00000008), ref: 1106C2B8
Part of subcall function 1106C290: RAND_SSLeay.LIBEAY32(00000000,11039409,?,00000008), ref: 1106C2C0

FreeLibrary.KERNEL32(?), ref: 1106C8C3
GetVersion.KERNEL32 ref: 1106C8C9
OPENSSL_isservice.LIBEAY32 ref: 1106C8D6
LoadLibraryA.KERNEL32(USER32.DLL), ref: 1106C8E8
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 1106C8FE
GetProcAddress.KERNEL32(00000000,GetCursorInfo), ref: 1106C909
GetProcAddress.KERNEL32(00000000,GetQueueStatus), ref: 1106C914
RAND_add.LIBEAY32(?,00000004), ref: 1106C93A
GetVersion.KERNEL32 ref: 1106C948
GetVersion.KERNEL32 ref: 1106C955
RAND_add.LIBEAY32(?,?), ref: 1106C992
RAND_add.LIBEAY32(?,00000004), ref: 1106C9C0
FreeLibrary.KERNEL32(00000000), ref: 1106C9C9
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 1106C9E4
GetProcAddress.KERNEL32(00000000,CloseToolhelp32Snapshot), ref: 1106C9EE
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 1106C9F9
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 1106CA04
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 1106CA0F
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 1106CA1A
GetProcAddress.KERNEL32(00000000,Process32First), ref: 1106CA25
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 1106CA30
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 1106CA3B
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 1106CA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 1106CA51
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 1106CA5C
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 1106CAD0
GetTickCount.KERNEL32 ref: 1106CAF8
Heap32ListFirst.KERNEL32(?,?), ref: 1106CB09
RAND_add.LIBEAY32(?,?), ref: 1106CB3B

Strings

CreateToolhelp32Snapshot, xrefs: 1106C9DE
CryptAcquireContextW, xrefs: 1106C7BE
CryptGenRandom, xrefs: 1106C7CC
CryptReleaseContext, xrefs: 1106C7D7
Thread32First, xrefs: 1106CA35
Process32First, xrefs: 1106CA1F
USER32.DLL, xrefs: 1106C8E3
Process32Next, xrefs: 1106CA2A
Heap32ListFirst, xrefs: 1106CA09
NetStatisticsGet, xrefs: 1106C708
ADVAPI32.DLL, xrefs: 1106C6CA
LanmanWorkstation, xrefs: 1106C736
KERNEL32.DLL, xrefs: 1106C6DA
GetCursorInfo, xrefs: 1106C903
NetApiBufferFree, xrefs: 1106C713
Heap32First, xrefs: 1106C9F3
GetQueueStatus, xrefs: 1106C90E
Thread32Next, xrefs: 1106CA40
Module32First, xrefs: 1106CA4B
Module32Next, xrefs: 1106CA56
Intel Hardware Cryptographic Service Provider, xrefs: 1106C860
CloseToolhelp32Snapshot, xrefs: 1106C9E8
NETAPI32.DLL, xrefs: 1106C6E6
LanmanServer, xrefs: 1106C777
GetForegroundWindow, xrefs: 1106C8F8
Heap32ListNext, xrefs: 1106CA14
Heap32Next, xrefs: 1106C9FE

Memory Dump Source

Source File: 00000005.00000002.1775673433.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.1775651683.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777212631.0000000011140000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777241361.0000000011142000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777273017.0000000011145000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_rutserv.jbxd

Similarity

API ID: AddressProc$D_add$CountTick$Library$Heap32Load$FirstFreeVersion$ListNext$CreateE_finishE_get_default_L_isserviceLeayO_get_nonceProcess32SnapshotToolhelp32
String ID: ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 3196546149-2556708411
Opcode ID: e3327effe1f5b2ba4b67e000f706f2fbadeac98b4e4da4298eb7c2a19fa64854
Instruction ID: 10a006a5607e0d550d81875a8ab9047309df8414474868ce463227d917f8a542
Opcode Fuzzy Hash: e3327effe1f5b2ba4b67e000f706f2fbadeac98b4e4da4298eb7c2a19fa64854
Instruction Fuzzy Hash: 58322871D0021AEBEB10EFE5CE85BEEBBB8FF08704F00455AE519E6280DB759944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 11002690 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1775673433.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.1775651683.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777212631.0000000011140000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777241361.0000000011142000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777273017.0000000011145000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfefd2b9e16b7a881cd250c4d70c7b59d63382c890754df551f5f8380428b221
Instruction ID: 8350dbce866fad38a17a7c687df15374a8df1a5ee9a01a80c45016c01f5f9c5f
Opcode Fuzzy Hash: bfefd2b9e16b7a881cd250c4d70c7b59d63382c890754df551f5f8380428b221
Instruction Fuzzy Hash: FBE0C230A4022167F9019654DC81FD63AC82F04BA5F080060F914E3280D798E29286B6

Uniqueness

Uniqueness Score: -1.00%

Function 110D57EE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 110D580C

Part of subcall function 110DF2F5: __mtinitlocknum.LIBCMT ref: 110DF30B
Part of subcall function 110DF2F5: __amsg_exit.LIBCMT ref: 110DF317
Part of subcall function 110DF2F5: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,110E57B3,00000004,11123660,0000000C,110DFC57,000000FF,00000000,00000000,00000000,00000000,?,110DD9D0,00000001), ref: 110DF31F

___sbh_find_block.LIBCMT ref: 110D5817
___sbh_free_block.LIBCMT ref: 110D5826
RtlFreeHeap.NTDLL(00000000,000000FF,11123020,0000000C,110DF2D6,00000000,11123418,0000000C,110DF310,000000FF,-0000000F,?,110E57B3,00000004,11123660,0000000C), ref: 110D5856
GetLastError.KERNEL32(?,110E57B3,00000004,11123660,0000000C,110DFC57,000000FF,00000000,00000000,00000000,00000000,?,110DD9D0,00000001,00000214), ref: 110D5867

Memory Dump Source

Source File: 00000005.00000002.1775673433.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.1775651683.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777212631.0000000011140000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777241361.0000000011142000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777273017.0000000011145000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_rutserv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 5744958208ca1ac439fda2841ed7bef3125d2a74257cb5450ff4dc5b0423a131
Instruction ID: f2934fa887a2f5b92d4dad34fa244d5c29d8b91115a05218f3b5124a81aaa94c
Opcode Fuzzy Hash: 5744958208ca1ac439fda2841ed7bef3125d2a74257cb5450ff4dc5b0423a131
Instruction Fuzzy Hash: F101A235D06317EBDF21DF728C0AB4D7EB5AF08768F208168E814BA084DB36E1808B55

Uniqueness

Uniqueness Score: -1.00%

Function 12037B97 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,12033353,00000001,?,?,?,120334CC,?,?,?,12048C20,0000000C,12033587), ref: 12037BAC

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 8fac217aa9f652e8f54ec70a04afeef6d63efe9694f6380ccd52bae7a97805df
Instruction ID: d350fafc95f1c94b9f63ab010e44d7dd19ab866b47b7ae0c0406e77e65b2a184
Opcode Fuzzy Hash: 8fac217aa9f652e8f54ec70a04afeef6d63efe9694f6380ccd52bae7a97805df
Instruction Fuzzy Hash: C1D05E765953999EEB019E756848BA63BECA384395F004E75F81CC6140E674D5409A50

Uniqueness

Uniqueness Score: -1.00%

Function 110E006E Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,110DB089,?), ref: 110E0083

Memory Dump Source

Source File: 00000005.00000002.1775673433.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000005.00000002.1775651683.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1776824610.00000000110EA000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777212631.0000000011140000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777241361.0000000011142000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777273017.0000000011145000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000005.00000002.1777313937.000000001114B000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11000000_rutserv.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bd4e453b01535edf120120e6e356e70a1ed62b97cbcbb1e21416d31b3b5b92cd
Instruction ID: 008941fb269a23ccf09a13ed0fca1b748723d80f21f7a7662bf1493f44b99112
Opcode Fuzzy Hash: bd4e453b01535edf120120e6e356e70a1ed62b97cbcbb1e21416d31b3b5b92cd
Instruction Fuzzy Hash: 8ED05E32A50359AFDB119E725848B227BDDD388A99F048476F91CC6584F779C580CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 12028320 Relevance: 87.6, APIs: 27, Strings: 23, Instructions: 108COMMON

Download Yara Rule

APIs

EVP_get_cipherbyname.LIBEAY32(DES-CBC,1202EFCD), ref: 12028325
EVP_get_cipherbyname.LIBEAY32(DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 12028334
EVP_get_cipherbyname.LIBEAY32(RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 12028343
EVP_get_cipherbyname.LIBEAY32(RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 12028352
EVP_get_cipherbyname.LIBEAY32(IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 12028361
EVP_get_cipherbyname.LIBEAY32(AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 12028370
EVP_get_cipherbyname.LIBEAY32(AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 1202837F
EVP_get_cipherbyname.LIBEAY32(CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 1202838E
EVP_get_cipherbyname.LIBEAY32(CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 1202839D
EVP_get_cipherbyname.LIBEAY32(gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 120283AC
EVP_get_cipherbyname.LIBEAY32(SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 120283BB
EVP_get_cipherbyname.LIBEAY32(id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 120283CA
EVP_get_cipherbyname.LIBEAY32(id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 120283D9
EVP_get_digestbyname.LIBEAY32(MD5,id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 120283E8
EVP_MD_size.LIBEAY32(00000000,MD5,id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202EFCD), ref: 120283F3
OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001B5,ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0), ref: 12028413
EVP_get_digestbyname.LIBEAY32(SHA1,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1202EFCD), ref: 12028420
EVP_MD_size.LIBEAY32(00000000,SHA1), ref: 1202842B
OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001B9,ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0), ref: 1202844B
EVP_get_digestbyname.LIBEAY32(md_gost94), ref: 12028458
EVP_MD_size.LIBEAY32(00000000), ref: 1202846A
OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001BF,ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0), ref: 1202848A
EVP_get_digestbyname.LIBEAY32(gost-mac), ref: 12028497
EVP_get_digestbyname.LIBEAY32(SHA256), ref: 120284C6
EVP_MD_size.LIBEAY32(00000000,SHA256), ref: 120284D1
EVP_get_digestbyname.LIBEAY32(SHA384,00000000,SHA256), ref: 120284E0
EVP_MD_size.LIBEAY32(00000000,SHA384,00000000,SHA256), ref: 120284EB

Strings

SHA384, xrefs: 120284D6
SHA1, xrefs: 1202841B
IDEA-CBC, xrefs: 12028357
ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0, xrefs: 1202847B
gost89-cnt, xrefs: 120283A2
ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0, xrefs: 12028404
CAMELLIA-128-CBC, xrefs: 12028384
MD5, xrefs: 120283DE
AES-128-CBC, xrefs: 12028366
id-aes256-GCM, xrefs: 120283CF
ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0, xrefs: 1202843C
SEED-CBC, xrefs: 120283B1
RC4, xrefs: 12028339
id-aes128-GCM, xrefs: 120283C0
CAMELLIA-256-CBC, xrefs: 12028393
AES-256-CBC, xrefs: 12028375
RC2-CBC, xrefs: 12028348
SHA256, xrefs: 120284C1
DES-EDE3-CBC, xrefs: 1202832A
.\ssl\ssl_ciph.c, xrefs: 1202840E, 12028446, 12028485
DES-CBC, xrefs: 12028320
gost-mac, xrefs: 12028492, 1202849C
md_gost94, xrefs: 12028453

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: P_get_cipherbyname$P_get_digestbyname$D_size$Open
String ID: .\ssl\ssl_ciph.c$AES-128-CBC$AES-256-CBC$CAMELLIA-128-CBC$CAMELLIA-256-CBC$DES-CBC$DES-EDE3-CBC$IDEA-CBC$MD5$RC2-CBC$RC4$SEED-CBC$SHA1$SHA256$SHA384$gost-mac$gost89-cnt$id-aes128-GCM$id-aes256-GCM$md_gost94$ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0$ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0$ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0
API String ID: 2986206148-2187843582
Opcode ID: 9d1934bc04c8dccff6172f709497ed78a8034637576d0e3eeabe05fb90cadca0
Instruction ID: a0a7c332c7fadc3b34ea5585c1b985939b06dbd4fbf0cc363d4d63c2236e8d62
Opcode Fuzzy Hash: 9d1934bc04c8dccff6172f709497ed78a8034637576d0e3eeabe05fb90cadca0
Instruction Fuzzy Hash: 4B3130BBE857916EE781EF71CC845AE77B27B1C3467158F39E40496A00EF349101BB61

Uniqueness

Uniqueness Score: -1.00%

Function 12019060 Relevance: 61.7, APIs: 31, Strings: 4, Instructions: 497COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(0000008C,.\ssl\t1_enc.c,0000017A), ref: 120190FF
EVP_CIPHER_CTX_init.LIBEAY32(00000000), ref: 12019116
COMP_CTX_free.LIBEAY32(?), ref: 1201914F
COMP_CTX_new.LIBEAY32(?), ref: 12019165
CRYPTO_malloc.LIBEAY32(00004540,.\ssl\t1_enc.c,00000193), ref: 120191A5
EVP_CIPHER_CTX_new.LIBEAY32 ref: 1201921E
EVP_MD_CTX_create.LIBEAY32 ref: 12019247
COMP_CTX_free.LIBEAY32(?), ref: 12019265
COMP_CTX_new.LIBEAY32(?), ref: 1201927B
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 120192FF
UI_get0_user_data.LIBEAY32(?), ref: 12019321
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 12019373
X509_TRUST_get0_name.LIBEAY32(?), ref: 12019395
X509_PURPOSE_get0_name.LIBEAY32(?,?,?,?), ref: 12019431
EVP_PKEY_new_mac_key.LIBEAY32(?,00000000,?), ref: 1201944F
EVP_DigestSignInit.LIBEAY32(?,00000000,?,00000000,00000000), ref: 12019470
EVP_PKEY_free.LIBEAY32(00000000), ref: 12019481
UI_get0_user_data.LIBEAY32(?), ref: 1201949C

Part of subcall function 12024BE0: EVP_MD_CTX_destroy.LIBEAY32(?,?,1200CB70,?,?), ref: 12024BEC
Part of subcall function 12024BE0: EVP_MD_CTX_create.LIBEAY32(?,1200CB70,?,?), ref: 12024BFA
Part of subcall function 12024BE0: EVP_DigestInit_ex.LIBEAY32(00000000,1200CB70,00000000,?,1200CB70,?,?), ref: 12024C11

EVP_PKEY_free.LIBEAY32(00000000), ref: 12019569
ERR_put_error.LIBEAY32(00000014,000000D1,00000044,.\ssl\t1_enc.c,000001FE,00000000), ref: 12019581
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 120195B4
EVP_CipherInit_ex.LIBEAY32(?,?,00000000,?,00000000,?), ref: 120195DC
EVP_CIPHER_CTX_ctrl.LIBEAY32(?,00000012,?,?), ref: 120195F1
ERR_put_error.LIBEAY32(00000014,000000D1,00000041,.\ssl\t1_enc.c,00000274), ref: 1201966F
OPENSSL_cleanse.LIBEAY32(?,00000040), ref: 12019685
OPENSSL_cleanse.LIBEAY32(?,00000040,?,00000040), ref: 12019694
OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000040,?,00000040), ref: 120196A0
OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000020,?,00000040,?,00000040), ref: 120196AC

Strings

client write key, xrefs: 120193F6, 120194D7
.\ssl\t1_enc.c, xrefs: 120190F5, 1201917C, 1201919B, 12019292, 120192BE, 12019573, 12019661
server write key, xrefs: 120193D0
IV block, xrefs: 12019538

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: L_cleanseX509_$E_get0_nameX_new$DigestI_get0_user_dataInit_exO_mallocR_put_errorX_createX_freeY_free$CipherInitSignT_get0_nameX_cleanupX_ctrlX_destroyX_initY_new_mac_key
String ID: .\ssl\t1_enc.c$IV block$client write key$server write key
API String ID: 2805114850-2198003478
Opcode ID: 87368a892905f0f2dfeb8c5c1dda7eb47587b4746c830cbd0676e73c45988929
Instruction ID: d90d7da467e942d370692ed1e4d3363b12f7b9bf44d29b05511deabff2142ae9
Opcode Fuzzy Hash: 87368a892905f0f2dfeb8c5c1dda7eb47587b4746c830cbd0676e73c45988929
Instruction Fuzzy Hash: CB02A3B66043459FE315DF50CC85FABB7E4AB88708F144A2CEA8A9F281E770F544DB52

Uniqueness

Uniqueness Score: -1.00%

Function 120162F0 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

HMAC_CTX_init.LIBEAY32(?,?,?,?,12018912,?,?,?), ref: 1201633E
EVP_CIPHER_CTX_init.LIBEAY32(?,?,?,?,?,12018912,?,?,?), ref: 12016348
HMAC_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 12016386
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?), ref: 12016390
EVP_sha256.LIBEAY32(00000000,?,?), ref: 120163E7
HMAC_Init_ex.LIBEAY32(?,?,00000010,00000000,00000000,?,?), ref: 120163FE
EVP_aes_128_cbc.LIBEAY32(00000000,?,0000000A,?,?,?,?,?,?,?), ref: 1201641B
EVP_DecryptInit_ex.LIBEAY32(?,00000000,00000000,?,0000000A,?,?,?,?,?,?,?), ref: 12016426
EVP_MD_size.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201643E
X509_get_issuer_name.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12016457
HMAC_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12016473
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201647D
HMAC_Update.LIBEAY32(?,-00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 120164AE
HMAC_Final.LIBEAY32(?,?,00000000), ref: 120164D0
HMAC_CTX_cleanup.LIBEAY32(?), ref: 120164E8
CRYPTO_memcmp.LIBEAY32(?,?,?,?), ref: 120164FE
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 1201650F
X509_get_issuer_name.LIBEAY32(?), ref: 12016539
X509_get_issuer_name.LIBEAY32(?,?), ref: 1201654B
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,00000DFF,?,?), ref: 12016564
EVP_DecryptUpdate.LIBEAY32(?,00000000,?,?,?), ref: 12016587
EVP_DecryptFinal.LIBEAY32(?,?,?), ref: 120165A8
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 120165B9
CRYPTO_free.LIBEAY32(00000000,?), ref: 120165BF
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 120165F1
d2i_SSL_SESSION.SSLEAY32(00000000,?,?,?), ref: 12016606
CRYPTO_free.LIBEAY32(00000000,00000000,?,?,?), ref: 12016618
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 120166C8
CRYPTO_free.LIBEAY32(00000000,?), ref: 120166CE
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?), ref: 120166DA
HMAC_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 120166E7

Strings

.\ssl\t1_lib.c, xrefs: 1201655E

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: X_cleanup$DecryptO_freeX509_get_issuer_name$FinalInit_exUpdateX_init$D_sizeO_mallocO_memcmpP_aes_128_cbcP_sha256d2i_
String ID: .\ssl\t1_lib.c
API String ID: 2898351744-2047370388
Opcode ID: 34e9d3e91298192f329cdb80befc4385001c7d6abcbb5198cf7860955b30e023
Instruction ID: 574f4a9c9ada1111f2817ca7e2358c2213a69731ee7a12704ad5252f9dc507e6
Opcode Fuzzy Hash: 34e9d3e91298192f329cdb80befc4385001c7d6abcbb5198cf7860955b30e023
Instruction Fuzzy Hash: BEB1A0B76043405FD361DB64DC41BFBB3E8AFC8716F444A2EE5498A240EB75F60897A2

Uniqueness

Uniqueness Score: -1.00%

Function 12018A40 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

EVP_MD_size.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?), ref: 12018AA3
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,000000AA,chunk >= 0), ref: 12018AC0
EVP_MD_CTX_init.LIBEAY32(?), ref: 12018ACD
EVP_MD_CTX_init.LIBEAY32(?,?), ref: 12018AD7
EVP_MD_CTX_init.LIBEAY32(?,?,?), ref: 12018AE1
EVP_MD_CTX_set_flags.LIBEAY32(?,00000008,?,?,?), ref: 12018AED
EVP_PKEY_new_mac_key.LIBEAY32(00000357,00000000,?,?,?,00000008,?,?,?), ref: 12018B02
EVP_DigestSignInit.LIBEAY32(?,00000000,?,00000000,00000000), ref: 12018B21
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 12018B3B
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018B5D
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018B83
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018BA9
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018BCF
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018BF5
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018C17
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 12018C31
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018C53
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 12018C78
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018C9A
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018CC0
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018CE6
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018D0C
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018D2E
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018D51
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018D84
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 12018D9A
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018DBE
EVP_PKEY_free.LIBEAY32(?), ref: 12018DED
EVP_MD_CTX_cleanup.LIBEAY32(?,?), ref: 12018DF7
EVP_MD_CTX_cleanup.LIBEAY32(?,?,?), ref: 12018E01
EVP_MD_CTX_cleanup.LIBEAY32(?,?,?,?), ref: 12018E0B
OPENSSL_cleanse.LIBEAY32(?,00000040,?,?,?,?), ref: 12018E1A

Strings

chunk >= 0, xrefs: 12018AB1
.\ssl\t1_enc.c, xrefs: 12018ABB

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$Sign$FinalX_copy_ex$X_cleanupX_init$D_sizeInitL_cleanseOpenX_set_flagsY_freeY_new_mac_key
String ID: .\ssl\t1_enc.c$chunk >= 0
API String ID: 2523695285-2139598294
Opcode ID: 53927f37be37dc65ed8b3dfe43320f376b23f39de8ded73f9ca7461b0f5db211
Instruction ID: b1fa4a4b0a0716049dc93f8e184774a4ffc320a6edf3368a2414a1d0fd5df758
Opcode Fuzzy Hash: 53927f37be37dc65ed8b3dfe43320f376b23f39de8ded73f9ca7461b0f5db211
Instruction Fuzzy Hash: 67A12DB75083415BE352CB64CC81FEBB3FDAF98705F044A1DFA859A140EA75E608DB62

Uniqueness

Uniqueness Score: -1.00%

Function 12003B90 Relevance: 54.6, APIs: 30, Strings: 1, Instructions: 373COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 12003BBE
X509_get_pubkey.LIBEAY32(?), ref: 12003C21
BIO_free.LIBEAY32(?), ref: 1200403C
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200405C
EVP_PKEY_free.LIBEAY32(00000000,?), ref: 12004062

Strings

.\ssl\s3_srvr.c, xrefs: 12003C4A, 12003CF0, 12003D74, 12003DD3, 12003DF5, 12003E2D, 12003E55, 12003EA1, 12003EEF, 12003F22, 12003F55, 12003F88, 12003FFC

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeX509_get_pubkeyX_cleanupX_initY_free
String ID: .\ssl\s3_srvr.c
API String ID: 804101390-3445611115
Opcode ID: 1330d0c421bb73840bb4a0040658afe23d59eee0fed962abaaed8ee892022075
Instruction ID: c6c4adceab5df25293b8a2ecee26b238cc9a80672a984d847b55c03a7943dc7a
Opcode Fuzzy Hash: 1330d0c421bb73840bb4a0040658afe23d59eee0fed962abaaed8ee892022075
Instruction Fuzzy Hash: 9AC11977A443416FF312DB10CC45FABB3A8AB14785F050728FA45AB1C2D774E944E7AA

Uniqueness

Uniqueness Score: -1.00%

Function 12024290 Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,000000FF,00000010,.\ssl\ssl_lib.c,00000239), ref: 120242B2
X509_VERIFY_PARAM_free.LIBEAY32(?), ref: 120242CA
CRYPTO_free_ex_data.LIBEAY32(00000001,?,?), ref: 120242DC
BIO_pop.LIBEAY32(?), ref: 120242F3
BIO_free.LIBEAY32(?), ref: 12024302
BIO_free_all.LIBEAY32(?), ref: 12024319
BIO_free_all.LIBEAY32(?), ref: 1202432E
BUF_MEM_free.LIBEAY32(?), ref: 1202433E
sk_free.LIBEAY32(?), ref: 1202434E
sk_free.LIBEAY32(?), ref: 1202435E
SSL_SESSION_free.SSLEAY32(00000000,?), ref: 1202437C
EVP_MD_CTX_destroy.LIBEAY32(?), ref: 12024398
EVP_MD_CTX_destroy.LIBEAY32(?), ref: 120243B5
CRYPTO_free.LIBEAY32(?), ref: 120243E5
SSL_CTX_free.SSLEAY32(?), ref: 120243F8
CRYPTO_free.LIBEAY32(?), ref: 1202440B
CRYPTO_free.LIBEAY32(?), ref: 1202441E
CRYPTO_free.LIBEAY32(?), ref: 12024431
sk_pop_free.LIBEAY32(?,12031CE2), ref: 12024449
sk_pop_free.LIBEAY32(?,12031CEE), ref: 12024461
CRYPTO_free.LIBEAY32(?), ref: 12024474
CRYPTO_free.LIBEAY32(?), ref: 12024487
sk_pop_free.LIBEAY32(?,12031B44), ref: 1202449F
SSL_CTX_free.SSLEAY32(?), ref: 120244C2
CRYPTO_free.LIBEAY32(?), ref: 120244D5
sk_free.LIBEAY32(?), ref: 120244E8
CRYPTO_free.LIBEAY32(?), ref: 120244F1

Strings

.\ssl\ssl_lib.c, xrefs: 120242A2

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$sk_freesk_pop_free$M_freeO_free_allX_destroyX_free$N_freeO_add_lockO_free_ex_dataO_popX509_
String ID: .\ssl\ssl_lib.c
API String ID: 957874568-3333140318
Opcode ID: 3c30928d91165516b049b2d69e31e1ba184a4427a917d55327bc1c86a94ec413
Instruction ID: 81ba30732c33f11dec22837797e7737796e29988af1575bdd45a8fdd6bc42dc9
Opcode Fuzzy Hash: 3c30928d91165516b049b2d69e31e1ba184a4427a917d55327bc1c86a94ec413
Instruction Fuzzy Hash: 9A51B3F7F007015BEA62CB719C44FA7B2FCAF04705F464A29E84AD7640EB24F114E262

Uniqueness

Uniqueness Score: -1.00%

Function 120198E0 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 375COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019918
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1201992B
EVP_MD_size.LIBEAY32(00000000,?), ref: 12019931
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,000002F9,n >= 0), ref: 1201994C
pqueue_peek.LIBEAY32(?), ref: 12019975
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 12019996
X509_TRUST_get0_name.LIBEAY32(?), ref: 120199B1
_fprintf.LIBCMT ref: 120199E2
RAND_bytes.LIBEAY32(?,00000000), ref: 120199F1
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019A1E
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019A31
EVP_MD_size.LIBEAY32(00000000,?), ref: 12019A37
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,00000318,n >= 0), ref: 12019A52
X509_TRUST_get_flags.LIBEAY32 ref: 12019AB2
X509_PURPOSE_get0_name.LIBEAY32(00000000), ref: 12019ABE
EVP_CIPHER_CTX_ctrl.LIBEAY32(?,00000016,0000000D,00000008), ref: 12019BA0
EVP_Cipher.LIBEAY32(?,?,?,?), ref: 12019C4A
X509_PURPOSE_get0_name.LIBEAY32(?,?,?,?,?), ref: 12019C58
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 12019C98
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019CCD
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019CE0
EVP_MD_size.LIBEAY32(00000000,?), ref: 12019CE6

Strings

%s:%d: rec->data != rec->input, xrefs: 120199D4
.\ssl\t1_enc.c, xrefs: 12019947, 120199CF, 12019A4D
n >= 0, xrefs: 1201993D, 12019A43

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: X509_$Y_get_object$E_get0_name$D_size$Open$CipherD_bytesT_get0_nameT_get_flagsX_ctrl_fprintfpqueue_peek
String ID: %s:%d: rec->data != rec->input$.\ssl\t1_enc.c$n >= 0
API String ID: 1325399572-3097570779
Opcode ID: 4e2af60942747acdcf65cdffdd4f966f9bd2b6003023bebe82854cbd0f18370e
Instruction ID: a4c6c17a66cacf18bb1f16c4ac611663db0d9e4fd3c866fe51b174c6857e216d
Opcode Fuzzy Hash: 4e2af60942747acdcf65cdffdd4f966f9bd2b6003023bebe82854cbd0f18370e
Instruction Fuzzy Hash: C6D1D277A043458FD751CF68C8807ABB7E5BF88315F444A2DE9898B381EB35E904DB92

Uniqueness

Uniqueness Score: -1.00%

Function 12007A00 Relevance: 44.1, APIs: 23, Strings: 2, Instructions: 335COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 12007A2E
EVP_PKEY_CTX_new.LIBEAY32(?,00000000), ref: 12007A60
EVP_PKEY_sign_init.LIBEAY32(00000000), ref: 12007A77
EVP_sha1.LIBEAY32 ref: 12007A87
EVP_PKEY_CTX_ctrl.LIBEAY32(00000000,000000FF,000000F8,00000001,00000000,00000000), ref: 12007A99
ERR_clear_error.LIBEAY32 ref: 12007AC3
BIO_ctrl.LIBEAY32(?,00000003,00000000,?), ref: 12007AF6
EVP_DigestInit_ex.LIBEAY32(?,?,00000000), ref: 12007B28
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12007B43
EVP_SignFinal.LIBEAY32(?,?,?,?), ref: 12007B5E
ERR_put_error.LIBEAY32(00000014,00000099,00000044,.\ssl\s3_clnt.c,00000CD8), ref: 12007BA6
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 12007BB7
EVP_PKEY_CTX_free.LIBEAY32(00000000,?), ref: 12007BBD
RSA_sign.LIBEAY32(00000072,?,00000024,?,?,?), ref: 12007C0D
ERR_put_error.LIBEAY32(00000014,00000099,00000004,.\ssl\s3_clnt.c,00000CF1), ref: 12007C2C
DSA_sign.LIBEAY32(?,?,00000014,?,?,?), ref: 12007C6F
ERR_put_error.LIBEAY32(00000014,00000099,0000000A,.\ssl\s3_clnt.c,00000CFE), ref: 12007C8E
ERR_put_error.LIBEAY32(00000014,00000099,00000044,.\ssl\s3_clnt.c,00000CC2), ref: 12007D71
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 12007DDB
EVP_PKEY_CTX_free.LIBEAY32(00000000,?), ref: 12007DE1

Strings

@, xrefs: 12007D2D
.\ssl\s3_clnt.c, xrefs: 12007B98, 12007BD9, 12007C1E, 12007C80, 12007CE1, 12007D63

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$A_signDigestX_cleanupX_free$FinalInit_exO_ctrlP_sha1R_clear_errorSignUpdateX_ctrlX_initX_newY_sign_init
String ID: .\ssl\s3_clnt.c$@
API String ID: 3225417783-226317790
Opcode ID: 6ec0d1bca88231b59be31024274287a16e4b5415ee416c48a34a34d88009e0a8
Instruction ID: 965f076991b6b4b9d97097f4c348c9561c3f976f263918b324dbfa262b93db2e
Opcode Fuzzy Hash: 6ec0d1bca88231b59be31024274287a16e4b5415ee416c48a34a34d88009e0a8
Instruction Fuzzy Hash: 67C1D176604342AFF215CB10CC81FABB7F9AF88704F044A1DFA995B691E774E904D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1200D380 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(00000000), ref: 1200D3D5
pqueue_peek.LIBEAY32(00000000,00000000), ref: 1200D3DB
ERR_put_error.LIBEAY32(00000014,0000011D,00000144,.\ssl\s3_enc.c,000002CF), ref: 1200D41D

Part of subcall function 1200D190: CRYPTO_malloc.LIBEAY32(00000018,.\ssl\s3_enc.c,00000273,?,00000000,12001BF2,?), ref: 1200D1B1
Part of subcall function 1200D190: ERR_put_error.LIBEAY32(00000014,00000125,00000041,.\ssl\s3_enc.c,00000275), ref: 1200D1E1

EVP_MD_CTX_init.LIBEAY32(?), ref: 1200D43E
EVP_MD_CTX_set_flags.LIBEAY32(?,00000008,?), ref: 1200D44A
EVP_MD_CTX_copy_ex.LIBEAY32(?,?,?,00000008,?), ref: 1200D455
X509_NAME_ENTRY_get_object.LIBEAY32(?,?,?,?,00000008,?), ref: 1200D45F
EVP_MD_size.LIBEAY32(00000000,?,?,?,?,00000008,?), ref: 1200D465
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D48F
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D4B2
EVP_DigestUpdate.LIBEAY32(?,1204E7B8,00000030), ref: 1200D4CD
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200D4EC
X509_NAME_ENTRY_get_object.LIBEAY32(?,00000000), ref: 1200D503
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200D511
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D530
EVP_DigestUpdate.LIBEAY32(?,1204E7E8,00000030), ref: 1200D547
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D562
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200D579
ERR_put_error.LIBEAY32(00000014,0000011D,00000044,.\ssl\s3_enc.c,000002E6), ref: 1200D598
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200D5AD

Strings

.\ssl\s3_enc.c, xrefs: 1200D40C, 1200D58A

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$R_put_errorX509_Y_get_object$Final_ex$D_sizeInit_exO_mallocX_cleanupX_copy_exX_initX_set_flagspqueue_peek
String ID: .\ssl\s3_enc.c
API String ID: 598271980-1985432667
Opcode ID: baf64e41a67a1ec31a9994cba8b1d396334b1929270db575b59e34d5a2ddc504
Instruction ID: 22db6912a6df20f6024a1aaec7e7b765f0ebb5a4be6209c65d4c5117704b19ce
Opcode Fuzzy Hash: baf64e41a67a1ec31a9994cba8b1d396334b1929270db575b59e34d5a2ddc504
Instruction Fuzzy Hash: 6151A0BB5043016FE305CB64CC41FAFB3E9AB98745F444A2DFA4596240FA34F508EBA6

Uniqueness

Uniqueness Score: -1.00%

Function 120063B0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 328COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32 ref: 1200644D
ERR_put_error.LIBEAY32(00000014,00000090,00000041,.\ssl\s3_clnt.c,000004BD), ref: 1200646F
ERR_put_error.LIBEAY32(00000014,00000090,000000EF,.\ssl\s3_clnt.c,00000521,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 1200672E
CRYPTO_add_lock.LIBEAY32(00000010,00000001,00000003,.\ssl\s3_clnt.c,00000538), ref: 12006763
X509_free.LIBEAY32(?), ref: 12006781
X509_free.LIBEAY32(?), ref: 1200679F
CRYPTO_add_lock.LIBEAY32(00000010,00000001,00000003,.\ssl\s3_clnt.c,00000544), ref: 120067B9
EVP_PKEY_free.LIBEAY32(?), ref: 12006821
X509_free.LIBEAY32(00003005,?), ref: 1200682B
sk_pop_free.LIBEAY32(?,Function_000319EE,00003005,?), ref: 1200683A

Strings

.\ssl\s3_clnt.c, xrefs: 12006439, 12006461, 120064A7, 12006586, 120065AB, 120065C4, 120065DD, 120065F3, 120066AF, 120066E0, 12006710, 12006753, 120067AC

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: X509_free$O_add_lockR_put_error$Y_freesk_new_nullsk_pop_free
String ID: .\ssl\s3_clnt.c
API String ID: 800983268-2155475665
Opcode ID: 7d559d877b3a98162e66678dc9e492ae8617ac4fb1574b901f6722d5c25a47d2
Instruction ID: 39272b103ee157adfe89867c244076aa74a34e1bae0fc1aba667e4a422780f87
Opcode Fuzzy Hash: 7d559d877b3a98162e66678dc9e492ae8617ac4fb1574b901f6722d5c25a47d2
Instruction Fuzzy Hash: A4C11072A04301AFF705CF14CC81FAAB7E5AB44345F254779F989AB282D670E904EB99

Uniqueness

Uniqueness Score: -1.00%

Function 1202C370 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 228COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202C3EB
BIO_new.LIBEAY32(00000000), ref: 1202C3F1
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202C418
ERR_put_error.LIBEAY32(00000014,00000151,00000043,.\ssl\ssl_rsa.c,000003CB), ref: 1202C5FD
CRYPTO_free.LIBEAY32(?), ref: 1202C60A
CRYPTO_free.LIBEAY32(?,?), ref: 1202C614
CRYPTO_free.LIBEAY32(?,?,?), ref: 1202C61E
CRYPTO_free.LIBEAY32(00000000,?,?,?), ref: 1202C624
BIO_free.LIBEAY32(?), ref: 1202C639

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C406, 1202C429, 1202C4F2, 1202C588, 1202C5AE, 1202C5BF, 1202C5D0, 1202C5DE, 1202C5EF
SERVERINFO FOR , xrefs: 1202C385

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$O_ctrlO_newO_s_fileR_put_error
String ID: .\ssl\ssl_rsa.c$SERVERINFO FOR
API String ID: 775051240-3219124774
Opcode ID: 723326dd89cd46b0bc0e97c6e5adeaa4a9572f7e345192560a790b13e95b8819
Instruction ID: 6a0e5840066cde609769d04a4ad4edafa24e83e3d5e10efa35e02003f5114aea
Opcode Fuzzy Hash: 723326dd89cd46b0bc0e97c6e5adeaa4a9572f7e345192560a790b13e95b8819
Instruction Fuzzy Hash: F971E5B3648342AFD341DFA4CC80E6BB7E9AB88704F515B2EF585A7140EB70E6449B52

Uniqueness

Uniqueness Score: -1.00%

Function 12022B10 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000C,.\ssl\ssl_lib.c,0000084B), ref: 12022B2F
X509_VERIFY_PARAM_free.LIBEAY32(?), ref: 12022B4A
SSL_CTX_flush_sessions.SSLEAY32(?,00000000), ref: 12022B5B
CRYPTO_free_ex_data.LIBEAY32(00000002,?,?), ref: 12022B6D
lh_free.LIBEAY32(00000000), ref: 12022B7D
X509_STORE_free.LIBEAY32(?), ref: 12022B8D
sk_free.LIBEAY32(?), ref: 12022B9D
sk_free.LIBEAY32(?), ref: 12022BAD
sk_pop_free.LIBEAY32(?,12031B44), ref: 12022BD8
sk_pop_free.LIBEAY32(?,Function_000319EE), ref: 12022BF0
sk_free.LIBEAY32(?), ref: 12022C0D
CRYPTO_free.LIBEAY32(?), ref: 12022C20
SSL_CTX_SRP_CTX_free.SSLEAY32(?), ref: 12022C29
ENGINE_finish.LIBEAY32(?), ref: 12022C3C
CRYPTO_free.LIBEAY32(?), ref: 12022C6F
CRYPTO_free.LIBEAY32(?), ref: 12022C82
CRYPTO_free.LIBEAY32(?), ref: 12022C95
CRYPTO_free.LIBEAY32(?), ref: 12022C9E

Strings

.\ssl\ssl_lib.c, xrefs: 12022B22

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$sk_free$X509_sk_pop_free$E_finishE_freeM_freeO_add_lockO_free_ex_dataX_flush_sessionsX_freelh_free
String ID: .\ssl\ssl_lib.c
API String ID: 880251562-3333140318
Opcode ID: c43081cb0ffa2eb263c16f5f51c105138b752a58687ec3da726ad6ef121d2de0
Instruction ID: 81e015d417066b77526aef553310761e9362c742981bf3c7d502c32ba04e0a95
Opcode Fuzzy Hash: c43081cb0ffa2eb263c16f5f51c105138b752a58687ec3da726ad6ef121d2de0
Instruction Fuzzy Hash: 2E418CF7A007015FEB53DBB59C05FE7B2EC2F14705F950A29E85AE7240FA21F114A2A2

Uniqueness

Uniqueness Score: -1.00%

Function 12004080 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 335COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000089,000000C7,.\ssl\s3_srvr.c,00000CC0), ref: 1200410C

Part of subcall function 1200E440: SSL_CTX_remove_session.SSLEAY32(?,?), ref: 1200E48A

ERR_put_error.LIBEAY32(00000014,00000089,000000E9,.\ssl\s3_srvr.c,00000CC9), ref: 12004150
ERR_put_error.LIBEAY32(00000014,00000089,00000106,.\ssl\s3_srvr.c,00000CD3), ref: 120041A5
X509_free.LIBEAY32(?), ref: 1200449F
sk_pop_free.LIBEAY32(?,Function_000319EE), ref: 120044B5
sk_pop_free.LIBEAY32(?,Function_000319EE), ref: 120044D6

Strings

.\ssl\s3_srvr.c, xrefs: 120040FB, 1200413F, 1200418F, 1200420A, 12004261, 12004319, 12004354, 120043D7, 12004479

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_pop_free$X509_freeX_remove_session
String ID: .\ssl\s3_srvr.c
API String ID: 2042108797-3445611115
Opcode ID: 9554a1abda8772450c8a7ce6f5921dcf11a1fa195791ed579c8f96eabeccb1a7
Instruction ID: 0a773fd76867177ad757357980a83a36867f0808bca267e264cc54b14e0d28fe
Opcode Fuzzy Hash: 9554a1abda8772450c8a7ce6f5921dcf11a1fa195791ed579c8f96eabeccb1a7
Instruction Fuzzy Hash: 68B109B6B40300ABF701DB10DC82FAA7794EB44745F0A4779FE496F2C2D6719904D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 1200DBA0 Relevance: 28.8, APIs: 19, Instructions: 271COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200DC0E
EVP_MD_size.LIBEAY32(00000000,?), ref: 1200DC14
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1200DC78
EVP_MD_CTX_init.LIBEAY32(?), ref: 1200DD38
EVP_MD_CTX_copy_ex.LIBEAY32(?,?,?), ref: 1200DD5C
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DD7B
EVP_DigestUpdate.LIBEAY32(?,1204E7B8,00000030), ref: 1200DD96
EVP_DigestUpdate.LIBEAY32(?,?,00000008), ref: 1200DDB2
EVP_DigestUpdate.LIBEAY32(?,?,00000001), ref: 1200DDCE
EVP_DigestUpdate.LIBEAY32(?,?,00000002), ref: 1200DDE6
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DE03
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200DE1B
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 1200DE31
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DE50
EVP_DigestUpdate.LIBEAY32(?,1204E7E8,00000030), ref: 1200DE67
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DE7E
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200DE95
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200DEAE

Part of subcall function 120111F0: X509_NAME_ENTRY_get_object.LIBEAY32(?,1200DC98,?), ref: 120111F5
Part of subcall function 120111F0: pqueue_peek.LIBEAY32(00000000,?,1200DC98,?), ref: 120111FB

EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200DECE

Part of subcall function 12011220: OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,000001C7,data_plus_mac_plus_padding_size < 1024 * 1024,?,?,?,?), ref: 120112B5
Part of subcall function 12011220: X509_NAME_ENTRY_get_object.LIBEAY32(?,?,?,?,?), ref: 120112BE
Part of subcall function 12011220: pqueue_peek.LIBEAY32(00000000,?,?,?,?,?), ref: 120112C4
Part of subcall function 12011220: SHA_Init.LIBEAY32(?,?,?), ref: 120112F3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$X509_Y_get_object$Final_exX_cleanupX_copy_expqueue_peek$D_sizeInitOpenX_flagsX_init
String ID:
API String ID: 2514736885-0
Opcode ID: ff9630bf00b5e40104762658c507a2b0cb71fc0663a14587522890d05e216d4a
Instruction ID: f671802bc11c5cab8b725b136d7fb0d547f7d404842ea41751837e9905fa1d2c
Opcode Fuzzy Hash: ff9630bf00b5e40104762658c507a2b0cb71fc0663a14587522890d05e216d4a
Instruction Fuzzy Hash: 3A91A1B75083829FE314DB64DC40FABB3E9EF98345F044A6DF98587241E634E509DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 12025000 Relevance: 28.7, APIs: 19, Instructions: 231COMMON

Download Yara Rule

APIs

SSL_new.SSLEAY32(?), ref: 1202500E

Part of subcall function 12024C40: ERR_put_error.LIBEAY32(00000014,000000BA,000000C3,.\ssl\ssl_lib.c,0000012B), ref: 12024C5F

SSL_copy_session_id.SSLEAY32(00000000,?), ref: 1202503F
X509_VERIFY_PARAM_get_depth.LIBEAY32(?), ref: 12025103
X509_VERIFY_PARAM_set_depth.LIBEAY32(?,00000000,?), ref: 1202510D
CRYPTO_dup_ex_data.LIBEAY32(00000001,000000F0,?,?,00000000,?), ref: 12025146
BIO_ctrl.LIBEAY32(?,0000000C,00000000,0000000C), ref: 12025165
BIO_ctrl.LIBEAY32(?,0000000C,00000000,00000010), ref: 12025189

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlX509_$L_copy_session_idL_newM_get_depthM_set_depthO_dup_ex_dataR_put_error
String ID:
API String ID: 4256526275-0
Opcode ID: 448ed8c9fbb9e611e83d7d880d269fe1ac8d1f360b8cb0e6754389639ae37a59
Instruction ID: efbecbf828e3f002354a74056d8518134caf88136510e2c07e40203a3d7ee5f6
Opcode Fuzzy Hash: 448ed8c9fbb9e611e83d7d880d269fe1ac8d1f360b8cb0e6754389639ae37a59
Instruction Fuzzy Hash: 61811DB6A00B02AFD359CF65D880AA6F7E5BF49300F508A2ED95E83740E731F854DB95

Uniqueness

Uniqueness Score: -1.00%

Function 1202CB60 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202CB72
BIO_new.LIBEAY32(00000000), ref: 1202CB78
ERR_put_error.LIBEAY32(00000014,000000AD,00000007,.\ssl\ssl_rsa.c,000001CF), ref: 1202CB99
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202CBB1
ERR_put_error.LIBEAY32(00000014,000000AD,00000002,.\ssl\ssl_rsa.c,000001D4), ref: 1202CBD0
BIO_free.LIBEAY32(00000000), ref: 1202CBD9

Strings

.\ssl\ssl_rsa.c, xrefs: 1202CB8B, 1202CBC2, 1202CC30, 1202CC87

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_file
String ID: .\ssl\ssl_rsa.c
API String ID: 3280554936-614043423
Opcode ID: d1e2a1cec1042e05b7c7eec9bb6a850c949dafd8eade73ad4bece3ddca9a9b0a
Instruction ID: b083fcf96847af42e8c9a81175b7fa4be8368a5bcf2b7cfded1dab27eee96448
Opcode Fuzzy Hash: d1e2a1cec1042e05b7c7eec9bb6a850c949dafd8eade73ad4bece3ddca9a9b0a
Instruction Fuzzy Hash: 1031EC7BB802002FE101D358AC42FBBB3A48FC5B22F154637F646AA181D561F91562A3

Uniqueness

Uniqueness Score: -1.00%

Function 12025A70 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(?,?,?,?,120043BF,?,?), ref: 12025AAD
sk_value.LIBEAY32(?,00000000,?), ref: 12025ABC
X509_STORE_CTX_init.LIBEAY32(?,?,00000000,?,?,00000000,?), ref: 12025AC9
ERR_put_error.LIBEAY32(00000014,000000CF,0000000B,.\ssl\ssl_cert.c,000002D6,?,?,?,?,?,?,?), ref: 12025AE8
X509_STORE_CTX_set_flags.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 12025B11
SSL_get_ex_data_X509_STORE_CTX_idx.SSLEAY32(?,?,?,?,?,?,?,?,?,?), ref: 12025B1A

Part of subcall function 120252C0: CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_cert.c,00000094,00000000,120245F9), ref: 120252E2
Part of subcall function 120252C0: X509_STORE_CTX_get_ex_new_index.LIBEAY32(00000000,SSL for verify callback,00000000,00000000,00000000), ref: 12025301
Part of subcall function 120252C0: CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_cert.c,0000009B), ref: 12025322

X509_STORE_CTX_set_ex_data.LIBEAY32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 12025B25
X509_STORE_CTX_set_default.LIBEAY32(?,ssl_client,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12025B43
X509_VERIFY_PARAM_get_flags.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12025B54
X509_VERIFY_PARAM_set1.LIBEAY32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12025B5D
X509_VERIFY_PARAM_set_depth.LIBEAY32(?,?), ref: 12025B75
X509_verify_cert.LIBEAY32(?), ref: 12025B9F
X509_STORE_CTX_cleanup.LIBEAY32(?), ref: 12025BB8

Strings

ssl_client, xrefs: 12025B31
ssl_server, xrefs: 12025B38, 12025B3D
.\ssl\ssl_cert.c, xrefs: 12025ADA

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: X509_$O_lock$L_get_ex_data_M_get_flagsM_set1M_set_depthR_put_errorX509_verify_certX_cleanupX_get_ex_new_indexX_idxX_initX_set_defaultX_set_ex_dataX_set_flagssk_numsk_value
String ID: .\ssl\ssl_cert.c$ssl_client$ssl_server
API String ID: 3995431402-2548101035
Opcode ID: f6d4ca299f5efbc28f7da2d6d2c984b125f468b1d0f2f2ea056573297df129d8
Instruction ID: 623950627c98f009f281b5489f962853935435bc16ab915ca9a2614388cd0af3
Opcode Fuzzy Hash: f6d4ca299f5efbc28f7da2d6d2c984b125f468b1d0f2f2ea056573297df129d8
Instruction Fuzzy Hash: CD31E9BB6003015FD316DB64DC41FEBB3E8AF88701F448A2EF95697240EA36F5099762

Uniqueness

Uniqueness Score: -1.00%

Function 12011B60 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 467COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s23_srvr.c,00000196,s->version <= TLS_MAX_VERSION), ref: 12011C1B
_strncmp.LIBCMT ref: 12011E59
_strncmp.LIBCMT ref: 12011E6D
_strncmp.LIBCMT ref: 12011E81
_strncmp.LIBCMT ref: 12011E95
_strncmp.LIBCMT ref: 12011EA9
ERR_put_error.LIBEAY32(00000014,00000076,000000FC,.\ssl\s23_srvr.c,00000283), ref: 120121AF

Part of subcall function 120132E0: BIO_read.LIBEAY32(?,?,?,00000000,?,?,12011F04,?,5F9859FB), ref: 12013308
Part of subcall function 120132E0: BIO_read.LIBEAY32(?,?,?), ref: 12013347

Strings

HEAD , xrefs: 12011E7C
s->version <= TLS_MAX_VERSION, xrefs: 12011C0C
.\ssl\s23_srvr.c, xrefs: 12011C16, 12011C3F, 12011CBF, 12011D7A, 12011EBE, 12011ED2, 12011EEB, 12011F98, 1201209C, 120120CF, 120121A1
GET , xrefs: 12011E54
POST , xrefs: 12011E68
PUT , xrefs: 12011E90
CONNECT, xrefs: 12011EA4

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: _strncmp$O_read$OpenR_put_error
String ID: .\ssl\s23_srvr.c$CONNECT$GET $HEAD $POST $PUT $s->version <= TLS_MAX_VERSION
API String ID: 4149642059-1747794495
Opcode ID: 32403b462dbee586ae720239c6d03385729fb9a202f3a1989314b9b2201f9fd3
Instruction ID: 617b0e1e962c56c67ba5e20cd9a8c88693e5662104ef47b83a661c8e38ab2ea2
Opcode Fuzzy Hash: 32403b462dbee586ae720239c6d03385729fb9a202f3a1989314b9b2201f9fd3
Instruction Fuzzy Hash: 4D0214B6A04392AFE31ACF24CC44B96FBE1BF54304F048629ED855F282D3B5E155EB91

Uniqueness

Uniqueness Score: -1.00%

Function 1200B3E0 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 401COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000D5,00000004,.\ssl\s3_lib.c,00000CA3), ref: 1200B42A

Strings

.\ssl\s3_lib.c, xrefs: 1200B41C, 1200B4EA, 1200B50A, 1200B546, 1200B55F, 1200B57F, 1200B5BB, 1200B5D4, 1200B5F2, 1200B622, 1200B66F, 1200B6DA, 1200B6EB, 1200B6FF

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_lib.c
API String ID: 1767461275-3880942756
Opcode ID: 71be670b809da2a98ad0448cd3d7749d08eb3165c2493047dc0dec27369f8bd3
Instruction ID: 9e82a8e877a5ba16624dcf57708185b7a0eb2845c05ec824b86c36a96d1f252b
Opcode Fuzzy Hash: 71be670b809da2a98ad0448cd3d7749d08eb3165c2493047dc0dec27369f8bd3
Instruction Fuzzy Hash: E0C114B77457014BF200DF68E880BEAB3E1E7C436BF14463AF649E7240E632E905A745

Uniqueness

Uniqueness Score: -1.00%

Function 1201D0D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

pqueue_size.LIBEAY32(?), ref: 1201D0E7
CRYPTO_malloc.LIBEAY32(0000003C,.\ssl\d1_pkt.c,000000FD), ref: 1201D106
pitem_new.LIBEAY32(?,00000000,0000003C,.\ssl\d1_pkt.c,000000FD), ref: 1201D113
ERR_put_error.LIBEAY32(00000014,000000F7,00000044,.\ssl\d1_pkt.c,00000120), ref: 1201D1E8
CRYPTO_free.LIBEAY32(?), ref: 1201D1F8
CRYPTO_free.LIBEAY32(00000000), ref: 1201D201
pqueue_free.LIBEAY32(?,00000000), ref: 1201D207

Strings

.\ssl\d1_pkt.c, xrefs: 1201D0FF, 1201D1DA, 1201D271

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$O_mallocR_put_errorpitem_newpqueue_freepqueue_size
String ID: .\ssl\d1_pkt.c
API String ID: 4281507345-285292661
Opcode ID: 67a7fa22c3b1d66523077ec60a7af9de1560486612dd5f6775c2c99883b54869
Instruction ID: 4ec22ac1701ed2814924643d6e5f2769eec386d18b622d629af4640e408de654
Opcode Fuzzy Hash: 67a7fa22c3b1d66523077ec60a7af9de1560486612dd5f6775c2c99883b54869
Instruction Fuzzy Hash: 4551C5B6A403009FD709DF18EC80EAAB7E4AF58311F1586BAF9199F391DA35E400DA55

Uniqueness

Uniqueness Score: -1.00%

Function 120313B0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SRP_Verify_B_mod_N.LIBEAY32(?,?,?,?,?), ref: 120313E4
SRP_Calc_u.LIBEAY32(?,?,?), ref: 12031409
SRP_Calc_x.LIBEAY32(?,?,00000000), ref: 12031453
SRP_Calc_client_key.LIBEAY32(?,?,?,?,?,?), ref: 1203148D
BN_num_bits.LIBEAY32(00000000), ref: 1203149C
CRYPTO_malloc.LIBEAY32(-00000007,.\ssl\tls_srp.c,00000191,00000000), ref: 120314BA
BN_bn2bin.LIBEAY32(00000000,00000000), ref: 120314CA
OPENSSL_cleanse.LIBEAY32(00000000,-00000007), ref: 120314E8
CRYPTO_free.LIBEAY32(00000000,00000000,-00000007), ref: 120314EE
BN_clear_free.LIBEAY32(00000000), ref: 120314FB
BN_clear_free.LIBEAY32(?,00000000), ref: 12031505
OPENSSL_cleanse.LIBEAY32(00000000,00000001), ref: 12031521
CRYPTO_free.LIBEAY32(00000000,00000000,00000001), ref: 12031527
BN_clear_free.LIBEAY32(?), ref: 12031534

Strings

.\ssl\tls_srp.c, xrefs: 120314B4

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: N_clear_free$L_cleanseO_free$B_mod_Calc_client_keyCalc_uCalc_xN_bn2binN_num_bitsO_mallocVerify_
String ID: .\ssl\tls_srp.c
API String ID: 2586719652-3972901604
Opcode ID: 8901fd453ab15e7a515ece269b964edcc377c20c7a99ba75c0ed192b14e91c72
Instruction ID: 81b82b2c827c2d5c166b086f3bcdf896ef28b50fc9064763aa5be6b636b1c803
Opcode Fuzzy Hash: 8901fd453ab15e7a515ece269b964edcc377c20c7a99ba75c0ed192b14e91c72
Instruction Fuzzy Hash: 61415CB76007016FD252DB64DC80EBBB3E9AFC9711F144A1CF99A83301EA35E9069762

Uniqueness

Uniqueness Score: -1.00%

Function 12026050 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,00000018,.\ssl\ssl_cert.c,000003F5), ref: 12026092
OPENSSL_DIR_read.LIBEAY32(?,?,00000009,00000018,.\ssl\ssl_cert.c,000003F5), ref: 1202609D
BIO_snprintf.LIBEAY32(?,00000400,%s/%s,?,00000000), ref: 120260EF
SSL_add_file_cert_subjects_to_stack.SSLEAY32(?,?), ref: 12026110
OPENSSL_DIR_read.LIBEAY32(?,?), ref: 12026126
GetLastError.KERNEL32(.\ssl\ssl_cert.c,0000040E), ref: 1202614A
ERR_put_error.LIBEAY32(00000002,0000000A,00000000), ref: 12026155
ERR_add_error_data.LIBEAY32(00000003,OPENSSL_DIR_read(&ctx, ',?,1204152C,00000002,0000000A,00000000), ref: 12026167
ERR_put_error.LIBEAY32(00000014,000000D7,00000002,.\ssl\ssl_cert.c,00000410,00000003,OPENSSL_DIR_read(&ctx, ',?,1204152C,00000002,0000000A,00000000), ref: 1202617F
ERR_put_error.LIBEAY32(00000014,000000D7,0000010E,.\ssl\ssl_cert.c,000003FF), ref: 1202619F
OPENSSL_DIR_end.LIBEAY32 ref: 120261C0
CRYPTO_lock.LIBEAY32(0000000A,00000018,.\ssl\ssl_cert.c,00000419), ref: 120261D6

Strings

OPENSSL_DIR_read(&ctx, ', xrefs: 12026160
%s/%s, xrefs: 120260E0
.\ssl\ssl_cert.c, xrefs: 1202607F, 12026145, 12026171, 1202618E, 120261CD

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_lockR_read$ErrorL_add_file_cert_subjects_to_stackLastO_snprintfR_add_error_dataR_end
String ID: %s/%s$.\ssl\ssl_cert.c$OPENSSL_DIR_read(&ctx, '
API String ID: 2099322235-4005729725
Opcode ID: 2bf11039d33400df31a4a352c5ca8830e7a86423c1ea050b39445a42b3535a71
Instruction ID: bfa269c09ad04ac578cd0c8f50df8c0252602b569c587e7cb82e5b894825fff3
Opcode Fuzzy Hash: 2bf11039d33400df31a4a352c5ca8830e7a86423c1ea050b39445a42b3535a71
Instruction Fuzzy Hash: 9E4150BBB403416FF311C750CC82FFAB3D4AB48709F44472EF745661C2EA71A505A1A2

Uniqueness

Uniqueness Score: -1.00%

Function 12012A90 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 120132E0: BIO_read.LIBEAY32(?,?,?,00000000,?,?,12011F04,?,5F9859FB), ref: 12013308
Part of subcall function 120132E0: BIO_read.LIBEAY32(?,?,?), ref: 12013347

SSLv3_client_method.SSLEAY32 ref: 12012B4E
TLSv1_client_method.SSLEAY32 ref: 12012B6C
TLSv1_1_client_method.SSLEAY32 ref: 12012B8A
TLSv1_2_client_method.SSLEAY32 ref: 12012BB0
OpenSSLDie.LIBEAY32(.\ssl\s23_clnt.c,00000307,s->version <= TLS_MAX_VERSION), ref: 12012BD9
SSL_connect.SSLEAY32 ref: 12012D01
TLSv1_2_client_method.SSLEAY32 ref: 12012D38
TLSv1_1_client_method.SSLEAY32 ref: 12012D45
ERR_put_error.LIBEAY32(00000014,00000077,00000102,.\ssl\s23_clnt.c,000002FF), ref: 12012D7A
ERR_put_error.LIBEAY32(00000014,00000077,000000FC,.\ssl\s23_clnt.c,0000033B), ref: 12012DB4

Strings

s->version <= TLS_MAX_VERSION, xrefs: 12012BCA
.\ssl\s23_clnt.c, xrefs: 12012AED, 12012BD4, 12012C6D, 12012D69, 12012DA6

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_readR_put_errorSv1_1_client_methodSv1_2_client_method$L_connectLv3_client_methodOpenSv1_client_method
String ID: .\ssl\s23_clnt.c$s->version <= TLS_MAX_VERSION
API String ID: 3050789455-3156374052
Opcode ID: c51c70f249c027df4740180eb110df77d7c07bcaec22bc6d4d4a5ca94dfc182e
Instruction ID: ee51861cdbab8222b260417ed615ce72719b3b1cc7076328fe5c6c89206fdda8
Opcode Fuzzy Hash: c51c70f249c027df4740180eb110df77d7c07bcaec22bc6d4d4a5ca94dfc182e
Instruction Fuzzy Hash: CD9104B6A04752AFE322CF21C856BA6B7E5AF44314F00871EE9994F6C1D7B4F090E752

Uniqueness

Uniqueness Score: -1.00%

Function 120262B0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBEAY32(?,0000000A), ref: 1202632A
ERR_put_error.LIBEAY32(00000014,0000013E,0000000B,.\ssl\ssl_cert.c,00000465,?,?,?,?,?,00000000), ref: 12026349
X509_STORE_CTX_init.LIBEAY32(?,?,00000000,00000000,?,00000000), ref: 1202639E
X509_verify_cert.LIBEAY32(?,?,?,?,?,?,00000000), ref: 120263BD
ERR_clear_error.LIBEAY32(?,?,?,?,?,?,00000000), ref: 120263C2
sk_num.LIBEAY32(?,?,?,?,?,?,?,00000000), ref: 120263CE
sk_num.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 12026404
sk_value.LIBEAY32(?,00000000,?,?,?,?,?,?,?,00000000), ref: 120263E6

Part of subcall function 12026200: i2d_X509.LIBEAY32(00000000,00000000,?,00000000,12026443,?,?,00000000,?,?,00000000), ref: 12026213
Part of subcall function 12026200: BUF_MEM_grow_clean.LIBEAY32(12026443,00000003,?,00000000,?,?,00000000), ref: 12026229
Part of subcall function 12026200: i2d_X509.LIBEAY32(00000000), ref: 12026263
Part of subcall function 12026200: ERR_put_error.LIBEAY32(00000014,0000013F,00000007,.\ssl\ssl_cert.c,00000426,?,00000000,?,?,00000000), ref: 12026297

X509_STORE_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,00000000), ref: 12026415
sk_num.LIBEAY32(?,?,00000000), ref: 12026420
sk_value.LIBEAY32(?,00000000,?,?,00000000), ref: 12026432
sk_num.LIBEAY32(?,?,?,?,?,?,00000000), ref: 12026450
X509_STORE_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 12026471

Strings

.\ssl\ssl_cert.c, xrefs: 1202633B, 120263AF

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$X509_$M_grow_cleanR_put_errorX509X_cleanupi2d_sk_value$R_clear_errorX509_verify_certX_init
String ID: .\ssl\ssl_cert.c
API String ID: 3599936654-3404700246
Opcode ID: 789a45595424ffe7e9fd078b1bcd92d7336cb88c574151041d689a57ad47566b
Instruction ID: a16eb26beae032c67430e0d04c31316e19e2a6421e40d4ca674e7acaf1ead161
Opcode Fuzzy Hash: 789a45595424ffe7e9fd078b1bcd92d7336cb88c574151041d689a57ad47566b
Instruction Fuzzy Hash: 1141E9BB7003415FD341CB60DD80BEBB3E8AB94715F884A3AEE5987241E676F4099652

Uniqueness

Uniqueness Score: -1.00%

Function 1202BAC0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

X509_get_pubkey.LIBEAY32(?,?,?,1202C6C2,00000000), ref: 1202BAC7
ERR_put_error.LIBEAY32(00000014,000000BF,0000010C,.\ssl\ssl_rsa.c,0000018F,00000000), ref: 1202BAEB
ERR_put_error.LIBEAY32(00000014,000000BF,000000F7,.\ssl\ssl_rsa.c,00000195,?,?,00000000), ref: 1202BB1C
EVP_PKEY_free.LIBEAY32(00000000,00000014,000000BF,000000F7,.\ssl\ssl_rsa.c,00000195,?,?,00000000), ref: 1202BB22

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BADA, 1202BB0B, 1202BBB6

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$X509_get_pubkeyY_free
String ID: .\ssl\ssl_rsa.c
API String ID: 254201522-614043423
Opcode ID: 07a197b9765af398d3aadd8343509e4a139451729c0802e2575f59e5134b4d32
Instruction ID: 3506ab72a6b44f729654de941a1a70ec4cfb216a87f5c2b10f116e838cbe6f8b
Opcode Fuzzy Hash: 07a197b9765af398d3aadd8343509e4a139451729c0802e2575f59e5134b4d32
Instruction Fuzzy Hash: E521E6B7A407016FE742DB649C41FBBB3B89B44706F040639FE099A181FB71F510A761

Uniqueness

Uniqueness Score: -1.00%

Function 120173C0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 399COMMON

Download Yara Rule

APIs

X509_chain_check_suiteb.LIBEAY32(00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 120174E0
sk_num.LIBEAY32(?,?,?,?,?,?,?,?,000000FF), ref: 120175D7
sk_value.LIBEAY32(?,00000000), ref: 120175E9
sk_num.LIBEAY32(?), ref: 120175FF

Part of subcall function 12013E80: X509_get_pubkey.LIBEAY32(?,?,?,12017645,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 12013E95

sk_num.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 120176C1
sk_num.LIBEAY32(?), ref: 1201770F
sk_value.LIBEAY32(?,00000000), ref: 12017722
sk_num.LIBEAY32(?), ref: 1201773A
sk_num.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 12017765
sk_value.LIBEAY32(?,00000000), ref: 12017777
sk_num.LIBEAY32(?), ref: 1201778E
X509_certificate_type.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 120177DD

Strings

@, xrefs: 1201764C

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$sk_value$X509_certificate_typeX509_chain_check_suitebX509_get_pubkey
String ID: @
API String ID: 682326728-2766056989
Opcode ID: 85966b93e9e3266a74109c523ebb64088ec05ade9c814ee78e90d8f0829062c6
Instruction ID: 2fbf94b48da3daa701723cb3b65e78e95cbbb8deeb5f14ec2c029e9554795e62
Opcode Fuzzy Hash: 85966b93e9e3266a74109c523ebb64088ec05ade9c814ee78e90d8f0829062c6
Instruction Fuzzy Hash: 49E1B577A443428BD70ECE14C884BABB6D4BB84718F000B2DEC559B2B1D774E948E792

Uniqueness

Uniqueness Score: -1.00%

Function 1201A380 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 219COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_enc.c,000004C3), ref: 1201A39F
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_enc.c,000004D1), ref: 1201A3DB
ERR_put_error.LIBEAY32(00000014,0000013A,00000041,.\ssl\t1_enc.c,0000050D), ref: 1201A3FC
CRYPTO_free.LIBEAY32(00000000), ref: 1201A5DB
CRYPTO_free.LIBEAY32(00000000), ref: 1201A5E8

Strings

.\ssl\t1_enc.c, xrefs: 1201A397, 1201A3D5, 1201A3EE, 1201A54F
server finished, xrefs: 1201A4C3
client finished, xrefs: 1201A484
master secret, xrefs: 1201A4FF
key expansion, xrefs: 1201A525

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc$R_put_error
String ID: .\ssl\t1_enc.c$client finished$key expansion$master secret$server finished
API String ID: 3736327811-3288890549
Opcode ID: f42fcb91f2a645b90f6ab023921ee13368050cf6e12c642ca07baf09b0593246
Instruction ID: 7c2c3a12d2de8a80685d05224c17059ab1ea30b7ad9c0e49f56e3ad198e17744
Opcode Fuzzy Hash: f42fcb91f2a645b90f6ab023921ee13368050cf6e12c642ca07baf09b0593246
Instruction Fuzzy Hash: E6612973E042845FE312CB248845BAB7BE2EB85314F4A46A8ED853F341D621FD85D791

Uniqueness

Uniqueness Score: -1.00%

Function 1201C8D0 Relevance: 22.6, APIs: 15, Instructions: 93COMMON

Download Yara Rule

APIs

pqueue_pop.LIBEAY32(?), ref: 1201C8DB
CRYPTO_free.LIBEAY32(?), ref: 1201C8FB
CRYPTO_free.LIBEAY32(?), ref: 1201C907
pqueue_free.LIBEAY32(00000000,?), ref: 1201C90D
pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C91C
pqueue_pop.LIBEAY32(?), ref: 1201C934
CRYPTO_free.LIBEAY32(?), ref: 1201C94D
CRYPTO_free.LIBEAY32(?), ref: 1201C959
pqueue_free.LIBEAY32(00000000,?), ref: 1201C95F
pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C96E
pqueue_pop.LIBEAY32(?), ref: 1201C986
CRYPTO_free.LIBEAY32(?), ref: 1201C99F
CRYPTO_free.LIBEAY32(?), ref: 1201C9AB
pqueue_free.LIBEAY32(00000000,?), ref: 1201C9B1
pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C9C0

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freepqueue_pop$pqueue_free
String ID:
API String ID: 2595648820-0
Opcode ID: 790fc77eb44bf5a8f960dae9b4526b68ed6fc7df742bd9536694abecf20a3a75
Instruction ID: d00becd74a0f39f822423fd742fd9820cc5ee27e668966a69db936cb27737f50
Opcode Fuzzy Hash: 790fc77eb44bf5a8f960dae9b4526b68ed6fc7df742bd9536694abecf20a3a75
Instruction Fuzzy Hash: 2C31B47BA006115BC262D760C888FAFB3E46F09310B094B28EC595F714E738F952E7E2

Uniqueness

Uniqueness Score: -1.00%

Function 1200FA60 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s3_pkt.c,0000028A,s->s3->wnum <= INT_MAX), ref: 1200FA96
SSL_state.SSLEAY32(?), ref: 1200FAB6
ERR_put_error.LIBEAY32(00000014,0000009E,000000E5,.\ssl\s3_pkt.c,00000293,?,000021D1), ref: 1200FAF4
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200FC48
X509_NAME_ENTRY_get_object.LIBEAY32(?,?,000021D1), ref: 1200FC5B
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1200FD67
X509_get_issuer_name.LIBEAY32(?,?,000021D1), ref: 1200FD80
ERR_put_error.LIBEAY32(00000014,00000068,0000008D,.\ssl\s3_pkt.c,000003F8,?,000021D1), ref: 1200FDCE
EVP_MD_size.LIBEAY32(00000000,?,?,000021D1), ref: 1200FC61

Part of subcall function 1200E210: SetLastError.KERNEL32(00000000,80000000), ref: 1200E262
Part of subcall function 1200E210: BIO_write.LIBEAY32(?,?,?), ref: 1200E287
Part of subcall function 1200E210: ERR_put_error.LIBEAY32(00000014,0000009F,00000080,.\ssl\s3_pkt.c,0000045B), ref: 1200E2A7

ERR_put_error.LIBEAY32(00000014,0000009E,0000010F,.\ssl\s3_pkt.c,000002A2,?,000021D1), ref: 1200FF84

Strings

.\ssl\s3_pkt.c, xrefs: 1200FA91, 1200FAE3, 1200FDC0, 1200FF24, 1200FF73
s->s3->wnum <= INT_MAX, xrefs: 1200FA87

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$X509_Y_get_object$D_sizeErrorL_stateLastO_writeOpenX509_get_issuer_nameX_flags
String ID: .\ssl\s3_pkt.c$s->s3->wnum <= INT_MAX
API String ID: 663342747-654347666
Opcode ID: edc1860676de84eeddedb09026c4481be7b8d48a7b72efaaacb70dc3947df475
Instruction ID: 04372e43f71802c1bf35446a703f16f1882f6a40b0e8459c1562bce7bac1fccd
Opcode Fuzzy Hash: edc1860676de84eeddedb09026c4481be7b8d48a7b72efaaacb70dc3947df475
Instruction Fuzzy Hash: DCF102766047429FF301CF28C888BA6B7E1BF84358F04472DE88987391DB75E945EB96

Uniqueness

Uniqueness Score: -1.00%

Function 1201A050 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1201A0B8
EVP_MD_size.LIBEAY32(00000000,?), ref: 1201A0BE
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,00000405,t >= 0), ref: 1201A0DB
EVP_MD_CTX_copy.LIBEAY32(?,?), ref: 1201A0F8

Part of subcall function 12011220: OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,000001C7,data_plus_mac_plus_padding_size < 1024 * 1024,?,?,?,?), ref: 120112B5
Part of subcall function 12011220: X509_NAME_ENTRY_get_object.LIBEAY32(?,?,?,?,?), ref: 120112BE
Part of subcall function 12011220: pqueue_peek.LIBEAY32(00000000,?,?,?,?,?), ref: 120112C4
Part of subcall function 12011220: SHA_Init.LIBEAY32(?,?,?), ref: 120112F3

EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1201A1DA
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1201A23B
EVP_DigestUpdate.LIBEAY32(?,?,0000000D), ref: 1201A261
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1201A276
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 1201A28D
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1201A2A5

Strings

.\ssl\t1_enc.c, xrefs: 1201A0D6
t >= 0, xrefs: 1201A0CC

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$OpenUpdateX509_X_cleanupY_get_object$D_sizeFinalInitSignX_copyX_flagspqueue_peek
String ID: .\ssl\t1_enc.c$t >= 0
API String ID: 4021478592-2679512843
Opcode ID: 11bafd55420687f7702203f5e037bc5d373e010c1f83e398a2ed20eb327d7248
Instruction ID: 41ac478e9e7dd49ebdebf94eb5c2b7339a435ad9f63613f03b892dcabffd9d71
Opcode Fuzzy Hash: 11bafd55420687f7702203f5e037bc5d373e010c1f83e398a2ed20eb327d7248
Instruction Fuzzy Hash: 7F817CB66083819FC305CF68C880BABB7F5BF99304F144A2DF9958B241E735E948DB52

Uniqueness

Uniqueness Score: -1.00%

Function 120158F0 Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 465COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,?,?,12016298,12006201,12006201,?,FFFFFFFF,?,12006201,?,?,?), ref: 1201592E
CRYPTO_free.LIBEAY32(?), ref: 12015A7B
CRYPTO_malloc.LIBEAY32(12006201,.\ssl\t1_lib.c,00000AB2), ref: 12015A8E
SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 12015B08
CRYPTO_free.LIBEAY32(?,?,12006201,?,?,?), ref: 12015BEB
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,00000B1E,?,?,12006201,?,?,?), ref: 12015C00
BUF_strdup.LIBEAY32(?), ref: 12015DEF
ERR_put_error.LIBEAY32(00000014,00000141,00000152,.\ssl\t1_lib.c,00000B9B), ref: 12015F12

Strings

.\ssl\t1_lib.c, xrefs: 12015A88, 12015BFA, 12015CAE, 12015EFB

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$O_malloc$F_strdupL_ctrlR_put_error
String ID: .\ssl\t1_lib.c
API String ID: 1794571826-2047370388
Opcode ID: f44e2106c22d7af2de106513a3fdf915d9eaece8660af7d25167811c585512b6
Instruction ID: 57152967bee781843a1e4c28a99c30611a778a7a527a2df499750a579e0004e4
Opcode Fuzzy Hash: f44e2106c22d7af2de106513a3fdf915d9eaece8660af7d25167811c585512b6
Instruction Fuzzy Hash: 7CF12572A043419FD315CF24E884BEBBBE4EF84318F88066DE9998F241D736E545EB61

Uniqueness

Uniqueness Score: -1.00%

Function 1201FBD0 Relevance: 19.6, APIs: 13, Instructions: 94COMMON

Download Yara Rule

APIs

SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201FBE3
BIO_ctrl.LIBEAY32(00000000), ref: 1201FBEC
SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201FC1B
BIO_ctrl.LIBEAY32(00000000), ref: 1201FC24
SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 1201FC49
SSL_get_wbio.SSLEAY32(?,00000028,00000000,00000000), ref: 1201FC63
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FC6C
SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201FC84
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FC8D
SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201FCAE
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FCB7
SSL_get_wbio.SSLEAY32(?,0000002A,?,00000000), ref: 1201FCDE
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FCE7

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_wbioO_ctrl$L_ctrl
String ID:
API String ID: 1073945668-0
Opcode ID: 1c721d55027b8bc242048e8795590909e34420e23a4e9cc212c6c9861306fa09
Instruction ID: c519e4a0b379f4d3b8fba617ca3c5825799b014d4c567904ff629bd1be581dd6
Opcode Fuzzy Hash: 1c721d55027b8bc242048e8795590909e34420e23a4e9cc212c6c9861306fa09
Instruction Fuzzy Hash: D0314979A407003FF351D6288C0AF7AB3949B5430AF244A7AF90D6F2C6F5F9B1419649

Uniqueness

Uniqueness Score: -1.00%

Function 1201D8C0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 202COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000101,00000092,.\ssl\d1_pkt.c,00000260), ref: 1201DB05

Part of subcall function 1200E440: SSL_CTX_remove_session.SSLEAY32(?,?), ref: 1200E48A

Strings

.\ssl\d1_pkt.c, xrefs: 1201D90C, 1201D9AB, 1201DA84, 1201DAB5, 1201DAD3, 1201DAEF
@, xrefs: 1201D99C
mac_size <= EVP_MAX_MD_SIZE, xrefs: 1201D9A1

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorX_remove_session
String ID: .\ssl\d1_pkt.c$@$mac_size <= EVP_MAX_MD_SIZE
API String ID: 456774654-2169613476
Opcode ID: 0c8fbbe2e351721e0905075f3aeaf10c86b57229266261e0860841a899372c6d
Instruction ID: 6e89f3ba014863254f45d960eea2177c2e160c991d7ce504a6c6032a2583f881
Opcode Fuzzy Hash: 0c8fbbe2e351721e0905075f3aeaf10c86b57229266261e0860841a899372c6d
Instruction Fuzzy Hash: A86118B7A44301AFE310EB74DC81BABF3E4BB44705F408A29E6598B281E775F514DB92

Uniqueness

Uniqueness Score: -1.00%

Function 120278B0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

SSL_SESSION_new.SSLEAY32(?,?,00000008,1200134B,?,00000001), ref: 120278C2

Part of subcall function 12026DE0: CRYPTO_malloc.LIBEAY32(000000F4,.\ssl\ssl_sess.c,000000C4), ref: 12026DF1
Part of subcall function 12026DE0: ERR_put_error.LIBEAY32(00000014,000000BD,00000041,.\ssl\ssl_sess.c,000000C6), ref: 12026E14

SSL_get_default_timeout.SSLEAY32(?,?,?,?,00000008,1200134B,?,00000001), ref: 120278E9
SSL_SESSION_free.SSLEAY32(?,?,?,?,00000008,1200134B,?,00000001), ref: 12027902
BUF_strdup.LIBEAY32(?), ref: 12027A62
ERR_put_error.LIBEAY32(00000014,000000B5,00000044,.\ssl\ssl_sess.c,00000215,?,?,?,00000008,1200134B,?,00000001), ref: 12027ABE
SSL_SESSION_free.SSLEAY32(00000000,00000014,000000B5,00000044,.\ssl\ssl_sess.c,00000215,?,?,?,00000008,1200134B,?,00000001), ref: 12027AC4

Strings

.\ssl\ssl_sess.c, xrefs: 12027997, 120279C9, 120279F6, 12027A49, 12027A80, 12027A91, 12027AB0

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: N_freeR_put_error$F_strdupL_get_default_timeoutN_newO_malloc
String ID: .\ssl\ssl_sess.c
API String ID: 4023725585-1959455021
Opcode ID: 6b1fa284865b60ff6a747cc1ac470cf304216af373077dc899b22db9139b4578
Instruction ID: fc203b012bc6d13d2a3cd1a70633238897cda1378ccec17aa12cc617ee54bb4e
Opcode Fuzzy Hash: 6b1fa284865b60ff6a747cc1ac470cf304216af373077dc899b22db9139b4578
Instruction Fuzzy Hash: 1051A1B3640342AEE729CE64CC80BEAF3E4AB58714F900B3FE685E6690D771A550E751

Uniqueness

Uniqueness Score: -1.00%

Function 120312A0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

SRP_Verify_A_mod_N.LIBEAY32(?,?,?,?), ref: 120312CC
SRP_Calc_u.LIBEAY32(?,?,?), ref: 120312F1
SRP_Calc_server_key.LIBEAY32(?,?,?,?,?), ref: 12031326
BN_num_bits.LIBEAY32(00000000), ref: 12031337
CRYPTO_malloc.LIBEAY32(-00000007,.\ssl\tls_srp.c,00000162,00000000), ref: 12031355
BN_bn2bin.LIBEAY32(00000000,00000000), ref: 12031365
OPENSSL_cleanse.LIBEAY32(00000000,-00000007), ref: 12031383
CRYPTO_free.LIBEAY32(00000000,00000000,-00000007), ref: 12031389
BN_clear_free.LIBEAY32(00000000), ref: 12031394
BN_clear_free.LIBEAY32(?,00000000), ref: 1203139E

Strings

.\ssl\tls_srp.c, xrefs: 1203134F

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: N_clear_free$A_mod_Calc_server_keyCalc_uL_cleanseN_bn2binN_num_bitsO_freeO_mallocVerify_
String ID: .\ssl\tls_srp.c
API String ID: 795914763-3972901604
Opcode ID: f31755bc897bc5bbb8c039697513192e8eb3686eb2e13fbaf54f9142657c176e
Instruction ID: f3e9653059a6a9f567b2ee636cb0940b33f7050c8412841008beb7f0a115222c
Opcode Fuzzy Hash: f31755bc897bc5bbb8c039697513192e8eb3686eb2e13fbaf54f9142657c176e
Instruction Fuzzy Hash: 0B214BB66007056FD291DB65CC80EBBB3EDEF89751F044A1CB99983241DB71FC4496A2

Uniqueness

Uniqueness Score: -1.00%

Function 120252C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_cert.c,00000094,00000000,120245F9), ref: 120252E2
X509_STORE_CTX_get_ex_new_index.LIBEAY32(00000000,SSL for verify callback,00000000,00000000,00000000), ref: 12025301
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_cert.c,0000009B), ref: 12025322
CRYPTO_lock.LIBEAY32(00000005,0000000C,.\ssl\ssl_cert.c,000000A1,120245F9), ref: 1202533C
CRYPTO_lock.LIBEAY32(00000006,0000000C,.\ssl\ssl_cert.c,000000A4), ref: 1202535C
CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_cert.c,000000A5,00000006,0000000C,.\ssl\ssl_cert.c,000000A4), ref: 1202536F
X509_STORE_CTX_get_ex_new_index.LIBEAY32(00000000,SSL for verify callback,00000000,00000000,00000000), ref: 1202538E
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_cert.c,000000B1), ref: 120253A9
CRYPTO_lock.LIBEAY32(00000006,0000000C,.\ssl\ssl_cert.c,000000B3), ref: 120253C5

Strings

SSL for verify callback, xrefs: 120252FA, 12025387
.\ssl\ssl_cert.c, xrefs: 120252D9, 12025319, 12025333, 12025353, 12025366, 120253A0, 120253BC

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$X509_X_get_ex_new_index
String ID: .\ssl\ssl_cert.c$SSL for verify callback
API String ID: 3006592226-852846603
Opcode ID: b134c0a4e0e8c3845e68c824f1e3b76e21b9e21b9e522b3b68c7bafd5634271d
Instruction ID: 34751451cf5c39d25e374d2f3c4faea57711db145cf249c22f34337c3d89160b
Opcode Fuzzy Hash: b134c0a4e0e8c3845e68c824f1e3b76e21b9e21b9e522b3b68c7bafd5634271d
Instruction Fuzzy Hash: E2214D36BC4390BBF260E354CD83F96A7A0A744B0AF99D711FF497E1C3E9D1A8512186

Uniqueness

Uniqueness Score: -1.00%

Function 120058B0 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000083,00000183,.\ssl\s3_clnt.c,000002C9), ref: 12005962
ERR_put_error.LIBEAY32(00000014,00000083,0000010A,.\ssl\s3_clnt.c,000002D0), ref: 12005999
DTLSv1_client_method.SSLEAY32 ref: 120059B3
DTLSv1_2_client_method.SSLEAY32 ref: 120059CB
ERR_put_error.LIBEAY32(00000014,00000083,000000B5,.\ssl\s3_clnt.c,00000345), ref: 12005A99
SSL_get_ciphers.SSLEAY32(?,?,00000000), ref: 12005B1D
sk_num.LIBEAY32(?), ref: 12005B72
sk_value.LIBEAY32(?,00000000), ref: 12005B9E

Part of subcall function 12014290: SSL_get_ciphers.SSLEAY32(00000000,00000000,?,?,00000000,12005BEB,?,?,?,?), ref: 120142C7
Part of subcall function 12014290: sk_num.LIBEAY32(00000000,00000000,00000000,?,?,00000000,12005BEB,?,?,?,?), ref: 120142CF
Part of subcall function 12014290: sk_value.LIBEAY32(00000000,00000000,?,?), ref: 120142E2
Part of subcall function 12014290: sk_num.LIBEAY32(00000000,?,?,?,?), ref: 120142F8

Part of subcall function 1200E440: SSL_CTX_remove_session.SSLEAY32(?,?), ref: 1200E48A

ERR_put_error.LIBEAY32(00000014,00000083,00000044,.\ssl\s3_clnt.c,00000371,?,00000002,?), ref: 12005C12

Strings

.\ssl\s3_clnt.c, xrefs: 12005951, 12005988, 12005A8B, 12005B38, 12005BC5, 12005C04

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_num$L_get_cipherssk_value$Sv1_2_client_methodSv1_client_methodX_remove_session
String ID: .\ssl\s3_clnt.c
API String ID: 2006378157-2155475665
Opcode ID: 5a1020c648ec1343fc84db3cf48431f7e9d707e81f118758d1a098618aa80dad
Instruction ID: 2eadc871bb96ecde0444b4d006ca1363b458cf2ad4a15c8c484a40f3639f1e2d
Opcode Fuzzy Hash: 5a1020c648ec1343fc84db3cf48431f7e9d707e81f118758d1a098618aa80dad
Instruction Fuzzy Hash: 19A10076600345AFF711CF14EC85FEA3BE4BF44354F048268EE494B282E275E589DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1201DB70 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\d1_pkt.c,00000637,len <= SSL3_RT_MAX_PLAIN_LENGTH,?,-00000013,1201FB4B,?,00000018,00000000,00000025), ref: 1201DB97
OpenSSLDie.LIBEAY32(.\ssl\d1_pkt.c,0000064D,120404F4), ref: 1201DBC5
X509_NAME_ENTRY_get_object.LIBEAY32(?,?,00000000), ref: 1201DC27
X509_NAME_ENTRY_get_object.LIBEAY32(?,00000025), ref: 1201DC44
EVP_MD_size.LIBEAY32(00000000,?,00000025), ref: 1201DC4A
EVP_CIPHER_CTX_flags.LIBEAY32(?,?,00000000), ref: 1201DCA2
X509_get_issuer_name.LIBEAY32(?,00000025), ref: 1201DCBB
ERR_put_error.LIBEAY32(00000014,000000F5,0000008D,.\ssl\d1_pkt.c,000006C2,00000025), ref: 1201DD21

Strings

.\ssl\d1_pkt.c, xrefs: 1201DB92, 1201DBC0, 1201DD10
len <= SSL3_RT_MAX_PLAIN_LENGTH, xrefs: 1201DB88

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: OpenX509_Y_get_object$D_sizeR_put_errorX509_get_issuer_nameX_flags
String ID: .\ssl\d1_pkt.c$len <= SSL3_RT_MAX_PLAIN_LENGTH
API String ID: 2157370477-491979900
Opcode ID: 7e21ae19fff7ebd7dbc819c93a1837a015e188e66201e882a528fbbbc02a7880
Instruction ID: ccbfbaa348a1e4b1a5b70948cd8e8e589592ee91add2e0a81272f2b944297e83
Opcode Fuzzy Hash: 7e21ae19fff7ebd7dbc819c93a1837a015e188e66201e882a528fbbbc02a7880
Instruction Fuzzy Hash: 8191DEB26047429FD315DF28C880BE6F7E0BF89314F144B69E99A8B391D770E944DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1202F210 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

SSL_CTX_ctrl.SSLEAY32(?,0000005E,?,00000000), ref: 1202F2AF

Strings

automatic, xrefs: 1202F243
auto, xrefs: 1202F270

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: X_ctrl
String ID: auto$automatic
API String ID: 3359300933-1510859630
Opcode ID: 9082319e6bb4974ad74f3ac263cb6cf6f0ee4fdebc5d2f4770344e479b01066f
Instruction ID: e5982ed5730516fa61420906356eb8db60dc9c4db49889fdbf27ef45c9c32bcc
Opcode Fuzzy Hash: 9082319e6bb4974ad74f3ac263cb6cf6f0ee4fdebc5d2f4770344e479b01066f
Instruction Fuzzy Hash: 2A31306BA4424617E712D9B45C89BE7B7C88B036F5F84036BED40DB2C1F782E409A1D0

Uniqueness

Uniqueness Score: -1.00%

Function 1203508C Relevance: 16.8, APIs: 11, Instructions: 288COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 12035129
_write_string.LIBCMT ref: 12035149
_write_multi_char.LIBCMT ref: 1203516B
__cftof.LIBCMT ref: 120351AB
_write_string.LIBCMT ref: 120351CE
_write_multi_char.LIBCMT ref: 12035217

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: _write_multi_char$_write_string$__cftof
String ID:
API String ID: 3900997005-0
Opcode ID: 250aff6e0be6ac5a07fb827d1cc9c126170b5f9327b5ab81c2fcd3b33c77088f
Instruction ID: a5a39e7864efaa4cb5b3bd1cac812cbc4bf1e0ac8fb0643e745ed8d227c61da2
Opcode Fuzzy Hash: 250aff6e0be6ac5a07fb827d1cc9c126170b5f9327b5ab81c2fcd3b33c77088f
Instruction Fuzzy Hash: 22C1657AC4526D8EDB62CA10DC887EDBBB4FB09306F1102D6D409AA1A0C7765BC5EF40

Uniqueness

Uniqueness Score: -1.00%

Function 120350A5 Relevance: 16.8, APIs: 11, Instructions: 285COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 12035129
_write_string.LIBCMT ref: 12035149
_write_multi_char.LIBCMT ref: 1203516B
__cftof.LIBCMT ref: 120351AB
_write_string.LIBCMT ref: 120351CE
_write_multi_char.LIBCMT ref: 12035217

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: _write_multi_char$_write_string$__cftof
String ID:
API String ID: 3900997005-0
Opcode ID: 9ee346f8c306642bef59db90756f1d17292c5c7654a66ae86188166ea32d3f63
Instruction ID: 8ae463a0f7436d38b1b343bfeefc52415a20f393686471a35f837962bed2f522
Opcode Fuzzy Hash: 9ee346f8c306642bef59db90756f1d17292c5c7654a66ae86188166ea32d3f63
Instruction Fuzzy Hash: 4DC1657AC4526D8EDB63CA10DC887E9BBB4FB09316F1102D6D409AA1A0CB765BC5EF40

Uniqueness

Uniqueness Score: -1.00%

Function 1202FB50 Relevance: 16.6, APIs: 11, Instructions: 143COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBEAY32(?,0000000F), ref: 1202FB81
SSL_read.SSLEAY32(?,?,?,?,0000000F), ref: 1202FB8D
SSL_get_error.SSLEAY32(?,00000000,?,?,?,?,0000000F), ref: 1202FB96

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_errorL_readO_clear_flags
String ID:
API String ID: 138930502-0
Opcode ID: 026bfc0caba4f1f6042b936ce35ce9c16be7cfb1d8ec7630e83993c745e7d662
Instruction ID: 309fbb7ca0415040c884f0b662e4926860d39c52ca4653ccaacd3db68ce7094d
Opcode Fuzzy Hash: 026bfc0caba4f1f6042b936ce35ce9c16be7cfb1d8ec7630e83993c745e7d662
Instruction Fuzzy Hash: 0341B47AA043049FD700DF1DEC816ABB7E8EB84766F90853FEC0586201D279F41D9BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1201D3E0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 301COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\d1_pkt.c,0000064D,120404F4), ref: 1201D432

Part of subcall function 1200E210: SetLastError.KERNEL32(00000000,80000000), ref: 1200E262
Part of subcall function 1200E210: BIO_write.LIBEAY32(?,?,?), ref: 1200E287
Part of subcall function 1200E210: ERR_put_error.LIBEAY32(00000014,0000009F,00000080,.\ssl\s3_pkt.c,0000045B), ref: 1200E2A7

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1201D484
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1201D4FC
X509_get_issuer_name.LIBEAY32(?), ref: 1201D519
ERR_put_error.LIBEAY32(00000014,000000F5,0000008D,.\ssl\d1_pkt.c,000006C2), ref: 1201D57F
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1201D74C

Strings

.\ssl\d1_pkt.c, xrefs: 1201D42D, 1201D56E

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$ErrorLastO_ctrlO_writeOpenX509_X509_get_issuer_nameX_flagsY_get_object
String ID: .\ssl\d1_pkt.c
API String ID: 690001995-285292661
Opcode ID: bf57e4f1def12ffa7a47387c25f0188ef1f9fd1df835f2b8a64e0a9500fa46a5
Instruction ID: a21c90d0a0a62928ad194dd800654f58e6e952b3d4e347b37244816fdd33e417
Opcode Fuzzy Hash: bf57e4f1def12ffa7a47387c25f0188ef1f9fd1df835f2b8a64e0a9500fa46a5
Instruction Fuzzy Hash: 6BB1DF726007429FD315DF29C880BE6B7E0BF89318F044A6DE9998B381E774F545DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1201F050 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

pqueue_find.LIBEAY32(?,?), ref: 1201F0DF
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,00000301,((long)msg_hdr->msg_len) > 0), ref: 1201F224
CRYPTO_free.LIBEAY32(?), ref: 1201F25E
pitem_new.LIBEAY32(?,?), ref: 1201F27E

Strings

.\ssl\d1_both.c, xrefs: 1201F21F, 1201F32B
item != NULL, xrefs: 1201F321
((long)msg_hdr->msg_len) > 0, xrefs: 1201F215

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeOpenpitem_newpqueue_find
String ID: ((long)msg_hdr->msg_len) > 0$.\ssl\d1_both.c$item != NULL
API String ID: 4078150540-2643215950
Opcode ID: 2a3709623e152f64579b824020f9eddb070ce4b06d820c5ddc7a9323357800bc
Instruction ID: 6ac34921b2cf8945d0c0733634d49e8049b2db35af3545baff08188eff9fc01b
Opcode Fuzzy Hash: 2a3709623e152f64579b824020f9eddb070ce4b06d820c5ddc7a9323357800bc
Instruction Fuzzy Hash: 9991F4766043828FC715CF68C888BAAB7E1BF98324F08476DE8558F782D730E905DB91

Uniqueness

Uniqueness Score: -1.00%

Function 12006890 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000011B,00000041,.\ssl\s3_clnt.c,00000926), ref: 120069B3
SSL_SESSION_free.SSLEAY32(?), ref: 120069DE

Part of subcall function 12026F30: CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000E,.\ssl\ssl_sess.c,0000035A,?,1202714B,?,?,?,120217F7,?,00000000,?), ref: 12026F52
Part of subcall function 12026F30: CRYPTO_free_ex_data.LIBEAY32(00000003,?,?), ref: 12026F6C
Part of subcall function 12026F30: OPENSSL_cleanse.LIBEAY32(?,00000008,00000003,?,?), ref: 12026F77
Part of subcall function 12026F30: OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000008,00000003,?,?), ref: 12026F82
Part of subcall function 12026F30: OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000030,?,00000008,00000003,?,?), ref: 12026F8D
Part of subcall function 12026F30: X509_free.LIBEAY32(?), ref: 12026FB3
Part of subcall function 12026F30: sk_free.LIBEAY32(?), ref: 12026FC6
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?), ref: 12026FD9
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?), ref: 12026FEC
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?), ref: 12027009
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?), ref: 12027026
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?), ref: 12027039
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?), ref: 1202704C
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?), ref: 1202705F
Part of subcall function 12026F30: OPENSSL_cleanse.LIBEAY32(?,000000F4), ref: 1202706D
Part of subcall function 12026F30: CRYPTO_free.LIBEAY32(?,?,000000F4), ref: 12027073

CRYPTO_free.LIBEAY32(?), ref: 12006A01
CRYPTO_malloc.LIBEAY32(?,.\ssl\s3_clnt.c,00000932), ref: 12006A24
ERR_put_error.LIBEAY32(00000014,0000011B,00000041,.\ssl\s3_clnt.c,00000934), ref: 12006A5B
EVP_sha256.LIBEAY32(00000000), ref: 12006A9E
EVP_Digest.LIBEAY32(?,?,?,?,00000000,00000000), ref: 12006AAE

Strings

.\ssl\s3_clnt.c, xrefs: 120068D9, 1200692E, 120069A2, 12006A1E, 12006A4D

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanse$R_put_error$DigestN_freeO_add_lockO_free_ex_dataO_mallocP_sha256X509_freesk_free
String ID: .\ssl\s3_clnt.c
API String ID: 2478572562-2155475665
Opcode ID: 31c73862b533a0a3433ca4526bf60234f660076ca7b6c57a9ebcaeaea066673a
Instruction ID: 41ec133aea32ea2c0129bfa45a5feddac4e15cd6b82f53201561d649becbe756
Opcode Fuzzy Hash: 31c73862b533a0a3433ca4526bf60234f660076ca7b6c57a9ebcaeaea066673a
Instruction Fuzzy Hash: 21513372A00202AFF609CB64CC80FAAB7A9BF44355F144729F6596BAC2D770A410DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 120308C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\t1_reneg.c,000000F0,!expected_len || s->s3->previous_client_finished_len), ref: 120308F6
OpenSSLDie.LIBEAY32(.\ssl\t1_reneg.c,000000F1,!expected_len || s->s3->previous_server_finished_len), ref: 12030919
ERR_put_error.LIBEAY32(00000014,0000012D,00000150,.\ssl\t1_reneg.c,000000F6,?,12006201,12015D09,?,?,00000000,?), ref: 12030940
ERR_put_error.LIBEAY32(00000014,0000012D,00000150,.\ssl\t1_reneg.c,00000100,?,?,12006201,12015D09,?,?,00000000,?), ref: 1203097D
ERR_put_error.LIBEAY32(00000014,0000012D,00000151,.\ssl\t1_reneg.c,00000110,?,?,12006201,12015D09,?,?,00000000,?), ref: 12030A05
ERR_put_error.LIBEAY32(00000014,0000012D,00000151,.\ssl\t1_reneg.c,00000119,?,?,12006201,12015D09,?,?,00000000,?), ref: 12030A8E

Strings

!expected_len || s->s3->previous_server_finished_len, xrefs: 1203090A
.\ssl\t1_reneg.c, xrefs: 120308F1, 12030914, 1203092F, 1203096C, 120309F4, 12030A7D
!expected_len || s->s3->previous_client_finished_len, xrefs: 120308E7

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$Open
String ID: !expected_len || s->s3->previous_client_finished_len$!expected_len || s->s3->previous_server_finished_len$.\ssl\t1_reneg.c
API String ID: 3578803784-3367045297
Opcode ID: f750d3deee68ec15abf5e551bf9bc0162a20ae6a97711ae0d937626ea9eab708
Instruction ID: 1a51725d550d42d441785b8f66f9c62203f20a84b82876116bf91c467264e5c9
Opcode Fuzzy Hash: f750d3deee68ec15abf5e551bf9bc0162a20ae6a97711ae0d937626ea9eab708
Instruction Fuzzy Hash: FA5124726851851FF303CB14D841BF93BE39F4131AF1946FAE6896A582C662E480E390

Uniqueness

Uniqueness Score: -1.00%

Function 1202BBE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000B1,00000043,.\ssl\ssl_rsa.c,0000020A), ref: 1202BBFC
ERR_put_error.LIBEAY32(00000014,000000B1,00000041,.\ssl\ssl_rsa.c,0000020E), ref: 1202BC33

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BBEE, 1202BC25, 1202BC51

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: bc12cb73949bc01593c96b6e0cddfd5b3c38c0ca3898079c92dd33d7a22589ec
Instruction ID: 7013f9310c5c9da37a9ad9dd2a7b0f1e5c52c3ccc201e3bc4fb7e7f903068685
Opcode Fuzzy Hash: bc12cb73949bc01593c96b6e0cddfd5b3c38c0ca3898079c92dd33d7a22589ec
Instruction Fuzzy Hash: B9110AB7B813002AF611E7B85C82FEB53584F54B22F944532FA05E91C1FB91F5613066

Uniqueness

Uniqueness Score: -1.00%

Function 1202C880 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000CC,00000043,.\ssl\ssl_rsa.c,00000096), ref: 1202C89C
ERR_put_error.LIBEAY32(00000014,000000CC,00000041,.\ssl\ssl_rsa.c,0000009A), ref: 1202C8D3

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C88E, 1202C8C5, 1202C8F1

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: 60c27ff1d9d4aed5f3e9f5847edf4d1412122d9d5d698ae1a7eb2d7e4afd70e5
Instruction ID: d0a3b37abc214547bec658ab7b832fc63d4ae332a0d04369dca8f98ed2460c49
Opcode Fuzzy Hash: 60c27ff1d9d4aed5f3e9f5847edf4d1412122d9d5d698ae1a7eb2d7e4afd70e5
Instruction Fuzzy Hash: 8B113AA7B813013AF611E7B89C82FDB52584F54B62F150633FA09EA1C1F651E52031A5

Uniqueness

Uniqueness Score: -1.00%

Function 12023860 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

BIO_f_buffer.LIBEAY32(00000000,?,12005532,?,00000001), ref: 1202386D
BIO_new.LIBEAY32(00000000,00000000,?,12005532,?,00000001), ref: 12023873
BIO_pop.LIBEAY32(?,00000000,?,12005532,?,00000001), ref: 1202388E
BIO_ctrl.LIBEAY32(?,00000001,00000000,00000000,00000000,?,12005532,?,00000001), ref: 120238A0
BIO_int_ctrl.LIBEAY32(?,00000075,00000001,00000000,?,00000001,00000000,00000000,00000000,?,12005532,?,00000001), ref: 120238AC
ERR_put_error.LIBEAY32(00000014,000000B8,00000007,.\ssl\ssl_lib.c,00000C29), ref: 120238CB
BIO_push.LIBEAY32(?,?,?,?,?,?,?,?,00000001), ref: 120238E8
BIO_pop.LIBEAY32(?,?,?,?,?,?,?,00000001), ref: 12023901

Strings

.\ssl\ssl_lib.c, xrefs: 120238BD

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_pop$O_ctrlO_f_bufferO_int_ctrlO_newO_pushR_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 156715244-3333140318
Opcode ID: 87190111594886734df9722fd9b8b9a2cec7b63549057b24b8ba1f606f835f27
Instruction ID: 8c4414098abb1ca9c547ecac8db2eb5d8b29708a84c978db5ba800ea8158c456
Opcode Fuzzy Hash: 87190111594886734df9722fd9b8b9a2cec7b63549057b24b8ba1f606f835f27
Instruction Fuzzy Hash: 4811B277F407117BE213DB24AC01BDAA3B8AB05B11F400722F900AE680E3E0B99192D2

Uniqueness

Uniqueness Score: -1.00%

Function 120240E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000A4,000000BC,.\ssl\ssl_lib.c,000000C2), ref: 12024103
SSL_SESSION_free.SSLEAY32(?), ref: 12024124
ERR_put_error.LIBEAY32(00000014,000000A4,00000044,.\ssl\ssl_lib.c,000000DC), ref: 12024159

Strings

.\ssl\ssl_lib.c, xrefs: 120240F2, 1202414B

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$N_free
String ID: .\ssl\ssl_lib.c
API String ID: 483722116-3333140318
Opcode ID: c5b56822a3eaf8b856a5c02a599cb148ec40642cf3e75bc5788332badbf79d42
Instruction ID: 9a42051a03c50ede7f5c77ed0bd32e4aa3c1ac01ef567403cf44cef418ff7d66
Opcode Fuzzy Hash: c5b56822a3eaf8b856a5c02a599cb148ec40642cf3e75bc5788332badbf79d42
Instruction Fuzzy Hash: 984176B6A00B008FE762CF29E840B97F7F4BF84304F554A2EE58A9B651D770B481DB81

Uniqueness

Uniqueness Score: -1.00%

Function 1200A8A0 Relevance: 13.6, APIs: 9, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 1200CEC0: OPENSSL_cleanse.LIBEAY32(00000000,?), ref: 1200CEDF
Part of subcall function 1200CEC0: CRYPTO_free.LIBEAY32(00000000,00000000,?), ref: 1200CEEE

CRYPTO_free.LIBEAY32(?), ref: 1200A8F8
DH_free.LIBEAY32(?), ref: 1200A90E
EC_KEY_free.LIBEAY32(?), ref: 1200A924
sk_pop_free.LIBEAY32(?,Function_00031B44), ref: 1200A93F
BIO_free.LIBEAY32(?), ref: 1200A955
CRYPTO_free.LIBEAY32(?), ref: 1200A980
SSL_SRP_CTX_free.SSLEAY32(?), ref: 1200A989
OPENSSL_cleanse.LIBEAY32(?,0000042C,?), ref: 1200A997
CRYPTO_free.LIBEAY32(?,?,0000042C,?), ref: 1200A9A0

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanse$H_freeX_freeY_freesk_pop_free
String ID:
API String ID: 981315686-0
Opcode ID: a74b0c112ad0982bb04e15912042dda4017631edec54418919a214a1a323f53d
Instruction ID: 481922330ecdfa00d4984be525658f0f7cac0a33788187fa2bf9cb2439b45956
Opcode Fuzzy Hash: a74b0c112ad0982bb04e15912042dda4017631edec54418919a214a1a323f53d
Instruction Fuzzy Hash: 5B2181B6F007409BF712CB21C844FABB3E8AF04349F050738E5469B651EA75F585EB96

Uniqueness

Uniqueness Score: -1.00%

Function 12030AC0 Relevance: 13.6, APIs: 9, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,?,12022C2E,?), ref: 12030AD8
BN_free.LIBEAY32(?,?,?,?,12022C2E,?), ref: 12030AE4
BN_free.LIBEAY32(?,?,?,?,?,12022C2E,?), ref: 12030AF0
BN_free.LIBEAY32(?,?,?,?,?,?,12022C2E,?), ref: 12030AFC
BN_free.LIBEAY32(?,?,?,?,?,?,?,12022C2E,?), ref: 12030B08
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,12022C2E,?), ref: 12030B14
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?,12022C2E,?), ref: 12030B20
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,12022C2E,?), ref: 12030B2C
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,12022C2E,?), ref: 12030B38

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: N_free$O_free
String ID:
API String ID: 3506937590-0
Opcode ID: f6715e65f56730b1781256080da6325bb7d85795ac8ec107f33c2cf5667828bf
Instruction ID: 09b2eb8b182ee2ae330bee6aaa1b8b77880ae51824e2a95f19a123722a425396
Opcode Fuzzy Hash: f6715e65f56730b1781256080da6325bb7d85795ac8ec107f33c2cf5667828bf
Instruction Fuzzy Hash: A121B8B6A04B00AFD661DF7AD450AD7F7F8AF98301F014A1EA1AE87210DB75B441DB60

Uniqueness

Uniqueness Score: -1.00%

Function 12030BB0 Relevance: 13.6, APIs: 9, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 12030BC8
BN_free.LIBEAY32(?,?), ref: 12030BD4
BN_free.LIBEAY32(?,?,?), ref: 12030BE0
BN_free.LIBEAY32(?,?,?,?), ref: 12030BEC
BN_free.LIBEAY32(?,?,?,?,?), ref: 12030BF8
BN_free.LIBEAY32(?,?,?,?,?,?), ref: 12030C04
BN_free.LIBEAY32(?,?,?,?,?,?,?), ref: 12030C10
BN_free.LIBEAY32(?,?,?,?,?,?,?,?), ref: 12030C1C
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 12030C28

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: N_free$O_free
String ID:
API String ID: 3506937590-0
Opcode ID: bb792955a2e71d4c8a960a2001c1a1886a56036fc43e0ac9206971f1962b806a
Instruction ID: 0e8b8a05211f088a2fdcbd12b4de97b44e87765bc59ad18dc229f3d1a7bb5a01
Opcode Fuzzy Hash: bb792955a2e71d4c8a960a2001c1a1886a56036fc43e0ac9206971f1962b806a
Instruction Fuzzy Hash: D521C3B6A01B00AFD6A1DF7AD490AD7F7F8AF99301F014A1EE1AA87210D7B0B441DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1201FA80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SSL_state.SSLEAY32(?), ref: 1201FABD
CRYPTO_malloc.LIBEAY32(00000025,.\ssl\d1_both.c,0000061D), ref: 1201FAE7
RAND_bytes.LIBEAY32(-00000003,00000010), ref: 1201FB22
RAND_bytes.LIBEAY32(-00000013,00000010), ref: 1201FB34
CRYPTO_free.LIBEAY32(00000000), ref: 1201FB84
ERR_put_error.LIBEAY32(00000014,00000131,0000016D,.\ssl\d1_both.c,000005FD,?,?,1200B7F2), ref: 1201FBB9

Strings

.\ssl\d1_both.c, xrefs: 1201FAAD, 1201FAE0, 1201FB97, 1201FBA8

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: D_bytes$L_stateO_freeO_mallocR_put_error
String ID: .\ssl\d1_both.c
API String ID: 1882168250-2895748750
Opcode ID: b3e9c83dd6bf5a8bcf2cba0b5532b7bb0e8861ce25808b85215a2c2fb836f3b9
Instruction ID: c846f416a95fbcefb0a60c099af187c5515bf32d1e5baa5f28ff6afe9908f401
Opcode Fuzzy Hash: b3e9c83dd6bf5a8bcf2cba0b5532b7bb0e8861ce25808b85215a2c2fb836f3b9
Instruction Fuzzy Hash: A9313F737803457BF701CA149C86FE7B3A85F61718F048318FD482D6C2E6E6E551A3A2

Uniqueness

Uniqueness Score: -1.00%

Function 12020A40 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32(?,?,12020B43,?), ref: 12020A4E
ERR_put_error.LIBEAY32(00000014,00000135,0000016A,.\ssl\d1_srtp.c,000000B0,?,?,12020B43,?), ref: 12020A6F
sk_find.LIBEAY32(00000000,?), ref: 12020AC3
sk_push.LIBEAY32(00000000,?), ref: 12020AD1
ERR_put_error.LIBEAY32(00000014,00000135,0000016C,.\ssl\d1_srtp.c,000000C3), ref: 12020B17
sk_free.LIBEAY32(00000000,00000014,00000135,0000016C,.\ssl\d1_srtp.c,000000C3), ref: 12020B1D

Strings

.\ssl\d1_srtp.c, xrefs: 12020A5E, 12020AE7, 12020B06

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_findsk_freesk_new_nullsk_push
String ID: .\ssl\d1_srtp.c
API String ID: 3835093942-3998674507
Opcode ID: 65cfa4ae2d37da82d2c26c498ae10c83c0351ae93012f91bd37884682b0401df
Instruction ID: e03f98b6f961837cb85028dd65a442aa926ea7d47740facf8497bb0e4f4698f0
Opcode Fuzzy Hash: 65cfa4ae2d37da82d2c26c498ae10c83c0351ae93012f91bd37884682b0401df
Instruction Fuzzy Hash: AD2149777403062EE602D6249C01FE7B35B8FA5757F944326FD059B180EA92B504B2A0

Uniqueness

Uniqueness Score: -1.00%

Function 12027080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000C3,000000F0,.\ssl\ssl_sess.c,00000398), ref: 120270D1
SSL_set_ssl_method.SSLEAY32(?,?), ref: 120270E5
CRYPTO_add_lock.LIBEAY32(?,00000001,0000000E,.\ssl\ssl_sess.c,000003B0), ref: 12027106
SSL_SESSION_free.SSLEAY32(?), ref: 12027119
SSL_SESSION_free.SSLEAY32(?,?,?,120217F7,?,00000000,?), ref: 12027146
SSL_set_ssl_method.SSLEAY32(?,?,?,?,120217F7,?,00000000,?), ref: 12027167

Strings

.\ssl\ssl_sess.c, xrefs: 120270C0, 120270F6

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: L_set_ssl_methodN_free$O_add_lockR_put_error
String ID: .\ssl\ssl_sess.c
API String ID: 926238990-1959455021
Opcode ID: 13b90a05fa30128346f77ea159cebb421026cce5398b7c3b0d35bf69a608a6ec
Instruction ID: b41a1b157ff8485181a411418ee02592877e137846f6ffabb273f5d8ede4dcb4
Opcode Fuzzy Hash: 13b90a05fa30128346f77ea159cebb421026cce5398b7c3b0d35bf69a608a6ec
Instruction Fuzzy Hash: AC21D3767407029BE724CB68EC81FE7B3E8AF84304F404A2AF91AD7250E771F541E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 120292E0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 120293F7
_strncmp.LIBCMT ref: 12029472
ERR_put_error.LIBEAY32(00000014,000000E6,00000118,.\ssl\ssl_ciph.c,000004C6,?,00000000,00000001,00000000), ref: 120295F9

Strings

STRENGTH, xrefs: 1202946C
.\ssl\ssl_ciph.c, xrefs: 120295E8, 12029612

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: _strncmp$R_put_error
String ID: .\ssl\ssl_ciph.c$STRENGTH
API String ID: 3709734218-4120156686
Opcode ID: f611ac621e4a2b722fb3b8ca74e6bbe0ff448207296dbb0a118b3598bd6a8b54
Instruction ID: faa0d62e25e51b70deef53a1e04b230b6d7f7978daef9998432ac387d9f07f4f
Opcode Fuzzy Hash: f611ac621e4a2b722fb3b8ca74e6bbe0ff448207296dbb0a118b3598bd6a8b54
Instruction Fuzzy Hash: F5B1C476A0834A8FD702CE18C584BEAB7E4AB85388FE0471FF99583290D371D446EB57

Uniqueness

Uniqueness Score: -1.00%

Function 1201F350 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

pqueue_find.LIBEAY32(?,?), ref: 1201F3BA
pitem_new.LIBEAY32(?,00000000), ref: 1201F4AC
pqueue_insert.LIBEAY32(?,00000000), ref: 1201F4C3
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,00000377,item != NULL), ref: 1201F4DE

Strings

.\ssl\d1_both.c, xrefs: 1201F4D9
item != NULL, xrefs: 1201F4CF

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Openpitem_newpqueue_findpqueue_insert
String ID: .\ssl\d1_both.c$item != NULL
API String ID: 3897113090-143540491
Opcode ID: 74f70250deef5e290fd6e98b0b5b7e8709c5a91f948c159f635755943e67fcee
Instruction ID: 8e83d70c1b0ef903ceabb82069215c61898b6b317ecdfa7a9fdbabecca77b1e1
Opcode Fuzzy Hash: 74f70250deef5e290fd6e98b0b5b7e8709c5a91f948c159f635755943e67fcee
Instruction Fuzzy Hash: CC51C9B26043424BD321DF68D885BABB3E4BF98314F044B2DF5998B241E774E90497A2

Uniqueness

Uniqueness Score: -1.00%

Function 12016AD0 Relevance: 10.6, APIs: 7, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 12016920: CRYPTO_free.LIBEAY32(?,00000000,?,?,?,12016AEC,?,?,?,1201873E,?,?,00000000,12001A88,?), ref: 1201694E
Part of subcall function 12016920: CRYPTO_malloc.LIBEAY32(00000000,.\ssl\t1_lib.c,00000F0F), ref: 12016A02

ERR_set_mark.LIBEAY32(00000000,?), ref: 12016B69
EVP_PKEY_get_default_digest_nid.LIBEAY32(00000000,?,00000000,?), ref: 12016B82
ERR_pop_to_mark.LIBEAY32 ref: 12016BBB
EVP_sha1.LIBEAY32 ref: 12016C31
EVP_sha1.LIBEAY32 ref: 12016C3F
EVP_sha1.LIBEAY32 ref: 12016C47
EVP_sha1.LIBEAY32 ref: 12016C58

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: P_sha1$O_freeO_mallocR_pop_to_markR_set_markY_get_default_digest_nid
String ID:
API String ID: 2753321895-0
Opcode ID: a1cb41b53f7c2c9bba1d8b0c2d7341734d71a2635f05af167f45a21796708d11
Instruction ID: 50858e87df94b2008b88ed6b2990f6570cbf2b21c9abf58c032eed31b0d7a729
Opcode Fuzzy Hash: a1cb41b53f7c2c9bba1d8b0c2d7341734d71a2635f05af167f45a21796708d11
Instruction Fuzzy Hash: 9641CF728042428FCB12CF68CCC47EAB7F0FB45315F044A69D8598F256E735E489EB61

Uniqueness

Uniqueness Score: -1.00%

Function 12022270 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SSL_get_ciphers.SSLEAY32(?), ref: 120222AD
sk_num.LIBEAY32(?), ref: 120222C4
sk_num.LIBEAY32(00000000), ref: 120222D5
sk_num.LIBEAY32(?), ref: 120222E9
sk_value.LIBEAY32(?,00000000), ref: 120222F7
sk_find.LIBEAY32(?,00000000,?,00000000), ref: 12022304
sk_num.LIBEAY32(?), ref: 1202234B

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$L_get_cipherssk_findsk_value
String ID:
API String ID: 1236675727-0
Opcode ID: 8dfae41303ffd931adf47a194eb6951b3e1860b3da03fbed65d1562287dc11d3
Instruction ID: 18e879d04a86ec9e752da8c4bac651537b7b96c88469db2af200fb58b7640225
Opcode Fuzzy Hash: 8dfae41303ffd931adf47a194eb6951b3e1860b3da03fbed65d1562287dc11d3
Instruction Fuzzy Hash: 8E313AB76043415FD711CFB49D807ABB7D9DF85354F440B7AE88983201E721E805D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 12010030 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 96COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s3_both.c,000000B5,i <= EVP_MAX_MD_SIZE), ref: 120100B6

Strings

i <= EVP_MAX_MD_SIZE, xrefs: 120100A7, 120100E4
.\ssl\s3_both.c, xrefs: 120100B1, 120100EE
@, xrefs: 120100DF
@, xrefs: 120100A2

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Open
String ID: .\ssl\s3_both.c$@$@$i <= EVP_MAX_MD_SIZE
API String ID: 71445658-1993513779
Opcode ID: 40be8a98187cfaed1c2dec77419f86731cc654c6e112e3b66e9c3dddbdf40f5c
Instruction ID: 070faa1e71cdd01671983abb4c54f34dd7c094a8b154eddad74149386e534ffe
Opcode Fuzzy Hash: 40be8a98187cfaed1c2dec77419f86731cc654c6e112e3b66e9c3dddbdf40f5c
Instruction Fuzzy Hash: 5631F5B6201741AFD311EB44CD80EA7B3E5EF88324F04466CE9859B711E678F945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 12027B10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_sess.c,0000033E,?,?,12027E78,00000001,?), ref: 12027B3B
lh_retrieve.LIBEAY32(00000001,?,?,?,?,12027E78,00000001,?), ref: 12027B49
lh_delete.LIBEAY32(00000001,?,00000001,?), ref: 12027B61
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_sess.c,00000346), ref: 12027B86
SSL_SESSION_free.SSLEAY32(00000000), ref: 12027BAB

Strings

.\ssl\ssl_sess.c, xrefs: 12027B32, 12027B7D

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$N_freelh_deletelh_retrieve
String ID: .\ssl\ssl_sess.c
API String ID: 614341428-1959455021
Opcode ID: 453cc74295f20d92ec066d79820d601ae8cffaa99b201aaf1e9a97db51c9783b
Instruction ID: 05c79065bb457ee0395b7a855774d750c5f01f89667f93f39cc05ce6cf293fb1
Opcode Fuzzy Hash: 453cc74295f20d92ec066d79820d601ae8cffaa99b201aaf1e9a97db51c9783b
Instruction Fuzzy Hash: 49010867B803096BE316DAA0AC41FB7B2EC9B54719F04072BBD0856291E7B1A54061A2

Uniqueness

Uniqueness Score: -1.00%

Function 12025BD0 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32 ref: 12025BD3
sk_num.LIBEAY32(?), ref: 12025BE1
sk_value.LIBEAY32(?,00000000), ref: 12025BF2
X509_NAME_dup.LIBEAY32(00000000,?,00000000), ref: 12025BF8
sk_push.LIBEAY32(00000000,00000000), ref: 12025C06
sk_num.LIBEAY32(?), ref: 12025C14
sk_pop_free.LIBEAY32(00000000,Function_00031B44), ref: 12025C2C

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$E_dupX509_sk_new_nullsk_pop_freesk_pushsk_value
String ID:
API String ID: 1341318936-0
Opcode ID: 53a18c00e582fa63a3ad5e995ebc4f5643ae0a4aa656c96552aa4f86f65fe54f
Instruction ID: 26e3e6a292558f57b470f06a765cc28272e8d1075529a5d7a3096ab9aa05dea5
Opcode Fuzzy Hash: 53a18c00e582fa63a3ad5e995ebc4f5643ae0a4aa656c96552aa4f86f65fe54f
Instruction Fuzzy Hash: C6F02BDF9001102F9602D6796C409BBD1AC895D693B450B36FC02D1101FA02E415B2B6

Uniqueness

Uniqueness Score: -1.00%

Function 12016830 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

EVP_md5.LIBEAY32(?,00000000,?,?,120169ED,00000000,?,?), ref: 12016864
EVP_sha1.LIBEAY32(?,00000000,?,?,120169ED,00000000,?,?), ref: 1201686B
EVP_sha224.LIBEAY32(?,00000000,?,?,120169ED,00000000,?,?), ref: 12016872
EVP_sha256.LIBEAY32(?,00000000,?,?,120169ED,00000000,?,?), ref: 12016879
EVP_sha384.LIBEAY32(?,00000000,?,?,120169ED,00000000,?,?), ref: 12016880
EVP_sha512.LIBEAY32(?,00000000,?,?,120169ED,00000000,?,?), ref: 12016887

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: P_md5P_sha1P_sha224P_sha256P_sha384P_sha512
String ID:
API String ID: 840344691-0
Opcode ID: eb28e7247ac25330997d4914d20fae90f3692b5494294b1a08cb217ab6af2a23
Instruction ID: 62beb5979140f3cb57d856844718930c6b7216bd2f1b5f7ed5ccfbb51f71d101
Opcode Fuzzy Hash: eb28e7247ac25330997d4914d20fae90f3692b5494294b1a08cb217ab6af2a23
Instruction Fuzzy Hash: A821083790C2578EC30AEF7C9C540AAFBE8AF55205B04875FE4958FA05D522E409FF22

Uniqueness

Uniqueness Score: -1.00%

Function 120310A0 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

SRP_get_default_gN.LIBEAY32(?), ref: 120310A6
BN_dup.LIBEAY32(?), ref: 120310BF
BN_dup.LIBEAY32(?,?), ref: 120310D2
BN_clear_free.LIBEAY32(00000000), ref: 120310ED
BN_clear_free.LIBEAY32(?), ref: 1203110C
SRP_create_verifier_BN.LIBEAY32(?,?,?,?,?,?), ref: 1203112E

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: N_clear_freeN_dup$P_create_verifier_P_get_default_g
String ID:
API String ID: 1988882276-0
Opcode ID: 864a434d40905804c6012350ba1ba1375abc65d512cec25e7886666110632e00
Instruction ID: bf5b192a4b847ef1b7f65762fc437d85fb458f1900a28f82da7ade47e7d574f1
Opcode Fuzzy Hash: 864a434d40905804c6012350ba1ba1375abc65d512cec25e7886666110632e00
Instruction Fuzzy Hash: CE1170F65046016FD751CB68DC40BA7B7F8AF89351F054A18E89883241E735F815DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 12017070 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

OBJ_sn2nid.LIBEAY32(00000001), ref: 1201718F
OBJ_ln2nid.LIBEAY32(00000001), ref: 1201719C

Strings

ECDSA, xrefs: 12017156
RSA, xrefs: 120170E3
DSA, xrefs: 1201711F

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: J_ln2nidJ_sn2nid
String ID: DSA$ECDSA$RSA
API String ID: 1214796006-3559535724
Opcode ID: 3711bbc1a0da3029ce16d3e6a056c23594f47e512824bd59807e96778e58306e
Instruction ID: 8aa15d404fe46c0ffaab3431b57f842569d704d9ead8bf1f792a229cff83f2e9
Opcode Fuzzy Hash: 3711bbc1a0da3029ce16d3e6a056c23594f47e512824bd59807e96778e58306e
Instruction Fuzzy Hash: C5514C339082824FD31BCF3C88957E67BD6AF46254F844B98D8858F265E722D50DD392

Uniqueness

Uniqueness Score: -1.00%

Function 12017200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,0000109F,?,?,12018A28,?,?,?,?), ref: 1201721A

Strings

.\ssl\t1_lib.c, xrefs: 12017214

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_malloc
String ID: .\ssl\t1_lib.c
API String ID: 1457121658-2047370388
Opcode ID: 137b099a1c1f7c763ee51d06831cd4af8044be7e3f41ae07eb72acd489ba692e
Instruction ID: e6086aba46df25009c4eb373b84c7808e61bb34520f1d42c71840dd069367434
Opcode Fuzzy Hash: 137b099a1c1f7c763ee51d06831cd4af8044be7e3f41ae07eb72acd489ba692e
Instruction Fuzzy Hash: 21310C73A053044BD329CA79D88069AB3D4EB55335F204B29F49A872A0D731F8579751

Uniqueness

Uniqueness Score: -1.00%

Function 12020BB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000,00000000,?,00000010,12014C42,00000000,00000000,?,00000000), ref: 12020BE0
ERR_put_error.LIBEAY32(00000014,00000133,00000162,.\ssl\d1_srtp.c,000000FE,00000000), ref: 12020C10
ERR_put_error.LIBEAY32(00000014,00000133,0000016B,.\ssl\d1_srtp.c,00000104,00000000), ref: 12020C41
sk_value.LIBEAY32(00000000,00000000,?,00000000), ref: 12020C6A

Strings

.\ssl\d1_srtp.c, xrefs: 12020BFF, 12020C30

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_numsk_value
String ID: .\ssl\d1_srtp.c
API String ID: 2202921107-3998674507
Opcode ID: 5403976ed6206ef3af5b1576127072032f392331783d8c5fe2bde3fef6211b9f
Instruction ID: 4f1b460eac65b0697b15284b1c6c14bbf0619d04adf2366200144fcc62edbc57
Opcode Fuzzy Hash: 5403976ed6206ef3af5b1576127072032f392331783d8c5fe2bde3fef6211b9f
Instruction Fuzzy Hash: 812188B320434A4FD712CF1488C0FD6F7E78F61704F4A45BAE9889B142E652E808D320

Uniqueness

Uniqueness Score: -1.00%

Function 1200E210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,80000000), ref: 1200E262
BIO_write.LIBEAY32(?,?,?), ref: 1200E287
ERR_put_error.LIBEAY32(00000014,0000009F,00000080,.\ssl\s3_pkt.c,0000045B), ref: 1200E2A7
ERR_put_error.LIBEAY32(00000014,0000009F,0000007F,.\ssl\s3_pkt.c,0000044F,?,?,1200FEDE,?,?,?,?), ref: 1200E321

Strings

.\ssl\s3_pkt.c, xrefs: 1200E296, 1200E313

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$ErrorLastO_write
String ID: .\ssl\s3_pkt.c
API String ID: 3621644563-4041216366
Opcode ID: 5612b89117473cc6983eae776132eeb2767ba3d73d3c901eaa7dc170a7f38730
Instruction ID: 9cc9e9bfe70c4189287567fde3f80d83cc25bc7568aa220c0c24872920ad72ae
Opcode Fuzzy Hash: 5612b89117473cc6983eae776132eeb2767ba3d73d3c901eaa7dc170a7f38730
Instruction Fuzzy Hash: D531CE726487029BF350CB28D885BD6B7E1BF54724F108B2CE6A9572C1D7B0B884DB94

Uniqueness

Uniqueness Score: -1.00%

Function 12026200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

i2d_X509.LIBEAY32(00000000,00000000,?,00000000,12026443,?,?,00000000,?,?,00000000), ref: 12026213
BUF_MEM_grow_clean.LIBEAY32(12026443,00000003,?,00000000,?,?,00000000), ref: 12026229
i2d_X509.LIBEAY32(00000000), ref: 12026263
ERR_put_error.LIBEAY32(00000014,0000013F,00000007,.\ssl\ssl_cert.c,00000426,?,00000000,?,?,00000000), ref: 12026297

Strings

.\ssl\ssl_cert.c, xrefs: 12026289

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: X509i2d_$M_grow_cleanR_put_error
String ID: .\ssl\ssl_cert.c
API String ID: 1887697227-3404700246
Opcode ID: a69ce3d9cec5f48d7d5770fefa3124c57e9d36d473863025433638a3df27185a
Instruction ID: b5d37624ec97774a0b99613afe8f4f67ad9d148f3ef1ba49d3fb91561d59970d
Opcode Fuzzy Hash: a69ce3d9cec5f48d7d5770fefa3124c57e9d36d473863025433638a3df27185a
Instruction Fuzzy Hash: A01108777483456FE751CF64CC81BA6F7E49F54305F58862DFA488B281E661F808E722

Uniqueness

Uniqueness Score: -1.00%

Function 120018C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

sk_value.LIBEAY32(?,00000000), ref: 120018DE
sk_num.LIBEAY32(?), ref: 120018FC
ERR_put_error.LIBEAY32(00000014,0000008A), ref: 12001C51
sk_free.LIBEAY32(?), ref: 12001C7D

Strings

.\ssl\s3_srvr.c, xrefs: 12001928

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_freesk_numsk_value
String ID: .\ssl\s3_srvr.c
API String ID: 1914634297-3445611115
Opcode ID: e9c2a45af60bc4abce401110548b1d1c94bb1f4e5ab8cac7573919b757d14240
Instruction ID: 8937d7427aa79183c43215d37db936eb116749cfe9694fd5bd8b591ca2063886
Opcode Fuzzy Hash: e9c2a45af60bc4abce401110548b1d1c94bb1f4e5ab8cac7573919b757d14240
Instruction Fuzzy Hash: 790104BBB402405FFB11CB20DC41FAAB3A4AB49342F044725EA496B640E631AA05DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1202BA50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

d2i_PrivateKey.LIBEAY32(?,00000000,?,?), ref: 1202BA6A
ERR_put_error.LIBEAY32(00000014,000000CA,0000000D,.\ssl\ssl_rsa.c,00000172), ref: 1202BA8B
SSL_use_PrivateKey.SSLEAY32(?,00000000), ref: 1202BA9E
EVP_PKEY_free.LIBEAY32(00000000,?,00000000), ref: 1202BAA6

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BA7D

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Private$L_use_R_put_errorY_freed2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 4174641380-614043423
Opcode ID: 963f59e22e231c41e892afa3efb3717879087d97f8a5e5518f13c4b81093686c
Instruction ID: bd811f917a35091124bf723c414c4d74f39ba5136141dba9b92ce82eb3137468
Opcode Fuzzy Hash: 963f59e22e231c41e892afa3efb3717879087d97f8a5e5518f13c4b81093686c
Instruction Fuzzy Hash: 12F0B47B7443112BD251DB68AC41F9B77E49FC8750F044A2AF64897280E670E80492B2

Uniqueness

Uniqueness Score: -1.00%

Function 12021050 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000), ref: 12021089
ERR_put_error.LIBEAY32(00000014,000000AA,000000E6,.\ssl\ssl_lib.c,00000120), ref: 120210B1

Strings

SSLv2, xrefs: 1202105D
ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2, xrefs: 12021064, 12021071
.\ssl\ssl_lib.c, xrefs: 120210A0

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_num
String ID: .\ssl\ssl_lib.c$ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2$SSLv2
API String ID: 3777708388-1426024572
Opcode ID: b33f13a994c23af215f40f51d64da093bc32f65ce54d5b368c44a26583cfa988
Instruction ID: 5f9aba0cc6dc0ccf0b7cc2ba9e92df98e62401109297096251ebed23850bcf79
Opcode Fuzzy Hash: b33f13a994c23af215f40f51d64da093bc32f65ce54d5b368c44a26583cfa988
Instruction Fuzzy Hash: D0F024BFB003406FE6119720CC41FE776A89B44F05F898AB4B405AB692E6A1E800E661

Uniqueness

Uniqueness Score: -1.00%

Function 1202CA90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

d2i_RSAPrivateKey.LIBEAY32(00000000,?,?), ref: 1202CAA5
ERR_put_error.LIBEAY32(00000014,000000CD,0000000D,.\ssl\ssl_rsa.c,00000124), ref: 1202CAC6
SSL_use_RSAPrivateKey.SSLEAY32(?,00000000), ref: 1202CAD9
RSA_free.LIBEAY32(00000000,?,00000000), ref: 1202CAE1

Strings

.\ssl\ssl_rsa.c, xrefs: 1202CAB8

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Private$A_freeL_use_R_put_errord2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 692539868-614043423
Opcode ID: 3bf76bfc6805fdca54c47b71b311333934c7b5be32cb648a9c48d5bd8caea7e3
Instruction ID: b870b7a20d0f409809cf670d6485c751b05cba7c2ff20136306ae7d0f8a26cb2
Opcode Fuzzy Hash: 3bf76bfc6805fdca54c47b71b311333934c7b5be32cb648a9c48d5bd8caea7e3
Instruction Fuzzy Hash: 2EF0EC7BB843103BDA10D7A4AC01FEB77E4CBC4760F064A2AFA049B680E670E81492E1

Uniqueness

Uniqueness Score: -1.00%

Function 1202C820 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

d2i_X509.LIBEAY32(00000000,?,?), ref: 1202C82D
ERR_put_error.LIBEAY32(00000014,000000C7,0000000D,.\ssl\ssl_rsa.c,00000086), ref: 1202C84E
SSL_use_certificate.SSLEAY32(?,00000000), ref: 1202C861
X509_free.LIBEAY32(00000000,?,00000000), ref: 1202C869

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C840

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: L_use_certificateR_put_errorX509X509_freed2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 4116471823-614043423
Opcode ID: 2ea96d89edaf9b030e5c99593db34667fe5821adce383aa40c018c8b570919ae
Instruction ID: 960762392dbc2c74c7e739a1d0a2abe2d0a5d2bdcc5f1fb815f05d9a3f963047
Opcode Fuzzy Hash: 2ea96d89edaf9b030e5c99593db34667fe5821adce383aa40c018c8b570919ae
Instruction Fuzzy Hash: 83E0E52BB852103AD161D3A4AC06FEB23989BC4B61F064736F64996180E860A80592F1

Uniqueness

Uniqueness Score: -1.00%

Function 1200BBCB Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

EVP_PKEY_new.LIBEAY32 ref: 1200BC03
EVP_PKEY_set1_RSA.LIBEAY32(00000000,?), ref: 1200BC1E
EVP_PKEY_set1_DH.LIBEAY32(00000000,?), ref: 1200BC31
EVP_PKEY_set1_EC_KEY.LIBEAY32(00000000,?), ref: 1200BC44
EVP_PKEY_free.LIBEAY32(00000000), ref: 1200BC61

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Y_set1_$Y_freeY_new
String ID:
API String ID: 4207563837-0
Opcode ID: 70e8b369497f6b63574c0135715565832455b3116f7004c202a084db1db959df
Instruction ID: 2139fde799712bc2a4ed35e3af9fdc546a24d7be51c1b1ba5f01bddeabc99f0a
Opcode Fuzzy Hash: 70e8b369497f6b63574c0135715565832455b3116f7004c202a084db1db959df
Instruction Fuzzy Hash: C911E533600A528BFB22DEA894C0BFFB3E5D794252F460B3ED69593500FB316942B659

Uniqueness

Uniqueness Score: -1.00%

Function 12016B97 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_pop_to_mark.LIBEAY32 ref: 12016BBB
EVP_sha1.LIBEAY32 ref: 12016C31
EVP_sha1.LIBEAY32 ref: 12016C3F
EVP_sha1.LIBEAY32 ref: 12016C47
EVP_sha1.LIBEAY32 ref: 12016C58

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: P_sha1$R_pop_to_mark
String ID:
API String ID: 3728491826-0
Opcode ID: c4741a3b3ef0199905cb42978a0ac2d53ff4aad16b08906e51c426eaee7e05c1
Instruction ID: e505c94386a30ec0f8b7cec8b73c2a04865c03ddcd7ab59d5080318d77feda51
Opcode Fuzzy Hash: c4741a3b3ef0199905cb42978a0ac2d53ff4aad16b08906e51c426eaee7e05c1
Instruction Fuzzy Hash: 442138728002958FDB52DF64CCC83A577E0FB48316F045A6AC8598E215E775E099EB21

Uniqueness

Uniqueness Score: -1.00%

Function 12017370 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

X509_get_issuer_name.LIBEAY32(?,?,?,120176EF,?), ref: 12017377
sk_num.LIBEAY32(?,?,?,?,120176EF,?), ref: 12017381
sk_value.LIBEAY32(?,00000000,120176EF,?), ref: 12017392
X509_NAME_cmp.LIBEAY32(00000000,00000000,?,00000000,120176EF,?), ref: 12017399
sk_num.LIBEAY32(?,?,?,?,?,120176EF,?), ref: 120173A7

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$E_cmpX509_X509_get_issuer_namesk_value
String ID:
API String ID: 3873463148-0
Opcode ID: 37368e5d5f6964e1fe917823a6ccad36baf2e8b909e49394d2d5b082b0824270
Instruction ID: 9031cb2f998383174f0e8618d5436d842d37adeb476767afcef7318ead5aa5f7
Opcode Fuzzy Hash: 37368e5d5f6964e1fe917823a6ccad36baf2e8b909e49394d2d5b082b0824270
Instruction Fuzzy Hash: 73E092EF9401212B9752E2B91DC0ABBD2ECCB59796B090A29FC05C6110F755F911B2B6

Uniqueness

Uniqueness Score: -1.00%

Function 1201C820 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

SSL_clear.SSLEAY32(?), ref: 1201C826

Part of subcall function 120240E0: ERR_put_error.LIBEAY32(00000014,000000A4,000000BC,.\ssl\ssl_lib.c,000000C2), ref: 12024103

SSL_ctrl.SSLEAY32(?,00000020,00002000,00000000,?), ref: 1201C835
SSL_accept.SSLEAY32 ref: 1201C848

Part of subcall function 12024FA0: SSL_set_accept_state.SSLEAY32(?), ref: 12024FAC

SSL_get_rbio.SSLEAY32(?,0000002E,00000000,?), ref: 1201C85E
BIO_ctrl.LIBEAY32(00000000,?), ref: 1201C867

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: L_acceptL_clearL_ctrlL_get_rbioL_set_accept_stateO_ctrlR_put_error
String ID:
API String ID: 3099295746-0
Opcode ID: 680035392fbeb0cae788b64de4a606493912db979aa4d025759089a7cf3a4572
Instruction ID: 0a0cc72fd1e04b2bedac55ede8b394cf7a376e8798b610891d9b721b84e190fb
Opcode Fuzzy Hash: 680035392fbeb0cae788b64de4a606493912db979aa4d025759089a7cf3a4572
Instruction Fuzzy Hash: D6E0927BA417203AF251E758AC46FAB73A88F49314F400556F6046B2C2E6F4F54157DA

Uniqueness

Uniqueness Score: -1.00%

Function 120160B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000118,0000009D,.\ssl\t1_lib.c,00000CC2), ref: 1201613C
CRYPTO_free.LIBEAY32(?,?), ref: 12016190

Strings

.\ssl\t1_lib.c, xrefs: 1201612B
p, xrefs: 120160C6

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeR_put_error
String ID: .\ssl\t1_lib.c$p
API String ID: 3735976985-3217429042
Opcode ID: c62a3e5a479a37408df2e1b270f9cfe6f678e884cde74dba2cd7e9343e3c211b
Instruction ID: 9aa165e3abd297037bb3d08f06db8837dbb6805832c07c8ead60b687d291e1af
Opcode Fuzzy Hash: c62a3e5a479a37408df2e1b270f9cfe6f678e884cde74dba2cd7e9343e3c211b
Instruction Fuzzy Hash: 16418D73A006019FE71ACB68CC44BE673E5AB80329F19876DE56A8F2D1CB71E441DB40

Uniqueness

Uniqueness Score: -1.00%

Function 1202C240 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000150,00000043,.\ssl\ssl_rsa.c,00000396), ref: 1202C28F

Part of subcall function 1202C170: SSL_CTX_add_server_custom_ext.SSLEAY32(?,?,1202C0F0,00000000,00000000,1202C0D0,00000000,?,?,?,?,1202C272,00000000), ref: 1202C1E5

CRYPTO_realloc.LIBEAY32(?,?,.\ssl\ssl_rsa.c,000003A6), ref: 1202C2E5
ERR_put_error.LIBEAY32(00000014,00000150,00000184,.\ssl\ssl_rsa.c,000003B4), ref: 1202C343

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C27E, 1202C2B6, 1202C2CB, 1202C2DE, 1202C2F6, 1202C332, 1202C361

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_reallocX_add_server_custom_ext
String ID: .\ssl\ssl_rsa.c
API String ID: 2635170945-614043423
Opcode ID: 9fdc5b9a4283ceb5ab812ccbdaf4dcbecc241aee041121497d4c62f7358fd0d2
Instruction ID: 6ceeee0d2057f9d3ce171d2d8311aa3012085a93383282a571cb82089ecd75de
Opcode Fuzzy Hash: 9fdc5b9a4283ceb5ab812ccbdaf4dcbecc241aee041121497d4c62f7358fd0d2
Instruction Fuzzy Hash: 943125777803016BE201CBD49C81FA77398AB48B45FA64666F7056F2C0DBA1EA50B3D9

Uniqueness

Uniqueness Score: -1.00%

Function 12004BB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000132,00000163,.\ssl\s3_srvr.c,00000E58), ref: 12004BD7
CRYPTO_malloc.LIBEAY32(?,.\ssl\s3_srvr.c,00000E76), ref: 12004C6F
ERR_put_error.LIBEAY32(00000014,00000132,00000041,.\ssl\s3_srvr.c,00000E78), ref: 12004C94

Strings

.\ssl\s3_srvr.c, xrefs: 12004BC6, 12004C29, 12004C69, 12004C86

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_malloc
String ID: .\ssl\s3_srvr.c
API String ID: 1108683871-3445611115
Opcode ID: e1d6a27932ac0f11fe6f5db2c98dc3c245ce0473c660fffc523de77c7c94207f
Instruction ID: 69686287996d1c07b93ababa8c93b7c8d41ef36eba2a3bf4fc4df8085425eec2
Opcode Fuzzy Hash: e1d6a27932ac0f11fe6f5db2c98dc3c245ce0473c660fffc523de77c7c94207f
Instruction Fuzzy Hash: F8214C766843427FF751CB24EC89FC377E4DB80718F014A28F2456E5C2D3B0A981D658

Uniqueness

Uniqueness Score: -1.00%

Function 12013AB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000000,.\ssl\t1_lib.c,0000028A,?,?,12013C8F,?,?,?), ref: 12013AD4
CRYPTO_free.LIBEAY32(?,?,?,?,?), ref: 12013B36

Strings

.\ssl\t1_lib.c, xrefs: 12013AC8

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\t1_lib.c
API String ID: 2609694610-2047370388
Opcode ID: 68ef7aa7eb16282174f3c4ecbb694606812af567895b0c708d48eb394f41f5b2
Instruction ID: e5260a16ea2d2f28ea5d3fe882bce9529145bf09cc6170868ac86296352715c8
Opcode Fuzzy Hash: 68ef7aa7eb16282174f3c4ecbb694606812af567895b0c708d48eb394f41f5b2
Instruction Fuzzy Hash: 9C11D2B3A093024FD310DFA9A88069BF7E5EFD4215F10463DEA859B640EA71F8059792

Uniqueness

Uniqueness Score: -1.00%

Function 120272C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 120272DC
CRYPTO_malloc.LIBEAY32(?,.\ssl\ssl_sess.c,00000430), ref: 12027301
ERR_put_error.LIBEAY32(00000014,00000126,00000041,.\ssl\ssl_sess.c,00000432), ref: 12027326

Strings

.\ssl\ssl_sess.c, xrefs: 120272FB, 12027318

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_mallocR_put_error
String ID: .\ssl\ssl_sess.c
API String ID: 2160744234-1959455021
Opcode ID: a007bccf90b6dc31e093e91aee10f09b67ed83a8f4ce5b5acba9854233b96c9a
Instruction ID: c8127f34947eaf1622b0586a20ae6cc58e1e0931f3d4af58ab9010d3fde437ca
Opcode Fuzzy Hash: a007bccf90b6dc31e093e91aee10f09b67ed83a8f4ce5b5acba9854233b96c9a
Instruction Fuzzy Hash: 09118FB2640B019FE714CF69EC44BD6F3E8AF95301F05896AF549CB360E3B4E940DA95

Uniqueness

Uniqueness Score: -1.00%

Function 12009836 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000087,00000092,.\ssl\s3_clnt.c,00000878,?,00000002,00000032), ref: 120098A7
X509_NAME_free.LIBEAY32(?), ref: 12009B23
sk_pop_free.LIBEAY32(?,Function_00031B44), ref: 12009B39

Strings

.\ssl\s3_clnt.c, xrefs: 12009896

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: E_freeR_put_errorX509_sk_pop_free
String ID: .\ssl\s3_clnt.c
API String ID: 2381510960-2155475665
Opcode ID: 6fcdb5000a6f6df604a59166c0a07cec24135cbaf41f179eb8958e6bd63cd71e
Instruction ID: 1950cdc591033f4ac549b3d539df45cb1563fa14a617b8463fe59f62eda49990
Opcode Fuzzy Hash: 6fcdb5000a6f6df604a59166c0a07cec24135cbaf41f179eb8958e6bd63cd71e
Instruction Fuzzy Hash: A91176327083424FF321CB28CC82FAAB7E0AF44708F084768E5855B682D624E514D756

Uniqueness

Uniqueness Score: -1.00%

Function 12010810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\s3_both.c,00000266,?,12010981,00000001,00000000), ref: 12010821
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\s3_both.c,00000270,120054FC,?,120054FC,?), ref: 1201086D
CRYPTO_malloc.LIBEAY32(1200963F,.\ssl\s3_both.c,00000272,?,?,?,?,120054FC,?,120054FC,?), ref: 12010884

Strings

.\ssl\s3_both.c, xrefs: 12010816, 12010864, 1201087E

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$O_malloc
String ID: .\ssl\s3_both.c
API String ID: 4201103026-639481419
Opcode ID: 450be974b35869312c8a252f2ec94b579b2209e9f6e03f525f6f71d39b67c141
Instruction ID: 13a6367d985bccc6dbf1dc894952563955c21de53807d174b11c51073661f9bf
Opcode Fuzzy Hash: 450be974b35869312c8a252f2ec94b579b2209e9f6e03f525f6f71d39b67c141
Instruction Fuzzy Hash: C8012673B44341ABE75AEB24DC48F9673936B40B11F12C758FE982F6D2DA60D800E2C0

Uniqueness

Uniqueness Score: -1.00%

Function 120108A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\s3_both.c,0000027B,?,12010ADC,00000000,00000000,00000000,?,1200FF5C,?), ref: 120108B1
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\s3_both.c,00000288), ref: 12010909
CRYPTO_free.LIBEAY32(00000000), ref: 12010916

Strings

.\ssl\s3_both.c, xrefs: 120108A6, 12010900

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$O_free
String ID: .\ssl\s3_both.c
API String ID: 1526627863-639481419
Opcode ID: 04c9bb3f1fc993384073ef93ec0182061e742f77659b2f6aeddfd155bfdcaa9c
Instruction ID: 4efec02a1448f7149f3a594e8bed9f6f1dc1118761b253bb80769839fc49bb45
Opcode Fuzzy Hash: 04c9bb3f1fc993384073ef93ec0182061e742f77659b2f6aeddfd155bfdcaa9c
Instruction Fuzzy Hash: 5F01B172B84251DBE755CB14C888FA677A2AB40712F0687A8EDC92F292CA30DC40D691

Uniqueness

Uniqueness Score: -1.00%

Function 120218C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000A8,000000BE,.\ssl\ssl_lib.c,000003C3), ref: 120218F5
X509_check_private_key.LIBEAY32(?,00000000), ref: 1202190F
ERR_put_error.LIBEAY32(00000014,000000A8,000000B1,.\ssl\ssl_lib.c,000003BE), ref: 1202192E

Strings

.\ssl\ssl_lib.c, xrefs: 120218E4, 1202191D

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$X509_check_private_key
String ID: .\ssl\ssl_lib.c
API String ID: 2185167962-3333140318
Opcode ID: 5fd8d3fd17ff02855cdea1295055afd485d655289ee403e6f515bcc8fc0fd4e7
Instruction ID: b2a998cc20b070d6a0813a1b8a1e73f7a46db212a9ff844c318f1912d6fb934a
Opcode Fuzzy Hash: 5fd8d3fd17ff02855cdea1295055afd485d655289ee403e6f515bcc8fc0fd4e7
Instruction Fuzzy Hash: CEF0627E7413016FEB41E714CC41F9672E16F45B06F8581B4B509AF2D1DBA0D940F662

Uniqueness

Uniqueness Score: -1.00%

Function 1200A830 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(0000042C,.\ssl\s3_lib.c,00000BCD), ref: 1200A840
_memset.LIBCMT ref: 1200A859
SSL_SRP_CTX_init.SSLEAY32(?,00000000,00000000,0000042C), ref: 1200A880

Strings

.\ssl\s3_lib.c, xrefs: 1200A836

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocX_init_memset
String ID: .\ssl\s3_lib.c
API String ID: 1540161045-3880942756
Opcode ID: 0915130969d44ade3d5585e11936ada1da2e75d3408142a69f6fa32276d31749
Instruction ID: 4284b7a5adff3512d1d577f23cc0acca0d5ab677643052a13cf1d0cfe4bb30cc
Opcode Fuzzy Hash: 0915130969d44ade3d5585e11936ada1da2e75d3408142a69f6fa32276d31749
Instruction Fuzzy Hash: CAF0B472A517105FE3A1DB39DC40FDBBBE49F89720F014529F5489B240D36468818BC5

Uniqueness

Uniqueness Score: -1.00%

Function 1201E010 Relevance: 6.2, APIs: 4, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 1201DEA0: pqueue_peek.LIBEAY32(?), ref: 1201DEBA
Part of subcall function 1201DEA0: pqueue_peek.LIBEAY32(?), ref: 1201DEFE
Part of subcall function 1201DEA0: pqueue_pop.LIBEAY32(?), ref: 1201DF1F
Part of subcall function 1201DEA0: CRYPTO_free.LIBEAY32(?,00000000), ref: 1201DF39
Part of subcall function 1201DEA0: pqueue_free.LIBEAY32(00000000,?,00000000), ref: 1201DF3F
Part of subcall function 1201DEA0: pqueue_peek.LIBEAY32(?), ref: 1201DFAD

pqueue_pop.LIBEAY32(?), ref: 1201E03C
CRYPTO_free.LIBEAY32(?,00000000), ref: 1201E287
pqueue_free.LIBEAY32(00000000,?,00000000), ref: 1201E28D

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: pqueue_peek$O_freepqueue_freepqueue_pop
String ID:
API String ID: 4057555279-0
Opcode ID: 10f94f95e3c494465a81251255d24b838a62fd92722eeecb24a3a3c9821e5396
Instruction ID: 57eb2a87194a039341d8ea663d74c7a76e25ac00915f4a9a1ed5d98774aa4227
Opcode Fuzzy Hash: 10f94f95e3c494465a81251255d24b838a62fd92722eeecb24a3a3c9821e5396
Instruction Fuzzy Hash: 8B71B172A00652ABD71ACF15C8947EEB7E5BF45308F048329EC498FA41D338F991EB91

Uniqueness

Uniqueness Score: -1.00%

Function 1201C025 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 120101B0: ERR_put_error.LIBEAY32(00000014,0000008C,00000095,.\ssl\s3_both.c,00000111), ref: 12010263

BUF_MEM_free.LIBEAY32(?), ref: 1201C2D6

Part of subcall function 1201C6C0: SSL_get_rbio.SSLEAY32(1201AFE9,0000002D,00000000,8AFFFD3E,00000000,1201AFE9,?), ref: 1201C706
Part of subcall function 1201C6C0: BIO_ctrl.LIBEAY32(00000000,?), ref: 1201C70F

BUF_MEM_new.LIBEAY32 ref: 1201C0CE
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1201C0E7
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1201C197

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrl$L_get_rbioM_freeM_growM_newR_put_error
String ID:
API String ID: 3339721261-0
Opcode ID: 6888b1e7769436cdf5371e69e6fcb82eaee2f7832308559fa8d908d8be5289fa
Instruction ID: 6bec10b77c41ed53c15b67c0645117885b4eedf44ecf98ec8416130a246f2f7e
Opcode Fuzzy Hash: 6888b1e7769436cdf5371e69e6fcb82eaee2f7832308559fa8d908d8be5289fa
Instruction Fuzzy Hash: 8651E0B7A017448FD366CF59D984AABB7E0EF48704F040A2EE48A8BB51C774F544DB86

Uniqueness

Uniqueness Score: -1.00%

Function 1201C003 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 12006AD0: ERR_put_error.LIBEAY32(00000014,00000121,00000041,.\ssl\s3_clnt.c,0000098E), ref: 12006C05

BUF_MEM_new.LIBEAY32 ref: 1201C0CE
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1201C0E7
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1201C197
BUF_MEM_free.LIBEAY32(?), ref: 1201C2D6

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrlR_put_error
String ID:
API String ID: 3213175576-0
Opcode ID: f8d513bb6a6f664f62d14029cc6684ef248cc1325864a56562d4b9ebc9843801
Instruction ID: 56d30c3d18a724a1117b877af2fe0175943aa8762d0c219e1f9188e9c8319209
Opcode Fuzzy Hash: f8d513bb6a6f664f62d14029cc6684ef248cc1325864a56562d4b9ebc9843801
Instruction Fuzzy Hash: 2551DDB79017448FD366CF55D944AABB7E0EF48B08F000A2EE48A8BB00C770F544EB86

Uniqueness

Uniqueness Score: -1.00%

Function 1200A352 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 12006890: ERR_put_error.LIBEAY32(00000014,0000011B,00000041,.\ssl\s3_clnt.c,00000926), ref: 120069B3

BUF_MEM_free.LIBEAY32(?), ref: 1200A0D4
BUF_MEM_new.LIBEAY32 ref: 1200A439
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1200A452
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200A4E3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrlR_put_error
String ID:
API String ID: 3213175576-0
Opcode ID: e81efd18566811c1c5e0b2208e9422d2f6430107a959cc0094655f1ecf06a6aa
Instruction ID: b99aa0f3ce1186634ed41a6dbccd9457d558623d21f031ff940b24d93782218c
Opcode Fuzzy Hash: e81efd18566811c1c5e0b2208e9422d2f6430107a959cc0094655f1ecf06a6aa
Instruction Fuzzy Hash: FD4103B75007498BF222DF14C944BABB2E1AF84385F000B2DEA4646A41C771F5C4EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 1200A374 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 12006AD0: ERR_put_error.LIBEAY32(00000014,00000121,00000041,.\ssl\s3_clnt.c,0000098E), ref: 12006C05

BUF_MEM_free.LIBEAY32(?), ref: 1200A0D4
BUF_MEM_new.LIBEAY32 ref: 1200A439
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1200A452
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200A4E3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrlR_put_error
String ID:
API String ID: 3213175576-0
Opcode ID: 9539717fc82090841a6477f9c48c2b4527e7abf350f2c21e0da28da14ebf114c
Instruction ID: 0c087e7bc586c5e22e6db1742f2bb5c5f27c479f1a02349e90fbd1691bf7a6f6
Opcode Fuzzy Hash: 9539717fc82090841a6477f9c48c2b4527e7abf350f2c21e0da28da14ebf114c
Instruction Fuzzy Hash: 2B4103B75007498BF222DF14C944BABB2E1EF84785F000B2DEA4646A41C771F5C4EB9A

Uniqueness

Uniqueness Score: -1.00%

Function 1200A29A Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 12008460: _memset.LIBCMT ref: 120084B7

BUF_MEM_free.LIBEAY32(?), ref: 1200A0D4
BUF_MEM_new.LIBEAY32 ref: 1200A439
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1200A452
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200A4E3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrl_memset
String ID:
API String ID: 3432697489-0
Opcode ID: 47ea92a3b10f6e484c3e47e81149dde95b9cb3951fd709beb51e6547ff519d73
Instruction ID: bca9df98b231997b2b143aff6c9033463b37addd252447516ec377e850d2c323
Opcode Fuzzy Hash: 47ea92a3b10f6e484c3e47e81149dde95b9cb3951fd709beb51e6547ff519d73
Instruction Fuzzy Hash: 9941E2B75007498BF222DF14C944BABB2E1BF84785F000B2EEA4686A41D771F5C4EB5A

Uniqueness

Uniqueness Score: -1.00%

Function 1200DAA0 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

BIO_free.LIBEAY32(?,?,12005543,?), ref: 1200DAB3
BIO_s_mem.LIBEAY32(?), ref: 1200DAD0
BIO_new.LIBEAY32(00000000), ref: 1200DAD6
BIO_ctrl.LIBEAY32(?,00000009,00000001,00000000), ref: 1200DB06

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_mem
String ID:
API String ID: 458502033-0
Opcode ID: 1c45b28d61f0ad82a6c46159ce46a965e32226bcd34765ccc1a106e22cd95210
Instruction ID: e5eb65a93b022c7f8d17163c7d7d43fb4af389e80e97330e05c627104fbbb17a
Opcode Fuzzy Hash: 1c45b28d61f0ad82a6c46159ce46a965e32226bcd34765ccc1a106e22cd95210
Instruction Fuzzy Hash: 53F0AF76A043008FF781D729E848FEA73F4AF04318F440679E40A8B292E6B1F8859796

Uniqueness

Uniqueness Score: -1.00%

Function 12024BE0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

EVP_MD_CTX_destroy.LIBEAY32(?,?,1200CB70,?,?), ref: 12024BEC
EVP_MD_CTX_create.LIBEAY32(?,1200CB70,?,?), ref: 12024BFA
EVP_DigestInit_ex.LIBEAY32(00000000,1200CB70,00000000,?,1200CB70,?,?), ref: 12024C11
EVP_MD_CTX_destroy.LIBEAY32(00000000,?,1200CB70,?,?), ref: 12024C24

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: X_destroy$DigestInit_exX_create
String ID:
API String ID: 3088442214-0
Opcode ID: 180b25277a5edbb6a4de63bb28c6ad4063e39d0cbd65a9048fa88ea7aae549ab
Instruction ID: a64396ac26e1575533b7b550bc40081e38a5d9fc0cb932585eddcae84ff47a53
Opcode Fuzzy Hash: 180b25277a5edbb6a4de63bb28c6ad4063e39d0cbd65a9048fa88ea7aae549ab
Instruction Fuzzy Hash: 5AF0FEB6A042025AEB92DF69A805BA6B3F89F14312F16192DEC84C7640EA74E440A761

Uniqueness

Uniqueness Score: -1.00%

Function 120123F0 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

SSL_get_ciphers.SSLEAY32(?), ref: 120123F7
sk_num.LIBEAY32(00000000,?), ref: 12012401
sk_value.LIBEAY32(00000000,00000000), ref: 12012412
sk_num.LIBEAY32(00000000), ref: 12012422

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$L_get_cipherssk_value
String ID:
API String ID: 1850632280-0
Opcode ID: d33d7f61b347c784fe951a15459f6c4892c83f731573176477c36110b5a8030b
Instruction ID: 9e5d95a4b87705048e3106e91ea4b8ca7e1f655a0b81faf8dda5867405f237a9
Opcode Fuzzy Hash: d33d7f61b347c784fe951a15459f6c4892c83f731573176477c36110b5a8030b
Instruction Fuzzy Hash: B3E02BBF9000201F8762D6297C019BBA2A89B92661B090639FC048A100E515E943E6E6

Uniqueness

Uniqueness Score: -1.00%

Function 120253E0 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

EVP_sha1.LIBEAY32(?,120187AC,?,?,00000000,12001A88,?), ref: 120253E1
EVP_sha1.LIBEAY32(?,120187AC,?,?,00000000,12001A88,?), ref: 120253ED
EVP_sha1.LIBEAY32(?,120187AC,?,?,00000000,12001A88,?), ref: 120253F5
EVP_sha1.LIBEAY32(?,120187AC,?,?,00000000,12001A88,?), ref: 120253FD

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: P_sha1
String ID:
API String ID: 360267384-0
Opcode ID: 428f2d06466e459424aa0c8781c48ceab85250140c36ecd5b52aa9e450823e26
Instruction ID: 150ce3923e4f23331064fc999c593fa1aa040ffe9712d7a6d6e4322f9afedbcf
Opcode Fuzzy Hash: 428f2d06466e459424aa0c8781c48ceab85250140c36ecd5b52aa9e450823e26
Instruction Fuzzy Hash: 11D0BC7A805F908ECAA2EBB190041ABBAF8BF48212B014A5BD59597610D734B441DB71

Uniqueness

Uniqueness Score: -1.00%

Function 1201A8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\t1_ext.c,000000A8,!(meth->ext_flags & SSL_EXT_FLAG_SENT),?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201AA00

Strings

!(meth->ext_flags & SSL_EXT_FLAG_SENT), xrefs: 1201A9F1
.\ssl\t1_ext.c, xrefs: 1201A9FB

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: Open
String ID: !(meth->ext_flags & SSL_EXT_FLAG_SENT)$.\ssl\t1_ext.c
API String ID: 71445658-3815644718
Opcode ID: aaf279ba7f84141ae2d446c6c06d44d80eefb1a54b39c281e2155a4b4d24a2b2
Instruction ID: b7bcf33c0cb85abf0f9b393a3ca955bc11e20355486537acdb4550e7738a8c42
Opcode Fuzzy Hash: aaf279ba7f84141ae2d446c6c06d44d80eefb1a54b39c281e2155a4b4d24a2b2
Instruction Fuzzy Hash: 1641E5765083428FD315CF24D9819ABB7E1BFC4205F058A2DF9999B341D334E988DB62

Uniqueness

Uniqueness Score: -1.00%

Function 12006AD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000121,00000041,.\ssl\s3_clnt.c,0000098E), ref: 12006C05

Strings

.\ssl\s3_clnt.c, xrefs: 12006B28, 12006B4C, 12006B81, 12006BDC, 12006BF2

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_clnt.c
API String ID: 1767461275-2155475665
Opcode ID: b366142c93b7080738ef380cdf5f58adc4fcb61f92868760dc7174de066bdda3
Instruction ID: 3577603839005f374002187a3bb882c98bdc74f2c8a9dced05c4ac4af2a1076a
Opcode Fuzzy Hash: b366142c93b7080738ef380cdf5f58adc4fcb61f92868760dc7174de066bdda3
Instruction Fuzzy Hash: F2312473A442117FF20AC714CC45FE5B7A29B41794F254379FA083E2E2C6A1A981D794

Uniqueness

Uniqueness Score: -1.00%

Function 1200536B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004E04
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 120055AC
BUF_MEM_free.LIBEAY32(?,?), ref: 120055FE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DF3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeO_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 489248819-3445611115
Opcode ID: 337d2dab09870fc0526cb3fc8f5bc2d5508e6fe3369b1012fea3a6377e1419fc
Instruction ID: f9529fadcd75281c6cfac812c5187d23cdb27fbef2b032917e9270967b2da783
Opcode Fuzzy Hash: 337d2dab09870fc0526cb3fc8f5bc2d5508e6fe3369b1012fea3a6377e1419fc
Instruction Fuzzy Hash: DF310732201701CBF321CF14D984A9ABBE6FF84759F410A2DE5499B680C732F905DB45

Uniqueness

Uniqueness Score: -1.00%

Function 120053DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004E04
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 120055AC

Strings

.\ssl\s3_srvr.c, xrefs: 12004DF3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 1094062903-3445611115
Opcode ID: 39426ab680038b5a5d2b1e860777c43811a5f1ed6b2dc76231c2e5102e9e71c5
Instruction ID: 687fb8e82ffed353e1f946399913733dac4564390e799e62c5f94e9164f5b96b
Opcode Fuzzy Hash: 39426ab680038b5a5d2b1e860777c43811a5f1ed6b2dc76231c2e5102e9e71c5
Instruction Fuzzy Hash: 653103736007418FF321CF04D985AAABBE6FB84759F450B2DE6465B690C372F901DB49

Uniqueness

Uniqueness Score: -1.00%

Function 120052C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004E04
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 120055AC

Strings

.\ssl\s3_srvr.c, xrefs: 12004DF3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 1094062903-3445611115
Opcode ID: 899298435561fb28c3ddfe05dda0730032355df6f5def8d937ca252fd847895f
Instruction ID: 1e9bdd4f44b77ba668c9420f2c158c588a0c0942686bd644f5f0df89b838b8a0
Opcode Fuzzy Hash: 899298435561fb28c3ddfe05dda0730032355df6f5def8d937ca252fd847895f
Instruction Fuzzy Hash: F731F2336417428BF321CF14E98569ABBE2FB80749F410B3DE2469B980C772F905EB59

Uniqueness

Uniqueness Score: -1.00%

Function 12005293 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 12003B90: EVP_MD_CTX_init.LIBEAY32(?), ref: 12003BBE
Part of subcall function 12003B90: BIO_free.LIBEAY32(?), ref: 1200403C
Part of subcall function 12003B90: EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200405C
Part of subcall function 12003B90: EVP_PKEY_free.LIBEAY32(00000000,?), ref: 12004062

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004E04
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 120055AC
BUF_MEM_free.LIBEAY32(?,?), ref: 120055FE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DF3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeO_ctrlO_freeR_put_errorX_cleanupX_initY_free
String ID: .\ssl\s3_srvr.c
API String ID: 1095167141-3445611115
Opcode ID: f4bb8e4497d6b0c561fa9370712a570a7080ce692c944a9fd5784fb65c465711
Instruction ID: d624d839448c861d4b02231766978e34513f038aa923b4eab561d0b7e15318fd
Opcode Fuzzy Hash: f4bb8e4497d6b0c561fa9370712a570a7080ce692c944a9fd5784fb65c465711
Instruction Fuzzy Hash: 5B2136736007428BF321CF14E9856AEBBE2FB80759F450B3DE24697680C232F905EB49

Uniqueness

Uniqueness Score: -1.00%

Function 1200E34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000124,00000085,.\ssl\s3_pkt.c,0000068E), ref: 1200E39D
ERR_put_error.LIBEAY32(00000014,00000124,00000044,.\ssl\s3_pkt.c,000006AA), ref: 1200E413

Strings

.\ssl\s3_pkt.c, xrefs: 1200E38C, 1200E405

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_pkt.c
API String ID: 1767461275-4041216366
Opcode ID: f88c94848a449550fc699e0abb648091ab431aea02e40ecb5dc6528d34fb59f6
Instruction ID: 2c9c9780b7afee0b07ecce880a50df373d03a685facca74a6d70121c7cbb957f
Opcode Fuzzy Hash: f88c94848a449550fc699e0abb648091ab431aea02e40ecb5dc6528d34fb59f6
Instruction Fuzzy Hash: 5021BC763403019FF304DB18D984F9677E6BF88324F0542A8E94A9B391DB70F882CB81

Uniqueness

Uniqueness Score: -1.00%

Function 12005327 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 12004590: i2d_SSL_SESSION.SSLEAY32(?,00000000), ref: 120045D3
Part of subcall function 12004590: CRYPTO_malloc.LIBEAY32(00000000,.\ssl\s3_srvr.c,00000D87), ref: 120045FC
Part of subcall function 12004590: EVP_CIPHER_CTX_init.LIBEAY32(?), ref: 12004613
Part of subcall function 12004590: HMAC_CTX_init.LIBEAY32(?,?), ref: 12004620
Part of subcall function 12004590: i2d_SSL_SESSION.SSLEAY32(?,?,?,?), ref: 12004635
Part of subcall function 12004590: d2i_SSL_SESSION.SSLEAY32(00000000,?,00000000), ref: 12004651
Part of subcall function 12004590: i2d_SSL_SESSION.SSLEAY32 ref: 1200466D
Part of subcall function 12004590: i2d_SSL_SESSION.SSLEAY32(00000000,?,00000000,00000000), ref: 12004693
Part of subcall function 12004590: SSL_SESSION_free.SSLEAY32(00000000,?,?,00000000,00000000), ref: 120046A4
Part of subcall function 12004590: BUF_MEM_grow.LIBEAY32(?,?,00000000,?,?,00000000,00000000), ref: 120046C2

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004E04
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 120055AC
BUF_MEM_free.LIBEAY32(?,?), ref: 120055FE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DF3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: i2d_$X_init$M_freeM_growN_freeO_ctrlO_mallocR_put_errord2i_
String ID: .\ssl\s3_srvr.c
API String ID: 4031021300-3445611115
Opcode ID: 7e60bf4006b52bf4b4ecd6f4fd02d712bd83ff32be11b9f25012be45100ea959
Instruction ID: 5be30ed865807980ed32c48d0bc4a6dddb73705ed524085141f7224b5912b71a
Opcode Fuzzy Hash: 7e60bf4006b52bf4b4ecd6f4fd02d712bd83ff32be11b9f25012be45100ea959
Instruction Fuzzy Hash: 632105735017428BF321CE14E9855AEBBD6FB80799F410A3DE24597580C372F905AB5A

Uniqueness

Uniqueness Score: -1.00%

Function 12005349 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 12004AF0: BUF_MEM_grow.LIBEAY32(?,?), ref: 12004B1C

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004E04
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 120055AC
BUF_MEM_free.LIBEAY32(?,?), ref: 120055FE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DF3

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growO_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 234834961-3445611115
Opcode ID: 13c7ac5ef9ae9368b90e5d6698fc157a6bcede7c401ca5691579cf375a8ee108
Instruction ID: 39846fe413898d05b05c1d8eb937bb21e64bd718970c42eafff4f64cc1c72a59
Opcode Fuzzy Hash: 13c7ac5ef9ae9368b90e5d6698fc157a6bcede7c401ca5691579cf375a8ee108
Instruction Fuzzy Hash: 952105735017428BF321CE14E9855AEBBD6FB80799F410A3DE24597580C372F905AB5A

Uniqueness

Uniqueness Score: -1.00%

Function 1201AB80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SSL_extension_supported.SSLEAY32(?,?,?,1201AC53,?,?,?,?), ref: 1201AB96
CRYPTO_realloc.LIBEAY32(?,?,.\ssl\t1_ext.c,000000F7), ref: 1201ABD0

Strings

.\ssl\t1_ext.c, xrefs: 1201ABC7

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: L_extension_supportedO_realloc
String ID: .\ssl\t1_ext.c
API String ID: 2810361572-2266425821
Opcode ID: 82da742607bc6528f8835070fd11d94423aef197c2c9225b7dbf02c99039ad60
Instruction ID: a50f2c8b7bc49900d97b6cfe1590c761c10101b41793ccf9f34d5ef429b481df
Opcode Fuzzy Hash: 82da742607bc6528f8835070fd11d94423aef197c2c9225b7dbf02c99039ad60
Instruction Fuzzy Hash: 6C1151F66043429FE306CF18D890AA7B3E6EF44314B05467ED908CB352EB30E954DB91

Uniqueness

Uniqueness Score: -1.00%

Function 12016A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

.\ssl\t1_lib.c, xrefs: 12016A93

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID:
String ID: .\ssl\t1_lib.c
API String ID: 0-2047370388
Opcode ID: 5042fb4943c449c06c75aa6fa3499dc7286a15756687161289b78425cf9c04b3
Instruction ID: 25c7bfdc7f0d54669176c33e83095e7cd4519b434ca51cbcff906f6562e8d60c
Opcode Fuzzy Hash: 5042fb4943c449c06c75aa6fa3499dc7286a15756687161289b78425cf9c04b3
Instruction Fuzzy Hash: 1601D1777082015FD792CB28FC44BEB73E89FC4720F054569F4889B240D220EC86AA91

Uniqueness

Uniqueness Score: -1.00%

Function 1202B8A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000C9,00000043,.\ssl\ssl_rsa.c,00000133), ref: 1202B8BC
ERR_put_error.LIBEAY32(00000014,000000C9,00000041,.\ssl\ssl_rsa.c,00000137), ref: 1202B8F3

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B8AE, 1202B8E5

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: 1d82cb92d9fb067031d2d12c1143018714a3d9033425538ac4ebfb815d9ec3d0
Instruction ID: 64b5564d800d434e6a4ca77e41f80b5b72259c1aa2d02fb32883d1d7888feef4
Opcode Fuzzy Hash: 1d82cb92d9fb067031d2d12c1143018714a3d9033425538ac4ebfb815d9ec3d0
Instruction Fuzzy Hash: 15F02EBB7C420439F541D36CBC42FE7A3545F90B21F594637FA097B1C5F550B250A0A6

Uniqueness

Uniqueness Score: -1.00%

Function 1202CAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000AB,00000043,.\ssl\ssl_rsa.c,0000017E), ref: 1202CB0C
ERR_put_error.LIBEAY32(00000014,000000AB,00000041,.\ssl\ssl_rsa.c,00000182), ref: 1202CB43

Strings

.\ssl\ssl_rsa.c, xrefs: 1202CAFE, 1202CB35

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: 43310632096b71f0eeca6cbc1750666428dd2ff7666e2b3ec458de431a8d2977
Instruction ID: c7968de1487dffa08922436a08e81d7fcb1d68225ef30b37b84cf0f45c216e94
Opcode Fuzzy Hash: 43310632096b71f0eeca6cbc1750666428dd2ff7666e2b3ec458de431a8d2977
Instruction Fuzzy Hash: B9F089F7B813043AF511D7E46C82FD773941F04711F594572FB0AAA1C1E691E56061A6

Uniqueness

Uniqueness Score: -1.00%

Function 12022890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 120228A1
CRYPTO_malloc.LIBEAY32(?,.\ssl\ssl_lib.c,000006E9), ref: 120228B8

Strings

.\ssl\ssl_lib.c, xrefs: 120228B2

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\ssl_lib.c
API String ID: 2609694610-3333140318
Opcode ID: de07ffb741a509846b2486cfb800cf705ee8f5ccfdd36557b04e73b38d96a9bf
Instruction ID: 79caf1ff434ec3506543a350a09ee50995ea871f8df7b5b0885dbdedb92e2f70
Opcode Fuzzy Hash: de07ffb741a509846b2486cfb800cf705ee8f5ccfdd36557b04e73b38d96a9bf
Instruction Fuzzy Hash: 77F08CB7B062126FE702CB69EC04ADBF798AF94320F04063AF40897640E771E81192E6

Uniqueness

Uniqueness Score: -1.00%

Function 12022200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000), ref: 1202222E
ERR_put_error.LIBEAY32(00000014,0000010F,000000B9,.\ssl\ssl_lib.c,00000578), ref: 12022250

Strings

.\ssl\ssl_lib.c, xrefs: 1202223F

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_num
String ID: .\ssl\ssl_lib.c
API String ID: 3777708388-3333140318
Opcode ID: f6675f3939b26cfd8be038b38e11b2b65551ca4b1a3f2a6ac5d22be2b110add4
Instruction ID: 367c2033b39ec97fd19eedb11848ce2af45310954ec3419c8b8fc9ed53ff6a2e
Opcode Fuzzy Hash: f6675f3939b26cfd8be038b38e11b2b65551ca4b1a3f2a6ac5d22be2b110add4
Instruction Fuzzy Hash: A3F089FE6402006FE704D760CC45FA733D45F84B01F4547B5BA0957691E961E904D551

Uniqueness

Uniqueness Score: -1.00%

Function 1202FA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000018,.\ssl\bio_ssl.c,0000006A), ref: 1202FA89
ERR_put_error.LIBEAY32(00000020,00000076,00000041,.\ssl\bio_ssl.c,0000006C), ref: 1202FAA4

Strings

.\ssl\bio_ssl.c, xrefs: 1202FA82, 1202FA99

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocR_put_error
String ID: .\ssl\bio_ssl.c
API String ID: 2513334388-1980322992
Opcode ID: fb7db9a0fa85f5af405eb41814dcb128f6be599218f2c868a43c8ff0668c946c
Instruction ID: 802fcc642077d98e81da0c70545ac8682efb434e42f5620554c953c54b98115c
Opcode Fuzzy Hash: fb7db9a0fa85f5af405eb41814dcb128f6be599218f2c868a43c8ff0668c946c
Instruction Fuzzy Hash: B8F058B5A883009FE758CF18E806B41BBE0FB08701F46C2BEB50DDB392C674D5409A89

Uniqueness

Uniqueness Score: -1.00%

Function 12021AB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000D0,00000114,.\ssl\ssl_lib.c,00000416), ref: 12021AD0
ERR_put_error.LIBEAY32(00000014,000000D0,000000CF,.\ssl\ssl_lib.c,0000041C), ref: 12021AFF

Strings

.\ssl\ssl_lib.c, xrefs: 12021ABF, 12021AEB

Memory Dump Source

Source File: 00000005.00000002.1777437719.0000000012001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 12000000, based on PE: true

Associated: 00000005.00000002.1777412148.0000000012000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777773566.000000001203F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777869782.000000001204D000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777894589.000000001204E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.1777937977.0000000012053000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 1767461275-3333140318
Opcode ID: d98c9f24964c0f0dacc448c48a485c53f19923425c201c53bfb26dcad8f17178
Instruction ID: 07c59985703a1e2cd6daa15d467d377df9aca9706cf9ae05ca542938903f8b4a
Opcode Fuzzy Hash: d98c9f24964c0f0dacc448c48a485c53f19923425c201c53bfb26dcad8f17178
Instruction Fuzzy Hash: 82F082BD7803046FF611D724CC42F857AA06B44B19F9547A8B6196F9D3E3B1D840E554

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\49a7b8.rbs

C:\Program Files (x86)\Remote Utilities - Host\EULA.rtf

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\MessageBox.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\VPDAgent.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\emf2pdf.dll

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\fwproc.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\pdfout.dll

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\printer.ico

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\progressbar.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\properties.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\rupd.lng

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\srvinst.exe

C:\Program Files (x86)\Remote Utilities - Host\Printer\common\vpd_sdk.dll

Windows Analysis Report
3_#U0420#U0430#U0445#U0443#U043d#U043e#U043a.pdf.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre